Privacy Policy

• Account details — your email address and name, from the account you sign in with.
• Addresses and phone numbers — a seller's ship-from address, the ship-to address captured on each order, and the phone numbers carriers require to print a label.
• Listings and photos — everything you write about a ball, plus the images you upload.
• Orders — what was bought, for how much, its shipping and tracking, and its payment, dispute, and payout history.
• Messages — conversations between buyers and sellers on the platform, and reviews left after delivery.
• Basic usage analytics — pages viewed and a handful of named actions (starting a listing, publishing one, starting a checkout), so we can see which steps people give up on. This uses a random identifier stored in your browser, not a cookie, and it's linked to your account only once you sign in. No cross-site identifiers, and never the contents of an address, a message, or a payment. That describes our own analytics; Google Analytics is separate and is described next.
• Google Analytics — as of September 6, 2026 we also run Google Analytics, which counts pages viewed, where visits arrive from, and roughly what part of the world they come from. Unlike the analytics above it does set a cookie, and it is run by the same company as the Google advertising tag described below — which is why it is listed under that one recipient rather than as a new one. It receives the pages you look at, your IP address and your browser; it never receives your name, your email address in any form, your phone number, your postal address, or anything you typed into a listing, a message, or a checkout. The scrambled email described in the advertising bullet below goes to the advertising tag and not to Analytics, even though one company runs both. The same Global Privacy Control setting that switches off the advertising tags switches this off too — it is loaded by the same tag manager, and under that signal none of it loads at all.
• A recording of the listing form, and only the listing form — when you create or edit a listing, we record how that screen is used, so we can see where the form itself goes wrong: what you clicked, what you scrolled past, where you gave up. It is a reconstruction of the page from the browser's own description of it, not a video of your screen, and nothing outside the browser tab — no camera, no microphone, no other window — is involved. Everything you type is hidden before it leaves your browser, as are your name and email address in the account menu. What stays visible is the listing itself once you save it — the ball, the condition, the price, the photos you add — which is what you are preparing to publish publicly anyway. It runs on the listing form and nowhere else: never on checkout, your account settings, your orders, your messages, or the identity and bank details you give our payment processor. Because only signed-in sellers reach that form, a recording is linked to your account. Our analytics provider keeps them for 30 days and then deletes them. If your browser sends a Global Privacy Control signal, we record nothing at all.
• Advertising measurement — we run the Google tag (Google Ads) so we can tell whether our ads on Google actually bring people here, and so we can show ads to people who have already visited. It sets cookies in your browser and tells Google which ReRack pages you looked at, so Google can connect a visit to the ad click that caused it. It never receives your name, your phone number, your postal address, or anything you typed into a listing, a message, or a checkout. The actions it reports are that an account was created and, as of the date at the top of this page, that a listing was started and that a listing was published — each sent from your browser at the moment it happens, so we can tell which ads produce sellers rather than just visits. None of them carries what the listing is, what it costs, or who you are. One thing about you does go to Google, and it is new as of the date at the top of this page: when you create an account, your browser sends Google a scrambled form of your email address along with the sign-up. It is scrambled by your own browser before it is sent, and Google cannot read the address back out of it — but it can compare it against addresses it already holds, which is exactly the point: it is how a sign-up gets matched to the ad that caused it when the cookie that would otherwise do the matching is blocked or expired, which on modern browsers is most of the time. Google calls this feature enhanced conversions. It happens only on sign-up, only in your browser, and never for any other action. Until the date at the top of this page this bullet promised that no form of your email address was ever sent to Google — and that promise is withdrawn, not reworded. If your browser sends a Global Privacy Control signal, none of it is sent, because none of these tags load at all. Until August 29, 2026 this section described the Meta (Facebook) pixel, which reported a longer list of marketplace actions from our servers along with a scrambled form of your email address; that pixel is removed, and nothing is sent to Google from our servers at all — every signal described here leaves from your browser or not at all. As of September 6, 2026 we also run Google Tag Manager, Google's own loader for measurement tags like this one, which lets us change what we measure without shipping new code. It is the same company receiving the same things and it adds no new recipient. This paragraph used to end by promising that if we ever used the tag manager to add a different advertiser, this page would say so before that tag ran. As of September 6, 2026 we have, and it does — the next bullet.
• Advertising measurement (Reddit) — as of September 6, 2026 we also run the Reddit pixel, so we can tell whether our ads on Reddit bring people here. It sets cookies in your browser and tells Reddit which ReRack pages you looked at and that an account was created: the same two things Google's tag is told, and nothing else. It never receives your name, your email address, your phone number, your postal address, or anything you typed into a listing, a message, or a checkout. Reddit's own installation offers a way to send a scrambled form of your email address so it can match you to a Reddit account, and we deliberately do not send one; nothing about you reaches Reddit from our servers either. It is loaded by the same tag manager as Google's tags, and switched off by the same browser signal, described below.

We never store payment card data. Card entry happens on Stripe's own hosted checkout page; we receive a payment status and an identifier, not a card number. Seller identity and bank documents likewise go to Stripe and stop there.

• To publish listings and show them to buyers.
• To take payment, hold it until the sale completes, buy shipping labels, track deliveries, and pay sellers out.
• To send transactional email about your orders — confirmations, shipping reminders, delivery and payout notices, dispute updates.
• To investigate reported problems and resolve disputes fairly, which means support may read the messages and photos attached to an order.
• To detect fraud and enforce our Terms of Service, including reviewing messages flagged for moving a deal off-platform.
• To meet legal, tax, and accounting obligations as merchant of record.

