RareRush

Privacy Policy

Draft date: August 5, 2026

Effective date: August 5, 2026

Last updated: August 5, 2026

1. Who We Are and What This Policy Covers

RareRush is operated by Enjoying interaction Corp, doing business as RareRush ("RareRush," "we," "us," or "our"), a California corporation located at 1179 Eager Road, Yuba City, California 95953, Sutter County, United States.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use the RareRush mobile application, RareRush websites, customer support, product AI, purchasing and fulfillment services, Share Earnings, and related services (collectively, the "Services"). This Policy is a notice about our information practices; it is not a request for consent to practices that require a separate choice.

The Services covered by this version are directed to adults in the United States. Product purchases are available only for supported shipping addresses in the contiguous 48 United States and the District of Columbia. Seeing the app or website outside the United States does not mean that account, transaction, AI, Share Earnings, or payout services are offered there.

2. Personal Information We Collect

The table below describes the categories of personal information we collect and, where applicable, have collected during the 12 months preceding the effective date.

Category	Examples	Main sources
Account and identity information	Name, nickname, email address, phone number if provided, avatar, referral code, age-eligibility confirmation, account status, password hash, and Apple or Google sign-in identifier	You; Apple or Google when you choose social sign-in
Contact and shipping information	Recipient name, phone number, street address, apartment or unit, city, state, postal code, country, address-validation result, and delivery instructions or status	You; address, fulfillment, customs, and delivery providers
Commercial and transaction information	Cart contents, product and fixed-SKU details, quantities, preorder and production status, price and tax snapshots, orders, payments, refunds, returns, shipping, delivery, customer-support history, Rare Token activity, Share Earnings attribution, commissions, and payout status	You; our systems; Stripe; fulfillment and delivery providers
Payment and payout information	Stripe customer or connected-account identifiers, payment status, payment method type, card brand and last four digits when returned by Stripe, payment and refund identifiers, commission balances, KYC completion status, payout eligibility, payout status, and tax-reporting status	Stripe; you when you initiate payment or Stripe-hosted onboarding
App, website, and product activity	Products viewed, swiped, searched, skipped, shared, added to cart, purchased, or refunded; feed impressions; referral-link and share-code activity; session and interaction timestamps; recommendation responses; feature usage	Your interaction with the Services; your device
Device, network, and security information	Device or app identifier, IP address, user agent, device model, operating system and app version, language and locale, time zone, session identifiers, authentication events, security events, and diagnostic or performance records	Your device, browser, operating system, app store, and our systems
Approximate location	General location inferred from IP address and shipping region	IP address; shipping address. We do not request precise device location permission
Communications and AI content	Private product-AI prompts and replies, recent conversation context and memory summaries, customer-support messages, AI-assisted support context, feedback, AI-response reports, moderation results, and correspondence with us	You; our personnel; DeepSeek; OpenAI
Photos and other submitted files	Photos or screenshots selected or captured for a refund, damaged-item claim, or customer-support request; file type, size, upload status, and related order or support record	You, only when you choose to provide them
Preferences and inferences	Notification and language preferences, product-interest profile, taste or recommendation ranking, and aggregated product-demand insights inferred from activity	Your settings and activity; our recommendation systems
Legal, fraud, and compliance records	Evidence associated with a refund, chargeback, account restriction, AI report, fraud review, tax requirement, legal request, complaint, or dispute	You; Stripe; logistics providers; authorities; our systems and personnel

Information handled directly by Stripe

Stripe processes card details, wallet credentials, and related payment information through Stripe-controlled interfaces and SDKs. RareRush does not store full card numbers or card security codes. If you join Share Earnings and request payouts, Stripe may collect identity documents, date of birth, taxpayer information, bank-account information, and other KYC information directly through Stripe-hosted onboarding. RareRush generally receives Stripe identifiers, verification and capability status, and transaction or payout records rather than copies of full identity or bank documents.

Camera, photos, and local device storage

RareRush requests camera or photo-library access only when you choose a feature that needs it, such as scanning a supported code, capturing evidence of an item issue, selecting a refund photo, or using a Stripe-supported card-capture feature. Code scanning is processed on the device unless the feature tells you otherwise. Photos selected for support or refunds are uploaded to our storage. Card images and full card credentials are handled by Stripe and are not stored by RareRush.

