Porch Pick Privacy Policy

Effective Date: July 16, 2026 Last Updated: July 16, 2026

This Privacy Policy explains how Hermitage Studios, LLC ("Hermitage Studios," "we," "us," or "our"), operator of the Porch Pick marketplace, collects, uses, and shares information when you use the Porch Pick mobile application, website, and related services (the "Service"). It is incorporated into our Terms of Service. By using the Service, you agree to this Policy.

1. Information We Collect

1.1 Information you provide - Account information: email, name, username, and password; and your confirmation that you are 18 or older (we record only your confirmation — we do not ask for your date of birth to verify age; Sellers onboarding for payouts provide a date of birth directly to Stripe, as described below). - Listing content: photos, descriptions, brand, size, condition, price, and other details you enter when selling. - Pattern Match photos: photos you upload to search for visually similar listings (see §4). - Offers, reviews, and messages: offers and counteroffers, ratings/reviews you write about Sellers, and messages (and any attachments) you exchange with other users. - Shipping information: sender and recipient names, postal addresses, and phone numbers, and package details, used to generate labels and track deliveries. - Payment and seller-payout information: handled by Stripe. Buyer card/payment details are collected by Stripe. For Sellers, identity and financial details required for payouts — such as legal name, date of birth, tax identifier, and bank account — are collected and verified directly by Stripe through its onboarding; Porch Pick does not store them. - Support communications: information you provide when you contact us or when Support reviews a transaction or conversation to resolve a dispute.

1.2 Information collected automatically - Device and usage data: device type, operating system, app version, IP address, identifiers, and interactions with the Service. - Analytics and diagnostics: collected through Firebase Analytics and Firebase Crashlytics (usage events, crash logs, performance and device data). - Search activity: search queries and click/interaction events processed through Algolia (including InstantSearch Insights). - Push tokens: device push tokens for notifications, via Firebase Cloud Messaging (FCM). - Device integrity: attestation data via Apple App Attest to deter fraud. - Camera and photo library: when you create a listing or use Pattern Match, the app accesses your camera and/or photo library with your permission to capture or select images. We access only the images you choose to submit.

1.3 Information from third parties - Stripe — verification results, payout and dispute/chargeback status. - Shipping providers (Shippo/carriers) — tracking and delivery status. - Sign-in providers — if you sign in with Apple or Google, we receive basic profile information (such as name and email/relay email) from them.

2. How We Use Information

We use information to: - create and manage your account and confirm eligibility; - operate the marketplace — publish listings, process orders and offers, hold and release funds, and issue payouts and refunds; - analyze photos you submit and listing images to find visually similar listings and power Item Watch alerts (see §4); - generate shipping labels and track deliveries; - provide messaging, reviews, referrals, and notifications; - maintain marketplace trust and prevent fraud, including keeping internal seller-reliability records of order events such as shipping delays, disputes filed, and item claims; - deter fraud and abuse (including App Attest device-integrity checks); - provide customer support and resolve disputes (which may include reviewing order messages); - comply with legal, tax, and regulatory obligations; and - maintain, secure, analyze, and improve the Service.

3. Payments & Payouts (Stripe)

Payments and seller payouts are handled by Stripe, Inc. We share with Stripe the information needed to process payments and onboard Sellers for payouts. Sensitive identity and financial data — including any government ID, tax identifier, and bank details collected during Stripe's payout onboarding — is collected and held by Stripe, not by Porch Pick. Porch Pick stores only non-sensitive records such as a Stripe account identifier and status flags (for example, whether payouts are enabled). Stripe processes this information under its own privacy policy and terms.

4. Automated Image Analysis (Pattern Match)

Our Pattern Match feature lets you upload a photo to find visually similar listings and to set up saved searches ("Item Watches") that alert you to new matches. To provide it, we process the photo you submit and listing images using automated image-analysis technology, including Google Cloud Vision (which detects visual labels and dominant colors) and perceptual image hashing. These tools measure visual similarity only; they do not authenticate items or verify brand, size, condition, or value. We do not use the photos you submit to train AI models — ours or anyone else's; images sent to Google Cloud Vision are processed under Google's terms.

Storage and retention. The photo you submit is stored on our infrastructure (Google Cloud Storage) — as a full image and a thumbnail — together with derived data (labels, colors, and image hashes) so we can run the search and alert you to new matches. When you delete a saved Item Watch in the app, its stored images are removed.

