Privacy Policy

Last updated: April 27, 2026

Purr LLC (“Purr,” “we,” “us,” or “our”) operates the Purr mobile application and website at bypurr.com (collectively, the “Service”). This Privacy Policy explains how we collect, use, share, and protect your personal information when you use the Service. By using the Service, you agree to the collection and use of information as described in this Privacy Policy.

1. Information We Collect

Information You Provide Directly

• Account information: Name, email address, profile photo, username, bio, location, account type (personal, reseller, store), business name (for resellers and stores), and authentication identifiers from Apple Sign-In, Google Sign-In, or email/password
• Closet data: Item descriptions, brand, model, style, size, color, material, hardware, condition grade, purchase price (cost basis), purchase date, purchase source, serial numbers, designer era, collection, notes, and provenance details such as whether the item includes the original receipt, dust bag, box, or authenticity card
• Photos: Images you capture with your camera or upload from your photo library for item identification, listing photos, receipt scans, and profile photos
• Marketplace activity: Listings you create, items you save (“heart”), sourcing/ISO requests you post, sourcing comments and bag responses, offers you send and receive, offer messages, accepted prices, and listing flags or reports
• Transaction data: Purchase and sale history, offer amounts, offer notes, shipping addresses, transaction status updates, shipping tracking numbers (forward and return), authentication results from third-party providers, and dispute records including reasons, attached photos, notes, and resolutions
• Payment information: Payment details are collected and processed directly by Stripe; we do not store your full credit card number, bank account number, or other sensitive payment credentials on our servers. We receive limited payment data from Stripe such as the last four digits of your card, your Stripe customer ID, your Stripe Connect account ID (for sellers), Stripe Tax calculation IDs, and transaction confirmation details.
• Subscription data: Subscription tier, subscription start and renewal dates, scan credit balance (for the optional pay-per-scan IAP), and entitlement status received from RevenueCat or Stripe.
• Communications: Messages you send through the marketplace, support requests, feedback, and any other communications with us or other users
• Wishlist and alert preferences: Brands, models, price ranges, conditions, and color preferences you specify for price alerts and wishlist notifications

Information Collected Automatically

• Device information: Device type, model, operating system and version, unique device identifiers, app version, and mobile network information
• Push notification tokens: When you grant permission to receive push notifications, we store the device-issued token (Expo push token) so we can send transactional, alert, and wishlist-match notifications
• Usage data: Features used, screens viewed, actions taken within the app, search queries, time spent on various sections, and interaction patterns
• Perceptual hashes of scan photos: For each bag scan we compute a perceptual hash of the photo (a short fingerprint of the image’s visual content) so we can match repeat scans of the same bag against our reference catalog without re-running expensive identification. The hash itself is not the photo and cannot be reversed back into one.
• Location data: With your permission, we may collect approximate location data to enable local marketplace features. Location collection is optional and can be disabled in your device settings at any time.
• Cookies and analytics (website): When you visit bypurr.com, we use cookies, web beacons, and similar technologies to collect browsing data, referral sources, page views, and other analytics. You can manage cookie preferences in your browser settings.
• Log data: IP address, browser type, access times, pages viewed, and crash reports

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and operate the Service: Create and manage your account, display your closet portfolio, process marketplace transactions, and deliver core functionality
• Process transactions: Facilitate purchases, sales, offers, escrow, payouts, and shipping through our integration with Stripe and shipping providers
• Generate valuations: Calculate estimated market values for your items using our pricing engine, which aggregates market data, comparable sales, and algorithmic analysis
• AI identification: Process your photos through the Anthropic Claude API to identify luxury handbags, assess condition, generate authenticity confidence scores, and provide market context
• Send notifications: Deliver push notifications about price changes on your items, wishlist matches, offers received, transaction status updates, and relevant market intelligence
• Detect fraud and counterfeits: Monitor listings, transactions, and disputes for fraudulent activity, counterfeit items, suspicious patterns, and violations of our Terms of Service. As part of this monitoring, we track aggregated dispute history per user (such as the count of past refund-resolved disputes) and surface it to our internal review team so we can identify coordinated abuse patterns. We do not publish this information to other users or use it for any purpose other than fraud prevention and Terms-of-Service enforcement.
• Improve the Service: Analyze usage patterns, diagnose technical issues, develop new features, optimize performance, and enhance user experience
• Aggregate market analytics: Create anonymized, aggregated market data and analytics about luxury handbag pricing trends, brand performance, and market conditions. This aggregated data does not identify individual users.
• Marketing communications: Send you information about new features, promotions, and updates related to the Service (you can opt out at any time)
• Comply with legal obligations: Fulfill our legal and regulatory requirements, respond to legal process, and enforce our Terms of Service

3. AI and Photo Processing

When you scan a bag or upload photos for identification, your images are transmitted to the Anthropic Claude API for processing. Anthropic’s AI analyzes the images to identify the brand, model, style, material, hardware, and condition of the item, and to estimate market value using comparable sales data we surface from public web sources. This processing is subject to Anthropic’s privacy policy and data handling practices, and we configure our API requests to opt out of any model training on your data where Anthropic supports such an option.

