Privacy Policy

1. Introduction

StillRuns, Inc. (“Company,” “we,” “us,” or “our”) operates the StillRuns mobile application and website at stillruns.app (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use the Service.

By using the Service, you agree to the collection and use of information as described in this Privacy Policy.

2. Information We Collect

2.1 Information You Provide.

(a) Account Information: Name, email address, profile photo (optional), biography (optional), city and state (optional), and phone number when you verify your account or use account recovery. We do not collect, request, or store any government-issued identification. We perform no identity verification of any kind.

(b) Listing Information: Vehicle make, model, year, VIN, mileage, condition description, asking price, photographs, listing title, and any other information included in a vehicle listing.

(c) Communications: Messages sent through the Service’s messaging features, including offers and counter-offers. See Section 5 regarding message encryption.

(d) Payment Information: We do not collect or store payment card numbers or bank account details. All payment processing is handled by Stripe, Inc. We receive payment confirmation and Stripe transaction identifiers only.

2.2 Information We Collect Automatically.

(a) Usage Data: Information about your interactions, including pages or screens viewed, features accessed, search queries, listings viewed, listings saved, and offers submitted.

(b) Device Information: Device type, operating system version, unique device identifiers, IP address, browser type, and mobile network information.

(c) Anonymous Device Identifier: To prevent spam and power buyer engagement features for sellers, we assign a persistent anonymous device identifier (a randomly generated UUID) to your device when you first access the Service. This identifier persists between sessions and is cleared when you reinstall the app or clear site data. It is not linked to your name, email address, or user account. It is not shared with third parties. It is used solely to: (i) detect and prevent fraudulent or spam activity, such as artificial inflation of listing view counts; and (ii) enable seller-facing engagement signals, such as notifying a seller that the same anonymous user has viewed their listing multiple times. This identifier is not used for cross-site tracking or advertising.

2.3 Interest Affinity Profile.

If you are a signed-in user, we maintain an interest affinity profile associated with your account. This profile stores numerical weights reflecting your apparent preferences across vehicle categories, makes, manufacturing eras, and price ranges, derived from your in-app behavior. This data is used solely to personalize your listing feed. Interest weights decay over time. You may delete this profile by deleting your account.

3. How We Use Your Information

We use the information we collect to:

• (a) create and maintain your account and provide the Service’s features;
• (b) display and manage your vehicle listings;
• (c) deliver personalized feed rankings based on your interest affinity profile;
• (d) facilitate communications between buyers and sellers through in-app messaging;
• (e) process listing package payments through Stripe;
• (f) provide seller analytics tools;
• (g) send one-time verification, account security, and account recovery text messages when you request them;
• (h) send renewal reminders for Collector Pass subscribers;
• (i) detect, investigate, and prevent fraud, spam, abuse, and Terms violations;
• (j) comply with legal obligations;
• (k) defend against legal claims and maintain evidence for payment dispute resolution;
• (l) improve the Service; and
• (m) enforce our Terms of Service.

We do not sell your personal information to third parties for their direct marketing purposes.

4. Sharing of Your Information

We do not sell, rent, or trade your personal information. We share your information only in the following circumstances:

4.1 Other Users.

Information in a public listing (vehicle photos, description, price, city/state, seller profile) is visible to all users. Your username and profile are visible to users with whom you exchange messages.

4.2 Payment Processor.

We share information necessary to process payments with Stripe, Inc. Stripe’s use is governed by Stripe’s Privacy Policy at stripe.com/privacy.

4.3 Infrastructure Providers.

We use third-party providers for hosting, database storage, file storage, and content delivery. These providers process data on our behalf and are not permitted to use your data for their own purposes. Current providers include Supabase (database and authentication) and Twilio (SMS delivery and verification). As disclosed in our Terms of Service, we grant these providers a sublicense to your User Content solely as necessary to deliver their services to us.

We do not sell, rent, trade, or share your mobile phone number, SMS opt-in data, or text-message consent status with third parties or affiliates for their marketing or promotional purposes. We may share this information with service providers only as needed to deliver verification, account security, account recovery, support, fraud-prevention, compliance, and legal services for StillRuns.

