Privacy Policy · Orrie Bag

1. Who we are

This policy explains how El Camino Studio LLC ("Orrie Bag", "we", "us") collects, uses and shares personal information when you use the Orrie Bag app and website (the "Service"). We are the controller of that information. You can reach us at support@orriebag.com or 8 The Green, Suite B, Dover, DE 19901, United States.

The Service is offered to eligible adults in the United States, subject to the eligibility and location restrictions in our Terms of Service.

2. What we collect

Information you give us

Sign-in identity. When you sign in with Apple or Google we receive a stable identifier for you from that provider and your email address. We do not ask the provider for your name. You can use Apple's option to hide your email; we then receive a relay address. When you sign in with an email code, the address you type is your sign-in identity. An account can link several of these ways to sign in; we keep each linked identifier, the account email (the provider's address or the one you verified), and when each way in was added and last used.
Profile. Your display name. A new account is given a generated one (for example "Bashful Otter") until you set your own.
Shipping details. Full name, delivery address, and optionally a phone number, when you request delivery of a product. We keep a copy of the address on each shipment so the record matches what was actually sent.
Support and feedback. Messages sent through the app's Help form or to our support address, including their topic and content. In-app submissions also record your account identifier, display name, email address, submission time and available client information. The support email includes account and sign-in-provider context so we can handle the request. Email correspondence may contain other information you choose to provide.
Acceptance records. The time and version of the statement you accept at sign-in covering eligibility, our Terms and this policy.
Withdrawals. Adding a payout method and requesting a withdrawal involves identity, contact and destination-account information needed for that method, such as bank-account or debit-card details or a payment-service account identifier. We keep provider references, details needed to identify your destination, eligibility and verification status, and withdrawal amounts, fees, decisions and payment status to process and support the request. The connection or withdrawal flow identifies the relevant provider and explains the information it collects or that you authorize it to access. For each withdrawal request, we also save the recipient name, address, contact information and masked destination details that the payout provider returns, with the observation and recording times. We distinguish information supplied to the provider from independently verified identity and bank-reported ownership information, and record when fields are empty or unavailable. These records do not by themselves establish identity or account ownership. Payout destinations may include bank accounts and eligible debit cards. For cards, the provider may return masked details such as the last four digits, expiration and a provider fingerprint, together with eligibility and payout status, to help us identify the destination and investigate payments.

Information created by using the Service

Credit balance and transactions. Your balance, every change to it (top-ups, bag openings, sell-backs and credits), and top-up records including the amount, currency, status and our payment provider's reference. To support payments and review fraud or disputes, we also retain available payment-attempt details from Stripe: supplied billing name, contact information and address; card brand, funding type, issuing country, last four digits, expiration and provider fingerprint; wallet type (such as Apple Pay); and verification, authentication and payment-outcome results. Missing information is recorded as unavailable or empty as returned by Stripe, without assuming what you entered. We never receive or store your full card number or CVC; those stay with the payment provider. If you choose to save payment details, Stripe stores them for future payments in Orrie Bag. We keep a Stripe customer reference linked to your account; Stripe manages the saved details, which you can remove from its payment sheet.
Activity. The bags you open and the products you receive, your vault, sell-backs, shipping requests and their status. Your opening activity is shown to you in your account. When an opening lands in any tier other than Common, the product and its bag may appear in the public Live strip on the app's Bags tab without your name, username or any account details; other customers' openings are not shown otherwise.
Referrals and rewards. If you participate, we keep your referral code, the code you apply, your original and active referral relationships, changes and their times, the offer terms you accepted, and records of qualifying purchases and their funding, payments, bonuses, commissions, adjustments, credits to your shopping balance, spending and recovery of referral credit, and any historical withdrawals. We link these records to the participating accounts to administer the offer, prevent abuse, resolve disputes and meet financial obligations. Section 4 explains what participating members can see.
Invitation links. When you open an invitation, the app may save the unclaimed code, receipt time and a random local identifier so you can review it after signing in or restarting the app. On Android, Google Play's install-referrer service may supply the invitation code used for your installation. Opening a link does not automatically apply or switch your referrer. This feature does not read your contacts or automatically read your clipboard. Section 5 explains invitation expiry and storage.
Device and session. A session token stored on your device (in secure storage on iOS and Android, and browser storage on the web), the time of your requests, and your network address, which we use to keep the Service secure and limit abuse. Browsing as a guest creates a service record and session with a generated identifier and name; sign-in is required to open bags.
Former sign-in identifier. For an account with retained purchase, credit or product/order records, deletion, or removing a way to sign in, may leave a protected, keyed one-way hash of each Apple, Google or email identifier. It lets us recognize the same sign-in identity if it returns, to prevent repeat promotion claims. It cannot sign in to the deleted account, but it remains a linkable identifier rather than anonymous information. Section 5 explains its retention.