5. How We Share Information

We share information: - With service providers who operate the Service on our behalf — payments/verification (Stripe), shipping (Shippo and carriers), image hosting (Cloudflare Images), image analysis (Google Cloud Vision), search (Algolia), cloud/hosting, analytics, and crash reporting (Firebase/Google), transactional email (SMTP2Go), and customer support — limited to what they need. - Between Buyers and Sellers as needed to complete a transaction (for example, shipping name, address, and phone are shared to fulfill an order; profile and review information is shown publicly). - For legal reasons — to comply with law, respond to lawful requests, enforce our Terms, or protect the rights, safety, and property of users and the public. - In a business transfer — in connection with a merger, acquisition, financing, or sale of assets. - With your consent or at your direction.

We do not sell your personal information for money.

6. Third-Party Services

The Service relies on the following third parties, each governed by its own privacy policy: - Stripe — payments, seller payouts (Stripe Connect), and tax calculation (Stripe Tax). - Shippo and shipping carriers — label generation and delivery (receives names, addresses, phone numbers). - Cloudflare Images — hosting of listing and profile photos. - Google Cloud Vision — image label/color analysis for Pattern Match. - Algolia — search indexing and search/click analytics (InstantSearch Insights). - Firebase / Google — authentication, database (Firestore), cloud functions, storage, messaging (FCM), analytics, and crash reporting (Crashlytics). - SMTP2Go — transactional email (order and shipping notifications). - Apple — Sign in with Apple, App Attest, push delivery (APNs), and In-App Purchases (subscriptions and credits). - Google — Google Sign-In. -

7. Advertising

The app currently does not serve third-party advertisements; an ad-free experience is offered as a membership benefit. The app includes the Google AdMob SDK, which is not active at launch.

8. Notifications & Communications

We send push notifications (via FCM) with your device permission; you can turn categories on or off in the app (for example, sales, order updates, matches, followers, and messages) or disable them in device settings. We send transactional email (such as order confirmations and shipping updates) through our email provider. We also send a small number of engagement emails (such as an unread-messages digest and a welcome email); every engagement email includes an unsubscribe link, and unsubscribing stops engagement email without affecting transactional email about your orders and account.

9. Data Retention

We retain most information for as long as your account is active and as needed to provide the Service. In general, content and records such as listings, orders, messages, reviews, offers, and notifications are retained indefinitely unless you delete your account. A limited set of records is deleted automatically on a schedule — for example, payment-processor idempotency records (about 7 days), short-lived rate-limiting records, and expired Item Watches (saved searches). Pattern Match images are retained as described in §4.

When you delete your account, we remove your profile, listings, images (including Pattern Match images), search records, Item Watches, and payment-processor account records, and remove you from other users' follower lists. Some data is retained even after deletion where we have a legal basis or obligation to keep it — in particular: order and transaction records (retained for tax, accounting, dispute, and fraud-prevention purposes, including the name and shipping address on orders you were party to, which remain visible to your transaction counterparty); reviews you wrote about sellers (which remain associated with your internal account identifier and continue to count toward seller ratings); messages in any group conversation that continues to involve other users; and fraud- and reliability-prevention records (for example, internal records of shipping delays, disputes, or claims associated with an account).

10. Security

We use administrative, technical, and physical safeguards designed to protect information, including access controls, a device-integrity signal (Apple App Attest) recorded at sign-in, and encrypted transport. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Protect your credentials and notify us of any suspected unauthorized access.

11. Your Privacy Rights (U.S. / California)

Depending on your state, you may have the right to access, delete, or correct your personal information, and to opt out of any "sale" or "sharing" (we do not sell for money), free from discrimination for exercising these rights. You can delete your account in the app, or contact us at support@porchpick.com; we will verify requests as required by law and honor authorized agents where permitted.

12. Children's Privacy

The Service is intended for adults (18+) and is not directed to children. We require users to confirm they are 18 or older, and we do not knowingly collect personal information from anyone under 18 — including, in particular, children under 13. Although listings involve children's products, our users are adults. If we learn we have collected information from a child, we will delete it.

13. International Users

The Service is offered only in the United States, and information is processed in the United States. Do not use the Service if you are located outside the United States.

14. Changes to This Policy

We may update this Policy. Material changes will be communicated through the Service or by other reasonable means, and the "Last Updated" date will change. Continued use after changes take effect constitutes acceptance.

15. Contact Us

Hermitage Studios, LLC · support@porchpick.com (primary contact method) · Formal legal correspondence: Hermitage Studios, LLC, c/o Northwest Registered Agent Service, Inc., 212 W. Troy St., STE B, Dothan, AL 36303