The app stores authentication sessions in protected device storage and may store a guest device identifier, recommendation session, pending request identifiers, preferences, and product or country-list caches in local app storage. Removing the app generally removes local app data, but it does not by itself delete server-side records or your RareRush account.

3. How We Use Personal Information

We use personal information to:

create, authenticate, secure, and administer accounts and preferences;
provide product discovery, search, personalized feeds, product details, cart, checkout, and account features;
create and preserve payment-time price, tax, preorder, and policy records;
process payments, saved-payment-method requests, refunds, chargebacks, commissions, identity verification, tax reporting, and payouts through Stripe;
determine whether a product has reached its preorder production threshold and manage production, quality control, customs, shipping, tracking, delivery, returns, and refunds;
provide private product AI and AI-assisted customer support, moderate content, investigate reports, and prevent unsafe or prohibited use;
attribute eligible purchases to Share Earnings links or codes and operate the commission ledger;
calculate and display Rare Token, early-purchase rewards, product-interest insights, and Value Growth information;
send authentication codes, receipts, payment confirmations, delay notices, shipping notices, refund notices, security alerts, and other service communications;
personalize and improve product ordering, measure product demand, diagnose errors, and evaluate the performance and safety of the Services;
detect and prevent fraud, account abuse, payment misuse, spam, security incidents, policy violations, and illegal activity;
comply with tax, accounting, customs, sanctions, consumer-protection, legal-process, recordkeeping, and regulatory obligations; and
establish, exercise, or defend legal claims and protect users, RareRush, our providers, and the public.

RareRush does not use recommendation profiles to make decisions that produce legal or similarly significant effects. Recommendations affect the ordering and presentation of products, not eligibility for employment, housing, credit, education, health care, or another similarly significant opportunity.

4. Product AI, AI-Assisted Support, and Content Moderation

Private product AI is available to signed-in users. When you submit a product-AI message:

the message is sent to OpenAI for content moderation before RareRush stores it or sends it for generation;
if it passes moderation, RareRush sends the message, a bounded recent transcript, a memory summary, and relevant product context to DeepSeek to generate a reply; and
the generated reply is sent to OpenAI for moderation before RareRush stores or displays it.

For private product AI, RareRush substitutes generic participant labels rather than sending your RareRush name, email address, or account ID to DeepSeek. The content itself may nevertheless identify you if you type identifying information. AI-assisted customer support may send your support message, recent support history, attachment count, and limited order facts—such as product, payment, fulfillment, refund, carrier, and tracking status—to DeepSeek so that it can draft a response. Support photos are not included in the AI prompt unless a feature expressly tells you otherwise.

We store product-AI messages, moderation request identifiers, model information, and moderation-category results. If you report an AI reply, we preserve a snapshot of the reported reply and associated moderation evidence so our authorized personnel can review the report. Private product-AI and support conversations are not public and are not shared with other RareRush users.

Do not include passwords, full payment-card details, government identifiers, health information, or other sensitive information in AI or support messages unless RareRush specifically requests information through an appropriate secure process.

5. When We Disclose Personal Information

We disclose personal information only as needed for the purposes described in this Policy.

Recipient category	Information and purpose
Stripe	Account contact data, order and payment amounts, transaction identifiers, and other information needed for payment, fraud prevention, refunds, Connect onboarding, identity verification, tax reporting, transfers, and payouts
Apple and Google	Information needed for app distribution, platform operation, social sign-in when selected, and store-level diagnostics or account services
DeepSeek and OpenAI	AI and support content, bounded conversation or product context, and moderation inputs and outputs, as described in Section 4
Cloud, storage, network, security, and email providers	Account, content, transaction, logs, files, and contact information needed to host, secure, back up, monitor, and communicate about the Services
Manufacturers, quality-control personnel, warehouses, customs agents, and logistics providers in China and the United States	Recipient name, address, phone number, order and SKU details, customs or shipment references, and tracking information needed to produce, inspect, export, import, deliver, return, or investigate a shipment
Professional advisers and insurers	Information reasonably necessary for legal, tax, accounting, security, compliance, audit, risk, or insurance services
Authorities and other legally entitled parties	Information required by valid legal process or reasonably necessary to protect rights, safety, property, users, or the public; investigate wrongdoing; or comply with law
Parties to a business transaction	Information subject to appropriate safeguards in connection with due diligence, financing, merger, acquisition, reorganization, bankruptcy, or sale of all or part of our business