Information we receive from others

Confirmation of payment from our payment provider, delivery status from shipping carriers, and the sign-in information described above from Apple or Google. Email sign-in codes and confirmation codes are sent through our email provider.

We do not collect precise location, contacts or photos. Our analytics configuration does not collect the device's advertising identifier (IDFA or Android advertising ID).

Diagnostics, operational logs and performance measurements. We collect technical information to detect and investigate failures, measure service reliability and speed, troubleshoot requests and improve the Service. This includes crash and error reports, technical stack traces, selected records of application operations and their outcomes, and counts, timing measurements and performance traces. These records may describe the app version and build, operating system and device characteristics, time, relevant app screen or operation, request route and response status, connection failures, retries and recovery attempts. Generated event, incident, trace or installation identifiers help connect related records. Some records can be connected to our service logs or other information, so we do not treat all diagnostics as anonymous.

We select and filter diagnostic information to limit collection to these purposes. We do not intentionally attach your account identity, contact or shipping details, passwords, authentication tokens, payment details or the content of support messages to these reports. Network addresses are used to deliver reports; our monitoring configuration removes IP addresses from stored diagnostic events. Diagnostic monitoring is not used for advertising. Masked session replay, described below, has separate collection controls.

Masked session replay. When product-usage sharing is enabled, we may use Sentry to record a sampled visual reconstruction of browsing in supported web experiences to investigate usability problems and errors. Native iOS and Android visual replay is disabled. Web replay can include screen layout, taps, scrolling, timing and a random replay identifier that connects the recording to diagnostic events. Text, text-entry fields, images and embedded web content are masked or blocked before transmission. We stop recording for sign-in, account, payment, wallet, shipping, support and other sensitive screens. We do not attach your account ID or email to replay, and do not use recordings for advertising. Turning off Share product usage stops future replay recording on that device; it does not disable ordinary crash and error diagnostics. Previously transmitted recordings are subject to the retention and rights provisions below.

For our App Store privacy disclosures, Performance Data and Other Diagnostic Data are Not Linked to You. Both are collected for App Functionality and are not used for tracking. Crash Data remains linked to identity.

Product-usage analytics. When enabled, we collect the screens and public products you view, selected actions and their outcomes, app foreground and background changes, time spent on screens, and server-confirmed bag openings and credit top-ups. We also measure first app launches and first verified account registrations. These records include event times, app version, platform, device characteristics, random installation/browser and session identifiers, and a pseudonymous analytics user identifier. Confirmed-payment events can include a transaction reference, amount and currency, but no card or bank-account details. On iOS, analytics may also include Apple's app-vendor identifier (IDFV), which is different from the advertising identifier (IDFA). They let us understand journeys with and without purchases and improve the Service. A guest journey can be linked to your account after you sign in. These are pseudonymous identifiers; they are not anonymous while we can link them to you. We do not include text you enter, names, email addresses, shipping details, authentication credentials or payment credentials in product-usage events. Event analytics do not contain visual recordings; masked replay is described separately above.

