Privacy Policy

Effective date: 15 September 2025

We keep the minimum amount of personal information needed to run your account and to prove what happened if there’s ever a question about returning an item. This page explains what we collect, why, and how you can control it — in plain language.

What we collect

• Account basics: name (or alias), email, and a password hash.
• Tag ownership: which Rufftag IDs belong to your account.
• Return coordination: messages and contact details you choose to share with a finder during a return.
• Logs for non‑repudiation: timestamps and minimal technical metadata (e.g., event type, tag ID, coarse location where applicable, and masked IP) to help resolve disputes about a return.

What we do not collect

• No precise continuous location tracking of owners or finders.
• No unnecessary profile data (date of birth, demographics, etc.).
• No third‑party advertising trackers.

Why we collect it

• Run your account and let you manage your tags.
• Coordinate returns between finders and owners with the least data necessary.
• Non‑repudiation: keep a minimal, tamper‑evident record of key events (e.g., return initiated, message sent, tag marked returned) to help resolve disputes fairly.

How long we keep it

• Account basics: while your account is active; deleted within 30 days after you close your account (subject to legal holds).
• Return coordination data: retained for up to 180 days after a case closes, then deleted or irreversibly anonymised.
• Non‑repudiation logs: minimal event records kept for up to 2 years to handle disputes and fraud prevention, then deleted or anonymised.

Sharing

• With finders/owners: only the information each side chooses to share to complete a return.
• Service providers: trusted processors who help us run the service (e.g., hosting, email). They must follow this policy and process data only on our instructions.
• Legal: if required by law or to protect someone’s safety, prevent fraud, or defend our rights.

Your choices and rights

• Access, fix, or delete your data from account settings, or contact us.
• Opt out of non‑essential emails.
• Close your account at any time; we’ll delete data per the timeframes above.

Security

• We use industry‑standard measures (encryption in transit and at rest where appropriate, least‑privilege access, audit logging). No system is perfectly secure, but we design for safety and consent.

Children

• Rufftag is not directed to children under 13, and we do not knowingly collect their personal information.

Contact

• Email: privacy@rufftag.com

Changes to this policy

• We may update this page. We’ll post the new effective date and, for material changes, provide notice in‑app or by email.

Related: See also Cookie Policy and our Privacy & Trust overview for product principles.