We require service providers and contractors to process information for specified purposes, apply appropriate safeguards, and not use it for unrelated advertising or their own independent purposes, except where the provider acts independently under law or a direct agreement with you, such as certain Stripe, Apple, or Google services.

6. No Sale, Cross-Context Behavioral Advertising, or Third-Party Ad Tracking

RareRush does not sell personal information for money or other valuable consideration. RareRush does not share personal information for cross-context behavioral advertising, does not serve third-party behavioral advertising in the Services, and does not track you across unrelated companies' apps or websites for advertising.

We do not knowingly sell or share the personal information of anyone under 16. The Services are not available to anyone under 18.

Because RareRush does not sell or share personal information as described above, there is currently no sale-or-sharing opt-out required for our practices. Where legally applicable, we will process a recognized opt-out preference signal, such as Global Privacy Control, as a request for the browser or device sending the signal. Browser "Do Not Track" signals are not standardized; regardless of whether a browser sends that signal, our practices remain as described in this Section.

7. Sensitive Personal Information

We use sensitive personal information—such as account login credentials, precise shipping address, private communications, payment-related information, and Stripe Connect verification status—only as reasonably necessary to provide requested services, secure accounts and transactions, prevent fraud, process payments or payouts, fulfill orders, comply with law, and protect users. We do not use sensitive personal information to infer characteristics about you or for cross-context behavioral advertising.

8. Cookies and Similar Technologies

The RareRush website and app use essential local or session storage, authentication technologies, and server logs to keep sessions secure, remember necessary preferences, prevent abuse, and operate requested features. The current Services do not use advertising cookies or third-party cross-site advertising trackers. Your browser and device settings may let you remove local data, but doing so may sign you out or reset preferences.

9. Data Retention

Unless a shorter period is required by law or a specific record is subject to a legal hold, we use the following retention periods:

Record	Retention period
Account profile, saved addresses, and preferences	While the account is active. After 24 months without account activity, we provide 30 days' notice before deletion or de-identification
Cart records	180 days after the last cart activity
Private product-AI conversations	24 months after the last conversation activity; deleted with the account unless specific moderation or legal evidence must be preserved
Ordinary support conversations and attachments	24 months after the support case is closed
Support, refund, fraud, chargeback, or dispute evidence tied to a transaction	7 years after the related transaction is completed
Raw recommendation, browsing, and interaction events	13 months; aggregated or de-identified statistics may be retained without a fixed limit
Login, device, and general security logs	12 months; confirmed security-incident records may be retained until investigation and any necessary enforcement period ends
Orders, payments, refunds, taxes, commissions, and payouts	7 years after the relevant transaction or reporting period
Uncommitted file uploads	24 hours
Rolling backups	Up to 35 days before overwrite or expiration

When a legal hold, investigation, regulatory requirement, or dispute applies, we preserve only the records reasonably related to that obligation and delete or de-identify them when the obligation ends. De-identified information is maintained in de-identified form and is not used to attempt to re-identify an individual.

External providers may keep limited security, compliance, or transaction records under their own legally applicable retention requirements and our agreements with them.

10. Security

We use administrative, technical, and physical safeguards designed for the nature of the information we process. These include encrypted network connections, protected credential storage, access controls, least-privilege administration, separation of payment and AI credentials, logging and review of sensitive administrative actions, and backups. No system is completely secure, and we cannot guarantee that unauthorized access, loss, misuse, or alteration will never occur.

You are responsible for protecting your password, device, email account, and authentication codes. Contact us promptly if you believe your account or information has been compromised.