4.4 Affiliate Program.

If you participate in our affiliate program, we process referral codes and commission data. We do not share your personal information with third-party affiliate networks.

4.5 Legal Requirements.

We may disclose your information if required by: (a) applicable law, regulation, or legal process; (b) enforcement of our Terms of Service; (c) protection of the rights, property, or safety of StillRuns, our users, or the public; or (d) fraud prevention.

4.6 Business Transfers.

In a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

5. Message Encryption

Messages sent through StillRuns are encrypted in transit using TLS and encrypted at rest. StillRuns retains the technical ability to access message content for the purposes of abuse investigation, enforcement of our Terms of Service, and compliance with legal process. StillRuns’ messaging does not use end-to-end encryption. Messages may be accessed by StillRuns personnel for the purposes described in this Privacy Policy.

6. Data Retention

6.1 Active Accounts.

We retain your personal information as long as your account is active or as necessary to provide the Service.

6.2 Account Deletion.

Upon account deletion, your personally identifiable information will be anonymized immediately and permanently deleted from our production systems within thirty (30) days. Listing content will be removed from public display upon account deletion.

6.3 Financial Records.

Records of financial transactions are retained for up to seven (7) years as required by law, in anonymized or pseudonymized form where feasible.

6.4 Chargeback and Dispute Defense.

Evidence snapshots collected at the time of listing removal are retained for the period reasonably necessary to defend against payment disputes and legal claims, not to exceed seven (7) years.

6.5 Communications.

Message content is retained while your account is active and deleted or anonymized within thirty (30) days of account deletion.

6.6 Legal Hold.

We may retain information beyond these periods if required by a legal hold, regulatory investigation, or ongoing proceeding.

7. Your Rights — California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act / California Privacy Rights Act:

• (a) Right to Know. Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the third parties with whom we share it.
• (b) Right to Delete. Request deletion of personal information we have collected from you, subject to certain exceptions.
• (c) Right to Correct. Request correction of inaccurate personal information we maintain about you.
• (d) Right to Opt-Out. We do not sell your personal information or share it for cross-context behavioral advertising.
• (e) Right to Non-Discrimination. We will not discriminate against you for exercising your rights.

7.1 How to Submit a Request.

Submit requests to: privacy@stillruns.app. Include your name, account email, and a description of your request.

7.2 Response Timeline.

We will respond within forty-five (45) days. If additional time is needed (up to 90 days total), we will notify you within the initial 45-day period.

7.3 Verification.

We must verify your identity before fulfilling a request.

8. Security & Data Breach Notification

8.1 Security Measures.

We implement industry-standard measures to protect your personal information, including TLS encryption in transit, encryption at rest, access controls, and system monitoring.

8.2 Notification Obligation.

In the event of a security breach involving unauthorized access to your unencrypted personal information — or encrypted information where the encryption key has been compromised — we will notify you in accordance with applicable law, including California Civil Code Section 1798.82.

8.3 What Triggers Notification.

Notification is required when there is unauthorized access to your name in combination with any of the following unencrypted data: Social Security number, driver’s license number, financial account number or credit/debit card number, medical information, health insurance information, or login credentials.

8.4 Timing.

We will provide notification no later than seventy-two (72) hours after discovering a qualifying breach, or as soon as reasonably practicable consistent with legitimate law enforcement needs.

8.5 Attorney General Notification.

If a breach affects more than five hundred (500) California residents, we will also notify the California Attorney General as required by California Civil Code Section 1798.82(f).

8.6 Content of Notice.

Breach notifications will include: the date of the breach, the type of information involved, steps we have taken to contain the breach, steps you can take to protect yourself, and our contact information.

9. Children’s Privacy

The Service is not directed to children under 18 and we do not knowingly collect personal information from children under 18. By using the Service, you represent that you are at least 18. If you believe we have inadvertently collected information from a child, contact us at privacy@stillruns.app.

10. Changes to This Privacy Policy

We may update this Privacy Policy. If we make material changes, we will notify you by email and/or by posting a notice on the Service at least thirty (30) days before the changes take effect. Your continued use after the effective date constitutes acceptance.

11. Contact Us

Privacy Inquiries: privacy@stillruns.app

StillRuns, Inc.