Privacy Policy
Effective date: 2026-06-17 Operator: Poor Dude Holdings LLC (Wyoming), through its operating subsidiaries.
1. Data we collect
- Account data: name, email, and account creation timestamp. Sign-in is handled by Clerk, which stores a hashed password; we never see your password.
- Application data: your listings (title, description, price, size, condition, photos), your shows and episodes (videos and thumbnails), and your orders as buyer and seller.
- Payment data: processed by Stripe. We never see or store full card numbers; we store only Stripe customer IDs and last-4 digits where displayed.
- Telemetry: request logs, error traces, device identifiers (used for fraud prevention and performance debugging).
2. Why we collect it
- To run the marketplace: accounts, listings, shows, orders and payouts.
- To take payments and pay sellers, through Stripe.
- To prevent fraud and abuse.
- To keep the records the law and the tax authorities require us to keep.
- To improve the product (telemetry only, never sold).
3. How long we keep it
| Category | Retention |
|---|---|
| Account data | While account is active + 30 days after deletion request |
| Payment records | 7 years (IRS / Stripe requirements) |
| Audit logs | 7 years (regulatory minimum) |
| Application data | While the account is active. When you delete your account, your listings are taken down straight away; completed orders are kept as financial records with your name and address removed, for as long as tax and legal rules require |
| Telemetry | 90 days |
4. Who we share with
We share personal data only with the services that run Velvet Rack — nothing else. Each one receives only what it needs to do its job:
- Stripe — payments. Stripe processes card payments and pays sellers through Stripe Connect. We never see or store your card details.
- Clerk — sign-in and identity. Clerk handles email and password sign-in, Google sign-in, and email verification.
- Convex — database and backend. Convex stores accounts, listings, orders and shows, and runs the marketplace logic.
- Vercel — web hosting. Vercel serves the Velvet Rack website.
- Google Play — app distribution. Google distributes the Android app and handles the install.
We do not sell personal data to advertisers or data brokers.
5. Your rights
- Access — request a copy of your data.
- Deletion — request account deletion (GDPR Art. 17, CCPA).
- Correction — request fixes to inaccurate data.
- Portability — export your data in JSON.
- Opt-out — unsubscribe from marketing emails at any time (one-click in every email).
Access, portability and deletion are self-service in the app, under Account & data on the home screen:
- Export my data returns your account, listings, orders on both sides and shows as JSON, immediately.
- Delete my account locks the account and takes down your listings straight away, then erases your personal details after a 30-day window during which you can change your mind. Completed orders are kept as financial records with your name and address removed — see the retention table above. Deletion is refused while you have an order in progress, because a sale in flight is a commitment to the person on the other side of it; finish or refund it first.
If you no longer have the app installed, https://velvet-rack.vercel.app/account/delete sets out the same process and an email route that does not require it.
For correction, opt-out, or anything the app cannot do for you, write to privacy@poordudeholdings.com. We respond within 30 days (CCPA) / 1 month (GDPR).
6. Children
Velvet Rack is for adults 18 and over. We do not knowingly collect data from anyone under 18. Contact us if a minor's data was submitted in error and we will delete it.
7. International transfers
Data may be processed in the United States. EU/UK users: we rely on the EU-US Data Privacy Framework / UK Extension and standard contractual clauses where required.
8. Security
- TLS 1.2+ in transit
- Encryption at rest for sensitive fields (payment data, credentials)
- Role-based access control
- Quarterly secret rotation
- Audit logging of all sensitive operations
- Annual security reviews
Reports: see SECURITY.md.
9. Changes
We post the "Effective date" at the top of this document. Material changes are announced via email to active account holders 30 days before they take effect.
10. Contact
Poor Dude Holdings LLC Wyoming, USA privacy@poordudeholdings.com