Privacy policy

Rummage (rummage.nz) is a New Zealand service that helps people run second-hand sales online. It is operated by Rummage limited (“we”, “us”).

Privacy enquiries: privacy@rummage.nz.

This policy describes how we handle personal information when you use Rummage as a buyer, seller, or visitor. Rummage is New Zealand only; prices and payments are in NZD.

Depending on how you use the service, we may collect:

• Account details: name, email, and sign-in data via Clerk (including optional social login).
• Profile & location: your physical address (private), closest town and city (shown on your listings), optional phone number and profile picture.
• Seller payment settings: optional bank account details and payment message (shared with buyers only after a purchase or accepted offer); Stripe Connect account IDs and capability status if you accept card payments.
• Listings & interactions: sale and item details, photos, questions, answers, offers, and messages.
• Transactions: payment amounts, methods, status, Stripe session references, fulfilment choices, and buyer email for guest checkout.
• Notifications: in-app notification history and transactional emails we send you.
• Reports & moderation: item reports you submit and actions taken by administrators.
• Technical data: server logs and security records needed to operate and protect the service.

We do not store raw card numbers. Card payments are handled by Stripe Checkout.

We use personal information to:

• create and manage your account;
• publish and operate listings, questions, and offers;
• facilitate card payments through Stripe;
• share contact and fulfilment details when a sale proceeds;
• send transactional emails and in-app notifications;
• moderate content, handle reports, and prevent abuse;
• comply with law and keep the service secure.

Rummage is link-based: sales are shared by URL, not browsed on a public marketplace feed. Other users may see:

• your closest town and city on listings you sell;
• questions and answers on items (per our visibility rules);
• your name or username where shown in notifications or transactional messages.

Your full address, bank details, and payment message are not shown on public listing pages. Bank details and seller email may be included in purchase or offer-accepted notifications to the buyer.

We use trusted service providers, including:

• Clerk, for authentication and account management;
• Stripe, for seller Connect onboarding and card payments;
• Resend (or equivalent), for transactional email;
• Railway (or equivalent), for hosting and database.

We do not sell your personal information. We may disclose information if required by law or to protect users and the platform.

Some providers may store or process data outside New Zealand (for example, the United States). Where this occurs, we rely on appropriate contractual and security measures offered by those providers.

Data is stored in our application database and on our servers (including listing images). We use HTTPS in production, access controls, and industry-standard practices. No system is perfectly secure; please use a strong password and keep your account details safe.

We keep information for as long as your account is active and as needed for transactions, moderation, and legal obligations. Deleted listings may be soft-deleted rather than immediately erased. Payment records may be retained for accounting and dispute purposes.

Under the Privacy Act 2020, you may request access to or correction of personal information we hold about you. Contact privacy@rummage.nz.

You may complain to the Office of the Privacy Commissioner.

If a privacy breach is likely to cause serious harm, we will assess it promptly and notify affected individuals and the Privacy Commissioner as required by law.

We use essential cookies and similar technologies for authentication (via Clerk). We do not use advertising cookies at launch. If we add analytics or marketing tools later, we will update this policy.

Rummage is not directed at children. You must be old enough to form a binding contract to use the service.

We may update this policy from time to time. The “Last updated” date at the top will change when we do. Material changes may also be notified by email or in-app notice.

See also our Terms & conditions.