Privacy Policy
Last updated: April 2026.
What we collect
- Account: email, username, display name, optional avatar + bio + location.
- Collection data: the entries, wantlist items, photos, restoration logs, and provenance records you create.
- Activity: comments you post, wantlist matches, transactions, reviews.
- Technical: IP address, browser type, timestamps for security and abuse prevention.
How we use it
- To run the collection-tracking and wantlist features.
- To match wantlists to public entries and listings (you can dismiss matches at any time).
- To send transactional emails (signup, password reset, matches).
- To detect and prevent abuse.
We do not sell your data. We do not run third-party ad networks.
What’s public vs private
Each catalog entry has a visibility flag: PRIVATE, UNLISTED, or PUBLIC. Public entries appear on your /@username page and are indexable by search engines. Your wantlist is always private. Your purchase prices and personal notes are always private.
Third-party services
- Neon (Postgres) stores your account and content.
- Cloudflare R2 stores uploaded photos.
- Resend sends transactional emails.
- Stripe Connect (when marketplace launches) handles payments + payouts. Stripe’s privacy policy applies to payment data.
Your rights
- Access: Download your data at any time from account settings.
- Deletion: Delete your account; we remove personal data within 30 days. Anonymized aggregate data (e.g., how many Mac SE/30s are in the community) may be retained.
- Correction: Edit your profile and entries at any time.
- Portability: Your data export is a standard JSON file.
GDPR / CCPA
If you’re in the EU/EEA or California, you have additional rights under the GDPR and CCPA. To exercise them, email privacy@orchardapp.io.
Children
Orchard is not intended for children under 13 and we do not knowingly collect data from them.
Changes
We may update this policy. Material changes will be announced by email at least 30 days before they take effect.