In supported app versions, optional usage events may also describe payment or withdrawal steps, such as opening a screen, starting a request, validation state, completion, failure or an outcome we could not confirm, together with timing and app state. These diagnostic events do not include entered financial details, withdrawal amounts, destination identifiers or financial-screen images. We may connect them to your account for troubleshooting. An app event is not proof that a payment or payout completed; financial status is verified separately. These events follow the product-usage preference and retention rules, including when used to investigate an error. The separately described confirmed-payment events may include a top-up amount and currency.

Google analytics and advertising measurement. Where enabled, Firebase Analytics and Google Analytics 4 (GA4) process product events on iOS, Android and web. Google can associate installation or browser identifiers and conversion events, such as a first launch, registration or confirmed payment, with our Google Ads campaigns. We use this to measure campaign effectiveness and improve how our ads reach prospective users. We share the event and pseudonymous identifier information needed for that measurement; we do not send your name, email, shipping details or payment credentials. Our analytics configuration disables advertising-ID collection and personalized-ad signals. Attribution availability depends on your platform and privacy settings. Turning off Share product usage stops future Firebase/GA4 collection and Google conversion reporting from that device. Turning it off does not erase events already received by a provider; access and deletion requests are handled as described below.

Meta advertising measurement. Where available, Share product usage also controls sharing registrations and verified first app opens with Meta to measure our Facebook and Instagram ads. On Android, this sharing also includes subsequent app opens and completed credit top-ups. Our server sends event times, a random installation identifier and available app/build and operating-system versions. For Android top-ups, it also sends a transaction reference, amount and currency, and may send Meta's encrypted Google Play install-referrer information. On iOS, we use the Firebase installation identifier and app/device metadata collected with product-usage sharing enabled. We do not send iOS payment events through this ongoing integration. We do not send Meta your name, email, phone number, network address, payment credentials or advertising ID through this integration. We do not request Apple's tracking permission; we report advertising tracking as disabled. You can turn this sharing off with Share product usage in Privacy & Data. If you turn sharing off while offline, the app sends your withdrawal of permission to our server when it reconnects. Events already sent or in flight may still be received. Provider retention and rights requests are described below.

Aggregate iOS advertising attribution. Where enabled, Share product usage also controls updates to Apple's SKAdNetwork and AdAttributionKit. We provide only a small conversion value indicating an app open, a newly verified registration, or a confirmed payment. Apple decides whether to send a delayed, privacy-protected postback to the winning ad network, which may include Meta or Google. We do not send an account identifier, advertising identifier, payment amount, or payment details through this path, and do not request permission to track you across other companies' apps. Turning sharing off stops future updates; it cannot recall a postback Apple has already scheduled. Aggregate reporting may be delayed or limited by Apple's privacy thresholds.

In supported app versions, Apple may also send us a copy of a winning advertising-attribution report. These reports describe the ad network, campaign or source, reporting window, and a limited conversion category such as an app open, registration or confirmed payment. They use a report identifier for duplicate handling rather than your Orrie Bag account identifier. We use these copies to measure campaigns. Turning off Share product usage cannot recall reports Apple has already scheduled.

Apple Ads attribution. When product-usage sharing is enabled on iOS, Apple's AdServices framework can tell us whether an app download was attributed to one of our Apple Ads campaigns. The app sends a temporary opaque token to our server, which exchanges it with Apple. We do not retain the token. We keep a random installation identifier, a one-way token hash to prevent duplicate submissions, the time we obtained the result, and the campaign, ad group, keyword, ad, country, placement and download type Apple provides. A missing attribution result does not establish how you found us. We associate these records with your account after verified sign-in and use campaign details with our product-usage analytics to understand which campaigns lead to registrations and purchases. We do not send your account identity or purchase history to Apple through this integration. Turning off Share product usage stops future attribution collection on that device. We process product events ourselves and through Firebase/GA4. During the transition, PostHog's United States service also processes journey events and Apple Ads attribution while we verify the replacement across app releases. Google Cloud, including BigQuery, may process analytics exports and first-party experiment data. This analysis is for Orrie Bag's product and campaign measurement. You can stop future product-usage collection on a device using Share product usage in Profile. This does not stop payment processing, necessary account records or ordinary diagnostic monitoring. Applicable access and deletion rights extend to linkable analytics records.