Your photos are stored securely in our cloud infrastructure (Supabase Storage) and are used for: displaying items in your closet and listings, processing identification and pricing requests, computing perceptual hashes for repeat-scan matching, and enabling marketplace features. Important commitments regarding your photos:

• We do NOT use your personal photos to train AI models. Your photos are processed for identification and pricing purposes only, not used as training data.
• Anonymized item reference data (such as confirmed brand/model associations and the perceptual hash of a confirmed scan) may be added to our internal reference catalog to improve identification accuracy on future scans. This does not include your personal photos, profile information, or any identifying details.
• You can request deletion of all your photos at any time by deleting your account or contacting us at hello@bypurr.com. Photos will be removed from our systems within 30 days of your request.

4. Information Sharing

We do not sell your personal information. We share your information only in the following limited circumstances:

• Other users: When you list an item for sale or mark it as “open to offers,” other users can see the item details (photos, brand, model, condition, asking price) and your public profile (username, member since date, completed sales count). Your purchase price (cost basis), portfolio value, gain/loss data, and private closet items are never shared with other users.
• Stripe: Payment and identity information necessary to process transactions, manage escrow, issue payouts, calculate sales tax, and comply with financial regulations. Stripe also operates the Connect platform that holds seller payout accounts. Subject to Stripe’s privacy policy.
• Anthropic: Photos and item descriptions submitted for AI identification and analysis. Subject to Anthropic’s privacy policy and data processing terms.
• Supabase: Account data, closet data, marketplace data, and transaction data stored in our cloud database and file storage infrastructure, plus authentication. Subject to Supabase’s privacy policy and data processing agreement.
• RevenueCat: Subscription status and purchase data for managing iOS Purr+ subscriptions. Subject to RevenueCat’s privacy policy.
• EasyPost and shipping carriers: Buyer and seller shipping addresses, item dimensions, and transaction details necessary to generate prepaid shipping labels (for both forward shipments and dispute returns) and to receive tracking-status webhooks. EasyPost provides labels via integrated carriers including USPS. Subject to EasyPost’s and the carrier’s privacy policies.
• Resend (email): We use Resend to deliver transactional emails (order confirmations, shipping updates, dispute updates, subscription notices, and similar). Email addresses and message contents are processed by Resend solely for delivery. Subject to Resend’s privacy policy.
• LegitGrails (optional authentication): If you opt into professional authentication on a transaction, photos and item details are sent to LegitGrails for human authentication review. The authentication result is returned to us. Subject to LegitGrails’s privacy policy.
• SearchAPI.io and search providers: When the pricing engine looks up comparable sold listings on public marketplaces, we send anonymized search queries (brand, model, size, material) to a third-party search API. We do not transmit your personal information in these queries.
• Hosting and CDN (Vercel, Railway): Our website and pricing-agent service are hosted on Vercel and Railway respectively. Standard server logs, IP addresses, and request metadata may be processed by these providers as part of hosting the Service.
• Error tracking (Sentry): Anonymized crash reports and error logs that do not contain personally identifiable information, used to diagnose and fix technical issues.
• Analytics providers: Anonymized and aggregated usage data to help us understand how the Service is used and improve performance.
• Law enforcement and legal process: We may disclose your information if required by law, subpoena, court order, or government request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, the safety of others, investigate fraud, or respond to a government request.
• Business transfers: In connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred as a business asset. We will notify you of any such change.

5. Your Closet Privacy

Your closet is private by default. We take closet privacy seriously because your collection data is sensitive financial information. Here is how privacy works:

• Your portfolio total value, cost basis (what you paid), gain/loss amounts, and gain/loss percentages are never visible to other users under any circumstances
• Items with availability set to “private” (the default) are visible only to you and are not discoverable by other users in search or browsing
• Only items you explicitly set to “open to offers” or “listed” become visible to other users in the marketplace. Even then, only item details are shared — never your cost basis or portfolio performance
• For listed items, the total count of users who have saved (“hearted”) the listing is publicly visible to other users as a popularity signal. The identities of users who hearted the item are not shared.
• Your closet is not visible on the web unless you explicitly opt in to web visibility per item (the “web_visible” flag), which is enabled by default for items you list publicly so the marketplace can be browsed at bypurr.com
• You have full control over what is public and what is private, and you can change an item’s availability status at any time