Buyers and sellers see only what a transaction requires: a seller's public listing shows their city and state, and full addresses are exchanged only once an order exists and only for the purpose of shipping it.

We use a small number of service providers to run the marketplace, each handling data on our behalf for the single purpose listed. We don't share your data with anyone else except where the law requires it.

Payments and identity verification

Takes payment, holds it until the sale completes, verifies seller identity, and pays sellers out. Card details and seller identity or bank documents go to our payment processor directly and are never stored by ReRack.

Authentication

Sign-in, sign-up, and session management. Holds your login credentials.

Database hosting

Stores our own records: accounts, listings, orders, addresses, and messages.

Image storage and delivery

Stores and serves listing photos.

Shipping and tracking

Shipping labels, rate quotes, and tracking. Receives the ship-from and ship-to addresses, names, and phone numbers needed to print a label.

Email delivery

Sends transactional email — order confirmations, shipping notices, payout and dispute updates.

Site hosting and analytics

Serves the site, plus product analytics: which pages are viewed and which steps of listing or buying get completed, and recordings of the listing form described above. Receives a browser identifier and, once you sign in, your account id — never your name, email, address, or anything you typed, including in a recording, where every box is masked in your browser before anything is sent.

Advertising measurement and site statistics (Google)

Two jobs for one company. The advertising half measures whether our ads on Google bring people here and lets us show ads to people who have visited before. The statistics half (Google Analytics, added September 6, 2026) counts pages viewed, where visits came from, and roughly where in the world they came from. Between them they receive the pages you view on ReRack, a signal when an account is created and when a listing is started or published, your IP address and browser, and identifiers stored in cookies they set — and, as of September 11, 2026, a scrambled form of your email address, sent once when you create an account. They never receive your phone number, your name, your readable email address, your postal address, or anything you typed. Both are loaded through Google's tag manager, which is the same company and does not add a recipient. This and Reddit below are the two recipients on this list that use what they receive for their own advertising purposes; you can turn all of it off below.

Advertising measurement (Reddit)

Measures whether our ads on Reddit bring people here. Receives the pages you view on ReRack, a signal when an account is created, your IP address and browser, and identifiers stored in cookies it sets — never your phone number, your name, your email address, your postal address, or anything you typed. Reddit's tag offers a way to send it a scrambled form of your email address so it can match you to a Reddit account; we deliberately do not send one. As of September 11, 2026 we do send one to Google, described above — that decision is Google's tag only, and nothing changed here. It is delivered by Google's tag manager, which loads it but does not receive what it sends. This and Google above are the two recipients on this list that use what they receive for their own advertising purposes; you can turn both off below.

If you need the specific providers named — for a data-subject request, a security review, or your own diligence — email support@rerackbowling.com and we'll tell you.

Listings and photos stay until you remove them or delete your account. Messages stay for as long as the accounts involved do.

Order records outlive account deletion. Deleting your account soft-deletes your user record and takes your profile out of the marketplace, but the orders attached to it — what was sold, for how much, where it shipped, and how any dispute was resolved — are retained for tax and dispute purposes, and because the other party to the sale has their own record of it.

Payment and payout records are also retained by Stripe under Stripe's own retention rules.

• Delete your account at any time from your account settings, subject to the order retention above.
• Correct your details — email, addresses, phone, and listings are all editable in the app.
• Ask us anything else — for a copy of your data, a correction we can't make in the app, or a deletion question, email support@rerackbowling.com.
• Turn off the listing-form recording — the same Global Privacy Control browser setting that switches off the advertising tags also stops the recording described above. There is nothing to click here: if your browser sends the signal, we don't record.
• Transactional email about your own orders isn't optional while you have an active order — it's how the held-payment deadlines are communicated.

• We do not sell personal data. We have never taken money for it and we don't intend to.
• Two advertising tags, and you can switch both off. The Google and Reddit tags described above are the whole of the exception to the rest of this page, and California law counts running them as “sharing” personal information for cross-context behavioural advertising. If your browser sends a Global Privacy Control signal — Firefox, Brave, DuckDuckGo and several privacy extensions send one, usually as a “tell sites not to sell or share my data” setting — ReRack loads neither of them, nor Google Analytics, nor the tag manager that delivers all three. Not loaded and muted: not loaded, so nothing Google or Reddit runs on this site runs for you. Nothing about your activity is reported to any advertiser from our servers, whatever your browser sends — and that stays true of the scrambled email described above, which leaves your browser and never our servers. Until September 6, 2026 there was one such tag rather than two, and this bullet said so.
• No ad networks beyond those two, and no advertising cookies beyond theirs. Nothing you type into a listing, a message, or a checkout is ever sent to an advertiser. The one piece of personal information that reaches one is your email address at sign-up, scrambled by your browser, to Google only — described in full above, and new as of the date at the top of this page.
• Recording stops at the listing form. This bullet used to say we recorded nothing anywhere, and as of August 27, 2026 that is no longer true: we record the screen you build a listing on, described above. It is the only one. Checkout, your account, your orders, your messages and the seller verification steps are not recorded, and nothing you type is recorded anywhere on this site — the listing form included, where every box is masked in your browser before anything is sent. Everywhere else, our analytics still counts named actions and page views and that is all it is able to see.
• No profile-building beyond what the marketplace itself needs to run.

If this policy changes we'll update this page and move the effective date at the top; material changes get an email to account holders.

Questions about privacy: support@rerackbowling.com.