3. How we use it

We use personal information to:

run the Service: keep your account, credit balance and vault, determine the result of each opening, show your activity to you and fulfil shipping requests;
process payments and, when available, withdrawal requests, and maintain necessary financial records;
administer referral participation, qualifying purchases and payments, rewards, adjustments and payouts, and maintain the related financial and eligibility records;
keep the Service secure: authenticate sessions, detect fraud, abuse, duplicate promotion claims and violations of our Terms of Service, and enforce rate limits;
meet legal obligations, including tax, consumer-protection and age-eligibility requirements;
respond to your questions and provide support, including requests about orders, refunds, eligible withdrawals and disputes after account deletion;
detect and investigate crashes and unexpected errors, troubleshoot operations, fix defects and measure and improve service reliability and performance;
understand and improve the Service using operational information and, where enabled, first-party product-usage analytics, aggregated where possible; and
send you service messages about your account and security, purchases and shipments, payment receipts and refunds, withdrawal requests and payouts, and support acknowledgements. We only send marketing messages if you opt in, and every marketing message includes a way to opt out.

Where the law of your region requires a legal basis, we rely on: the performance of our contract with you (running the Service and fulfilling purchases); our legitimate interests (security, fraud prevention, improvement); our legal obligations (financial records, age eligibility); and your consent (marketing), which you can withdraw at any time.

We share personal information only as described here:

Payment and payout providers. Providers, including Stripe, receive the information needed to process top-ups, refunds, account connection, recipient verification and payouts when you use those services. The relevant payment, connection or withdrawal flow identifies the provider and makes its privacy information available before you provide the information. Available providers and methods may change. See Stripe's Privacy Policy.
Sign-in providers. Apple and Google, when you use them to sign in.
Participating referral members. Your referral code is intended to be shared, and someone who receives it can pass it on. A referring member can see referral counts and their own earnings, including amounts, timing and status. We do not provide that member with your name, email, contact details, payment credentials or a list identifying the customers behind those earnings. However, someone who knows whom they invited may infer activity from changes in their counts or rewards. The invited customer can see their active referrer's code.
Shipping carriers and fulfilment partners. Your name, address and phone number, to deliver products you request.
Address suggestions and verification. When these features are available, Google Maps receives the address text you type and the complete delivery address to suggest matches and check postal details. We do not send your recipient name, phone number or account identifier with these requests. We keep the shipping address you submit or confirm, not a saved list of suggestions or Google's verification response. See Google's Privacy Policy.
Infrastructure providers that host the Service and its database (currently Vercel and Supabase), which process data on our behalf under contract.
Diagnostic and monitoring providers. We use specialist service providers, including Sentry, to process the diagnostic information, operational logs, performance measurements and masked replay described in Section 2 on our behalf. Our Sentry project stores event data in its United States region. See Sentry's privacy information.
Email and support providers. Google Workspace, including Gmail and Google Groups, processes support correspondence and service email, including shipment notifications. Messages may contain contact details, account references, message content and relevant order information.
Analytics and advertising-measurement providers. Google processes the Firebase/GA4 events and associated identifiers described in Section 2, and Google Ads uses conversion information to measure and optimize our campaigns. Meta receives the optional app events described in Section 2. See Meta’s Privacy Policy. Apple processes the attribution requests and conversion updates described in Section 2 and may send privacy-protected attribution reports to the winning ad network and copies to us in supported app versions. PostHog continues to process journey information and Apple Ads campaign details in its United States region during the transition. Google Cloud, including BigQuery, may process analytics exports and first-party experiment data. See Google's Privacy Policy, Google's explanation of partner data use and PostHog's Privacy Policy.
Professional advisers such as lawyers, accountants and auditors.
Authorities, when required by law, to respond to a lawful request, to protect the rights, property or safety of Orrie Bag or others, or to enforce our Terms.
A successor, if Orrie Bag is involved in a merger, acquisition or sale of assets; we will notify you before your information becomes subject to a different privacy policy.

