Privacy Policy

1. Overview

This policy covers the personal information Rackd collects when you create an account and place an order on this site, and what happens to it. It doesn’t cover the participating store’s own handling of information once you’re standing in front of their counter — see Terms of Service § 3 for how Rackd’s role and the store’s role split.

2. What we collect

Only what’s actually needed to run an account and a pickup order:

• Account info: name, email and/or phone number, and — if you sign up with Apple or Google — the name/email your provider shares with us.
• Age verification: the date of birth you self-attest at signup, and whether a store later confirmed 21+ in person. We don’t collect or store a copy of your photo ID — that check happens visually at pickup and isn’t recorded here.
• Order data: what you reserved, which store, and its status (reserved, ready, picked up, cancelled).
• Payment: handled entirely by Stripe — Rackd never receives or stores your card number. We keep a reference to the Stripe customer and payment records tied to your account so receipts and refunds work.
• SMS/marketing consent: whether you opted in to order-status texts and/or promotional texts, and the phone number consent applies to — see the checkboxes on your Account page, which is where you set these, not this policy.
• Basic technical data: standard web request data (IP address, browser) that our hosting and rate-limiting infrastructure sees automatically, the way any web server does.

We don’t run any analytics or ad-tracking scripts on this site.

3. How we use it

• To create and secure your account, and to let you sign back in.
• To reserve your order at the store you chose, process payment, and let the store see what to prepare.
• To text or email you about an order — confirmed, ready for pickup — if you opted into those messages.
• To text you promotions or loyalty offers, only if you separately opted into that (declining doesn’t affect your ability to order).
• To prevent abuse — the same rate-limiting that stops scripted signup/checkout attempts uses request data described above.

4. Who we share it with

We don’t sell personal information. It’s shared only with the vendors that make the site work, each only for the purpose below, and with the store you ordered from:

• The store you order from — your name, order contents, and enough contact info to hand off the order and text you if needed.
• Supabase — our database, authentication, and file-storage provider. Your account and order records live in Supabase’s infrastructure.
• Stripe — processes your payment and stores your payment method under its own privacy practices; we only hold a reference to it, not the card details.
• Twilio — sends the order-status and marketing texts you opted into.
• Resend — sends transactional emails (order confirmations, receipts).

We’d share information beyond this list only if the law requires it (a valid subpoena or court order) or to investigate fraud or a security incident.

5. How long we keep it

We keep account and order records as long as your account is active, plus a reasonable period after — stores and Rackd both have legitimate reasons to keep sales and age-verification records (tax, accounting, and compliance with tobacco/vapor retail record-keeping expectations). If you delete your account, we remove what we can while still meeting those obligations for records already tied to completed orders.

6. Your choices and rights

• Update your info: your name, phone, and marketing/order-text preferences are all editable directly on your Account page.
• Opt out of texts: uncheck the consent boxes on your Account page, or reply STOP to any text.
• Access, correction, or deletion: email us (below) from the address or with the phone number on your account so we can verify it’s really you, and we’ll act on it, subject to the retention needs in Section 5. If you’re a California resident, this includes your CCPA rights to know, delete, and correct your information, and we won’t discriminate against you for exercising them.

7. Security

Your account is protected by the password/PIN and login flow you set up, payment details never touch our servers (Stripe handles that directly), and our database access is governed by row-level security policies that scope what any given request can see. No system is perfectly secure, but we treat account and order data as sensitive by design, not as an afterthought.

8. Age

This site is for adults 21 and older. We don’t knowingly collect information from anyone under 21; see Terms of Service § 2.

9. Changes to this policy

If we change how we handle your information in a meaningful way, we’ll update the date at the top of this page. Continuing to use the site after that means you accept the update.

10. Contact

Questions, or a request to access/correct/delete your information: [email protected].