11. Your Privacy Choices and Rights

RareRush provides all users with a process to request:

confirmation of whether we process their personal information;
access to and a portable copy of personal information associated with them;
correction of inaccurate personal information;
deletion of personal information, subject to lawful exceptions;
information about the categories, sources, purposes, and recipients of personal information;
appeal or further review if we deny a privacy request; and
non-discriminatory treatment for exercising privacy rights.

To submit a request, email support@rarerush.ai from the email associated with your account and include "Privacy Request" in the subject line. Identify the right you wish to exercise and provide enough information for us to locate the account. We may verify your identity through your authenticated account, an email or phone already associated with it, or transaction details. Do not send a copy of a government identity document unless we specifically request it through a secure method.

You may authorize an agent to make a request. We may require proof of the agent's authority and may verify your identity directly unless applicable law provides otherwise. If we deny a request, you may appeal by emailing the same address with "Privacy Appeal" in the subject line.

We will complete verified deletion requests within 30 days, except to the extent a lawful retention exception applies. We will respond to other verified requests within the period required by applicable law and will notify you if a lawful extension is necessary. We will not discriminate against you for exercising a privacy right.

California privacy rights

California residents may have rights under California law to know, access, correct, and delete personal information; to receive information about collection, disclosure, sale, and sharing; to opt out of sale or sharing; to limit certain uses of sensitive personal information; and not to receive discriminatory treatment. RareRush does not sell or share personal information for cross-context behavioral advertising and uses sensitive personal information only for the limited purposes described in Section 7.

RareRush offers the request methods described above whether or not a particular statutory threshold applies to us. This statement does not waive lawful exceptions, verification requirements, or rights that cannot legally be waived.

12. Account Deletion

You may request deletion of your RareRush account by emailing support@rarerush.ai from your registered email address with "Delete My Account" in the subject line. We will verify the request, prevent unauthorized deletion, and tell you when the request is completed.

Deleting an account removes or de-identifies the account profile, saved addresses, preferences, cart, recommendation profile, and private AI content that we are not required to retain. It also revokes active login sessions and, where applicable, disconnects sign-in credentials. We may retain limited order, payment, refund, tax, commission, payout, fraud, safety, and dispute records for the periods in Section 9. Retained records will not be used to continue personalization or marketing.

Account deletion does not cancel an order, return, refund, chargeback, or payout already in progress. We will first preserve or complete the records and actions needed to protect you and fulfill those obligations. Non-transferable Rare Token and other account-only access ends when the account is deleted.

13. Adults Only

The Services are only for people who are at least 18 years old. We do not knowingly create accounts for or collect personal information from anyone under 18. If you believe a person under 18 has provided personal information, contact support@rarerush.ai. We will investigate and delete the account and information unless retention is legally required.

14. International and Cross-Border Processing

RareRush's primary application databases and business storage are hosted in the United States. Personal information may also be accessed or processed:

in China by authorized personnel, manufacturers, quality-control providers, warehouses, customs agents, logistics providers, and DeepSeek, only as needed for AI generation or order fulfillment;
in the United States and other locations where Stripe, OpenAI, Apple, Google, cloud, email, security, or delivery providers operate; and
wherever you access the Services.

These locations may have privacy laws different from those where you live. We use contractual, access-control, data-minimization, encryption, and vendor-management measures appropriate to the transfer and the information involved. We send Chinese production and logistics partners only the fields needed to make, inspect, clear, deliver, return, or investigate the relevant order.

15. Third-Party Services and Links

The Services may link to or rely on services operated by Stripe, Apple, Google, DeepSeek, OpenAI, carriers, or other third parties. Their independent services and websites are governed by their own terms and privacy notices. This Policy describes RareRush's decisions and practices; it does not replace a third party's notice for information the third party collects for its independent purposes.

16. Changes to This Policy

We may update this Policy when our information practices, Services, providers, or legal obligations change. We will update the "Last updated" date and provide additional notice before a material change takes effect when required by law. We will not use previously collected personal information for a materially incompatible new purpose without the notice or choice required by law.

17. Contact Us

For privacy questions, requests, complaints, or appeals, contact:

Enjoying interaction Corp d/b/a RareRush<br> 1179 Eager Road<br> Yuba City, CA 95953<br> Sutter County, United States<br> Email: support@rarerush.ai

Home