We do not sell personal information for money. When Share product usage is enabled, we disclose the events and identifiers described in Section 2 to Google and, where available, Meta for advertising measurement. Depending on applicable law and the providers' use of the information, these disclosures may be considered a sale, sharing or targeted advertising. You can stop future optional collection and sharing on that device through Privacy & Data. Turning it off does not erase information already received; contact us to exercise applicable access and deletion rights. Section 7 explains your choices and regional rights.

5. How long we keep it

The following retention periods apply to our records, subject to the specific exceptions for outstanding obligations, legal holds and legal requirements described below. We will remove or anonymize personal information when its applicable retention period ends.

Account and profile. We retain your account and profile while the account exists. Deleting it closes access and removes active sessions immediately. We move the sign-in details, profile email and display name, saved shipping profile and a snapshot of recorded activity into a private deletion archive retained indefinitely for deletion administration and historical review. The archive includes the account ID, deletion date and generation number and cannot be used to sign in. Separate protected sign-in identifiers remain with the archive to count repeat account-deletion generations. Applicable access and deletion rights continue to apply to archived information. Where Apple is linked, the deletion process requests revocation of the app's authorization. The same Apple, Google or email identity can register a new, empty account afterwards. This does not erase every copy of your name, email address or shipping address from other records.
Closed-account records. Purchase and credit history, products, orders and related records may remain on a closed account to resolve outstanding credit, products, orders, refunds, eligible withdrawals or disputes. Shipment address snapshots and support correspondence can still contain personal information. Deletion remains available in the app; contacting support is not a condition of deleting the account. If you later contact support about an outstanding obligation, we may request receipt/order information or other proportionate evidence to verify the request before disclosing records or resolving it. After resolution, we will remove unnecessary copies and apply the relevant retention period below. Resolution will not restart an unrelated record's original retention period.
Former sign-in identifier. The protected identifier described in Section 2 will be retained for up to 24 months after account deletion to recognize returning sign-in identities and prevent repeat promotion claims, then removed. We will align promotion eligibility and enforcement with that window. Access is restricted, and the identifier does not restore access to a deleted account.
Financial records. We will retain top-up and credit-transaction records, including payment-attempt review details and withdrawal records, for seven years after the transaction, subject to record-specific legal and accounting requirements. This is our retention policy, not a statement that every financial record legally requires seven years.
Referral records. Necessary records of referral earnings, adjustments, shopping-credit transactions, recoveries and historical payouts follow the financial-record schedule above. We keep referral relationships, accepted offer records and supporting payment evidence while needed to administer participation, calculate ongoing qualification and resolve outstanding obligations, and remove or minimize unnecessary detail when that purpose ends. Specific disputes, unpaid amounts and legal holds follow the exceptions in this section. Closing an account does not immediately erase records needed to settle legitimate obligations.
Unclaimed invitations. A pending invitation expires after 30 days and may be removed sooner when used or dismissed. Expired invitation data is removed when the app processes its local invitation state; while the app remains closed, stored data may remain until that cleanup occurs. A code you deliberately copy to your clipboard is separate from this local app record.
Shipping records. We will retain necessary shipment and address records for three years after delivery, for warranty and dispute handling.
Routine support and feedback. We will retain these records for 12 months after the case closes. Necessary records of an unresolved order, refund or dispute follow the outstanding-obligation rule above; any required financial record follows its applicable retention period.
Security logs. We will retain routine network-address and request-timing records for up to 90 days. A specific security investigation or legal hold may require the relevant records longer.
Diagnostics, logs and performance measurements. Detailed diagnostic records are retained for up to 90 days; operational logs and custom metrics are retained for up to 30 days. A sampled subset of performance traces may be retained for up to 13 months where our monitoring plan supports longer-term performance analysis. Issue summaries may persist while an issue continues to receive new events. Provider backup copies expire separately, within 90 days of their creation. Diagnostic information copied into a support case or a specific security investigation follows the relevant retention rule for that record. Aggregated statistics that cannot reasonably be linked to an individual may be retained longer. Applicable access and deletion rights extend to diagnostic information that can be linked to you.