6. Data Security

We implement commercially reasonable administrative, technical, and physical security measures to protect your personal information, including:

• Encryption in transit: All data transmitted between your device, our servers, and third-party services is encrypted using TLS (Transport Layer Security)
• Encryption at rest: Personal data stored in our database and file storage is encrypted at rest
• Secure authentication: Account authentication is managed through Supabase Auth with support for Apple Sign-In, Google Sign-In, and secure password hashing
• Row-level security: Our database enforces row-level security policies ensuring that users can only access their own data through the API
• Secure key management: API keys and secrets are stored securely using environment variables and secret management services, never in client-side code
• Regular security reviews: We conduct periodic security assessments of our infrastructure, code, and third-party integrations

While we strive to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security and are not responsible for unauthorized access resulting from circumstances beyond our reasonable control.

7. Data Retention

We retain your information according to the following practices:

• Active accounts: Your personal data, closet data, photos, and transaction history are retained for as long as your account remains active
• Deleted accounts: When you delete your account, your personal data (name, email, profile) and photos are deleted within 30 days. Some data may persist in encrypted backups for up to 90 days before being purged.
• Anonymized market data: Aggregated and anonymized market data derived from transactions (e.g., “a Chanel Classic Flap in excellent condition sold for $X on [date]”) is retained indefinitely to power our pricing engine and market analytics. This data does not identify you.
• Transaction records: Records of completed marketplace transactions are retained as required by applicable tax and financial regulations, typically for a minimum of seven (7) years, even after account deletion. This is necessary for tax reporting, dispute resolution, and legal compliance.
• Dispute records and fraud-prevention metadata: Records of disputes you open or that are opened against your transactions — including the dispute reason, attached photos, return tracking, and resolution — are retained alongside the related transaction record (typically seven years). Aggregated dispute counts per user are retained for as long as the account exists for fraud-prevention and Terms-of-Service-enforcement purposes.
• Communications: Support tickets and related communications may be retained for up to three (3) years for quality assurance and legal purposes

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that we correct any inaccurate or incomplete personal information
• Deletion: Request that we delete your personal information, subject to certain exceptions (such as legal retention requirements)
• Data portability: Request a copy of your closet data and transaction history in a portable, machine-readable format (such as JSON or CSV)
• Opt out of marketing: Unsubscribe from marketing emails and promotional push notifications at any time through your account settings or by following the unsubscribe link in any marketing email
• Restrict processing: Request that we limit how we process your personal information in certain circumstances
• Withdraw consent: Where our processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact us at hello@bypurr.com. We will respond to your request within 30 days, or as required by applicable law. We may need to verify your identity before processing your request.

9. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions permitted by law.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: We do not sell your personal information as defined by the CCPA/CPRA. We do not share your personal information for cross-context behavioral advertising purposes.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you the Service, charge you different prices, provide a different quality of service, or retaliate in any way.
• Shine the Light: California Civil Code Section 1798.83 permits California residents to request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.
• Authorized Agent: You may designate an authorized agent to submit requests on your behalf. The agent must provide proof of authorization (such as a signed written permission or power of attorney), and we may require you to verify your identity directly.

To submit a CCPA/CPRA request, contact us at hello@bypurr.com. We will verify your identity and respond within 45 days, as required by law.

10. International Users

The Service is operated from and hosted in the United States. If you access the Service from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country of residence. By using the Service, you consent to the transfer of your information to the United States and the processing of your information in accordance with this Privacy Policy and applicable United States law.

11. Children

The Service is not intended for, directed to, or designed to attract anyone under the age of 18. We do not knowingly collect personal information from individuals under 18. If we become aware that we have collected personal information from someone under 18, we will take steps to delete that information as promptly as possible. If you believe that we may have collected information from a minor, please contact us immediately at hello@bypurr.com.

12. Third-Party Links and Services

The Service may contain links to third-party websites and services, including but not limited to luxury resale platforms referenced in pricing comparables (The RealReal, Fashionphile, Vestiaire Collective, eBay), payment and tax services (Stripe), authentication services (LegitGrails), shipping carriers (USPS via EasyPost), email delivery (Resend), subscription management (RevenueCat), and AI providers (Anthropic). These third-party services have their own privacy policies, and we are not responsible for their privacy practices or content. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Service.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. For material changes, we will provide at least thirty (30) days’ advance notice by posting the updated Privacy Policy on the Service, sending you an in-app notification, or emailing you at the address associated with your account. The “Last updated” date at the top of this policy will be revised accordingly. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. If you do not agree to the revised Privacy Policy, you must stop using the Service and delete your account.

14. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Purr LLC
Email: hello@bypurr.com
Website: bypurr.com