Privacy Policy

1. Information we collect

We collect only what we need to run the network:

• Signup details. When you join Rum & Thatch we collect your email, city, and state so we can contact you and, for cities we haven't opened yet, gauge demand by region.
• Profile details. If you fill out your member profile we collect what you choose to provide: your username, full name, home market, bio, favorite cocktails and spirits, travel destinations, and a profile photo. Only your username, photo, and the profile fields you fill in are shown to other members.
• Posts, comments & messages. What you write and upload on the site: event wall posts, replies, likes, venue and article comments, photos you add, and direct messages to friends. Direct messages are visible only to you and the person you wrote to.
• Safety records. If you report something, or someone reports you, we keep the report, a short text copy of what was reported, and who made it. Our language filter also files an automatic report, with no reporter, when a post, comment, or username contains a slur or a call to self-harm; the post itself is not changed. We also record which members you have blocked and which version of our Terms you accepted, and when.
• Account & authentication. You sign in with your username or email and a password, handled by Supabase Auth. Your password is stored only as a salted hash by Supabase; we never see or store it in plain text. We use one-time emailed links to confirm your email address and to set or reset your password. We store your email and the authentication identifiers needed to maintain your session.
• Payment information. Subscriptions are processed by Stripe. Stripe handles your card details directly; we never receive or store full card numbers. We retain your subscription status and billing identifiers returned by Stripe.
• Technical data. Like most sites, our hosting provider records standard request data (such as IP address and browser type) for security and reliability.

2. How we use your information

• To process signups and review host applications.
• To create and manage your account and membership.
• To process subscription billing through Stripe.
• To send transactional email: application updates, account confirmation and password links, and membership notices.
• To keep the registry secure and verify member identity.
• To keep members safe: review reports, apply our Community Guidelines, and remove content or accounts that break them.
• To comply with legal obligations and enforce our Terms.

We do not sell your personal information.

3. Service providers

We share data only with the vendors that power the platform, and only as needed to provide the service:

• Supabase: database, authentication, and photo storage.
• Stripe: subscription payments and billing.
• Resend: transactional email delivery.
• Vercel: application hosting and delivery.
• YouTube (Google): plays the videos embedded on our site. Nothing loads from YouTube until you press play; the video then streams in YouTube's privacy-enhanced mode, and Google's own privacy policy applies to that playback.

Each processes data on our behalf under its own terms. We may also disclose information if required by law or to protect the rights and safety of our members.

4. What other members can see

Real names are optional. Members see the username you choose, your profile photo, and whatever profile fields you fill in; your real name, email, and phone number are never shown to other members. Your event RSVPs are visible to the member organizing that event. Direct messages are limited to members you have accepted as friends (a market's Organizer can also message any member). Anything you post on an event wall, in a comment, or as a photo is visible to other members. You can block any member, which stops them contacting you.

5. Data retention

We keep your information for as long as your account is active. You can delete your account yourself at any time, in the app or at rumandthatch.com/delete-account, and it takes effect right away.

What is deleted: your profile, username, photos, sign-in, friends, blocks, notifications, RSVPs, comments, event posts and likes, and your direct messages, which means messages you sent also disappear from the other person's inbox. Any paid subscription is cancelled first.

What may remain: payment and tax records held by our payment provider, which we are required to keep; safety reports that mention you, kept as a short text copy with the link to your account removed, so we can spot repeat abuse; and copies in our providers' routine backups, which are overwritten on their normal schedule.

6. Your choices

• You can request access to, correction of, or deletion of your personal information.
• You can delete your account yourself, in the app (Profile, then Delete account) or at rumandthatch.com/delete-account.
• You can manage your subscription and payment details through the Stripe billing portal in your dashboard.

To make any of these requests, contact us at contact@rumandthatch.com.

7. Security

We use reputable infrastructure providers and access controls to protect your data. No method of transmission or storage is perfectly secure, but we work to safeguard your information and to limit access to those who need it.

8. Age requirement

Rum & Thatch is a community centered on craft spirits and is intended only for adults of legal drinking age. You must be at least 21 years old to join Rum & Thatch, hold a membership, or host. We do not knowingly collect information from anyone under that age.

9. Changes to this policy

We may update this policy as the platform evolves. When we make material changes we will revise the “Last updated” date above and, where appropriate, notify you by email.

10. Contact us

Questions about your data or this policy? Reach us at contact@rumandthatch.com.