Inactive, empty guest records. We will remove these records 30 days after their sessions expire, provided they remain inactive and have no outstanding obligations.
Opening records. Account deletion removes the direct account link from opening-history records and replaces the display name in the opening audit with "former member". Related transaction and audit records may still be linkable; they are not all anonymous. Openings by a deleted account can still appear in the public Live strip described in Section 2, which never shows account details.
Other retained copies. The database, support mailboxes and Google Groups archives contain separate copies. We will apply the relevant category's retention period to those copies. Existing backup copies are not immediately erased by account deletion; we will apply retention requirements to backup handling and restored data as well as active records. For opening, audit and acceptance records without a fixed period above, we will retain personal information only while necessary to reconcile transactions, resolve disputes, investigate security incidents, establish accepted terms or meet applicable legal requirements, then remove or anonymize it. Fixed periods above continue to govern records in those categories unless a specific exception applies.
Masked session replay. Recordings are kept only while needed to investigate usability problems and errors, under our monitoring provider's applicable retention settings. Recordings copied into a specific support case or security investigation follow that record's retention rule. You may contact us for the applicable provider retention period or to exercise rights concerning a recording that can be linked to you.
Product-usage analytics. Our first-party journey collection keeps a bounded queue of unsent events. Events older than 72 hours are not accepted. Expired events are removed from the device queue when the app next connects to the analytics service. While the app is closed or offline, queued events may remain on the device until that cleanup occurs. Our primary journey database retains raw events for up to 90 days; PostHog's free-plan event retention is one year. The account-to-analytics mapping is retained while needed to associate your activity and honor deletion requests. Account deletion removes the journey history from active tables, retains a private activity snapshot for the indefinite deletion archive described above, and queues deletion requests for linked PostHog records and known Firebase/GA4 analytics identifiers. Providers process deletion requests asynchronously; aggregate reports that cannot reasonably be linked to a person may remain. Firebase/GA4 also uses its own SDK buffering, event/user-data retention controls and provider deletion procedures. Contact us for the applicable configured retention periods. Minimal deletion records remain for up to 90 days after deletion succeeds, or longer while a deletion request is still unresolved. Backup copies expire separately under our backup retention procedures. Applicable access and deletion rights extend to linkable analytics information.
Meta measurement. Our local delivery records are retained for up to 90 days after collection for submitted or expired events, or longer while delivery needs review. Installation records and records of your withdrawal of permission remain while needed to enforce your withdrawal of permission. Account deletion removes local linked measurement data and opens a provider-erasure request for operator follow-up. Turning off sharing alone does not delete events Meta already received. Minimal installation identifiers and request times remain while erasure is unresolved, and for up to 90 days after completion. Meta's retention and privacy controls apply to information already received; contact us for help exercising applicable rights.
Apple Ads attribution. We retain the account-linked attribution result while the account exists, and remove it with account deletion or when an inactive guest record expires. Campaign information sent to PostHog follows the analytics retention and deletion rules above. The app keeps its random install identifier and completion state in local app storage to avoid collecting the same install again or assigning it to another account.
Apple advertising-report copies. We keep our copies of SKAdNetwork and AdAttributionKit reports for up to 400 days after receipt. These campaign reports are separate from the account-linked Apple Ads records above. Individual account deletion does not identify a report that contains no account link.

Specific legal holds, recordkeeping requirements and unresolved claims may require longer retention of the relevant records. We will limit that retention to the information needed for the exception, review it when the exception ends, and apply the appropriate deletion or retention rule. These exceptions do not limit applicable deletion rights. To ask about information retained for your account or exercise those rights, contact support@orriebag.com.

6. Security

We protect personal information with encryption in transit, secure storage of session tokens on your device, server-side control of every balance and outcome, and access controls on our systems. No method of transmission or storage is completely secure; if we learn of a breach that affects you we will notify you as the law requires.

7. Your choices and rights

See, correct or delete your information. You can change your display name and saved shipping details in the app and delete your account from the Profile screen. Account deletion does not immediately erase every order, support or transaction record; Section 5 explains the retained categories. For anything else, contact us at support@orriebag.com.
Marketing. Opt out at any time using the link in the message or by contacting us.
Product usage and replay. Use Share product usage in Profile to stop future optional product analytics, campaign measurement and masked replay on that device. This choice does not prevent purchases or disable necessary financial/account records and ordinary error diagnostics. It also does not disable referral accounting needed to administer the program you participate in. Referral invitations require your confirmation before a code is applied or switched.
Regional rights. Depending on applicable law, you may have rights to access, correct or delete personal information, receive a portable copy, restrict or object to certain uses, opt out of sale, sharing or targeted advertising, withdraw consent, appeal a decision or complain to a relevant authority. To exercise applicable rights or appeal our response, contact support@orriebag.com. We may need to verify the request first. An authorized agent may submit a request where permitted by law, subject to appropriate verification. We will not discriminate against you for exercising protected rights.

For California residents, the categories of information we collect, their purposes and recipient categories are described in Sections 2 through 4. Section 4 describes our optional advertising-measurement disclosures and the controls available to stop future sharing on a device. Contact support@orriebag.com to exercise applicable regional opt-out rights. We do not use or disclose sensitive personal information for purposes other than those permitted by applicable law. Our US launch territory does not limit rights that otherwise apply under the law governing your request.

8. Children

The Service is for adults who are at least 18 and have reached the age of majority where they live, as described in our Terms. We do not knowingly collect personal information from anyone under 18. If we learn that a user is under 18, we close the account and delete information as required by applicable law. If you believe a minor has used the Service, contact support@orriebag.com.

9. International transfers

We are located in the United States, and our providers may process information in the United States and other countries. Those countries may have different data-protection laws from where you live. You may contact support@orriebag.com for information about relevant processing locations and any applicable transfer safeguards.

10. Cookies and similar technologies (web)

The web version of the Service stores a session token and your engine preference in browser storage so that you stay signed in and your preference is remembered. When product-usage sharing is enabled, Firebase/GA4 may use first-party analytics cookies and browser identifiers to measure visits, events and our advertising conversions. Advertising-cookie storage and personalized-ad signals are disabled in our analytics configuration. Product-usage analytics uses local storage for your device's analytics preference and a bounded first-party journey retry queue. Journey events older than 72 hours are not accepted; expired queued events are removed when the app next connects to the analytics service, as described in Section 5. The app rotates its journey visit identifier after 30 minutes in the background, on a fresh app launch, at 24 hours, and on sign-out. Turning off Share product usage clears the local journey queue, stops Firebase/GA4 collection and masked replay, and clears the integration's local analytics identifiers where the SDK permits. We provide any additional notice or consent process required for the use of these technologies.

11. Changes to this policy

This policy describes categories of information, purposes, recipients and retention limits. Routine changes to the technical measurements we use within those disclosed boundaries do not change those commitments.

We may revise this policy by posting an updated version in the Service and changing the "Last updated" date. Non-material revisions take effect when posted unless a later date is stated. For material changes, we will notify you in the app or by email before their stated effective date and provide any longer notice required by law.

To the extent permitted by law, your continued use after a revision takes effect signifies acceptance of the updated policy without another signature, checkbox or confirmation. We will obtain separate consent when required by law; continued use does not replace that consent or override your privacy choices. A policy update does not by itself authorize an incompatible new use of information collected under earlier commitments.

12. Contact

El Camino Studio LLC

8 The Green, Suite B, Dover, DE 19901, United States

support@orriebag.com

Orrie Bag Privacy Policy