ORRIE BAG

Orrie Bag Privacy Policy

Last updated September 9, 2026

1. Who we are

This policy explains how El Camino Studio LLC ("Orrie Bag", "we", "us") collects, uses and shares personal information when you use the Orrie Bag app and website (the "Service"). We are the controller of that information. You can reach us at support@orriebag.com or 8 The Green, Suite B, Dover, DE 19901, United States.

2. What we collect

Information you give us

  • Sign-in identity. When you sign in with Apple or Google we receive a stable identifier for you from that provider, your email address, and — for Apple, the first time only — the name you choose to share. You can use Apple's option to hide your email; we then receive a relay address.
  • Profile. The display name you set.
  • Shipping details. Full name, delivery address, and optionally a phone number, when you request delivery of a product. We keep a copy of the address on each shipment so the record matches what was actually sent.
  • Support messages. Anything you send us at our support address.

Information created by using the Service

  • Credit balance and transactions. Your balance, every change to it (top-ups, bag openings, sell-backs and credits), and top-up records including the amount, currency, status and our payment provider's reference. We never receive or store your card number; that stays with the payment provider.
  • Activity. The bags you open and the products you draw, your vault, sell-backs, shipping requests and their status. Your openings also appear in the live "pulls" feed shown to other users under your display name; you can change that name at any time.
  • Device and session. A session token stored on your device (in the secure keychain on iOS and Android, in browser storage on the web), the time of your requests, and your network address, which we use to keep the Service secure and to limit abuse.

Information we receive from others

  • Confirmation of payment from our payment provider, delivery status from shipping carriers, and the sign-in information described above from Apple or Google.

We do not collect precise location, contacts, photos, or advertising identifiers.

3. How we use it

We use personal information to:

  • run the Service: keep your account, credit balance and vault, decide the result of each opening, show the live feed, and fulfil shipping requests;
  • process payments and keep the financial records the law requires;
  • keep the Service secure: authenticate sessions, detect fraud, abuse, duplicate accounts and violations of our Terms of Service, and enforce rate limits;
  • meet legal obligations, including tax, consumer-protection and age-eligibility requirements;
  • respond to your questions and provide support;
  • improve the Service by analysing how it is used, in aggregate wherever possible; and
  • send you service messages about your account, purchases and shipments. We only send marketing messages if you opt in, and every marketing message includes a way to opt out.

Where the law of your region requires a legal basis, we rely on: the performance of our contract with you (running the Service and fulfilling purchases); our legitimate interests (security, fraud prevention, improvement); our legal obligations (financial records, age eligibility); and your consent (marketing), which you can withdraw at any time.

4. Who we share it with

We share personal information only as described here:

  • Payment provider. Stripe processes top-ups and receives the information needed to do so, under its own privacy policy.
  • Sign-in providers. Apple and Google, when you use them to sign in.
  • Shipping carriers and fulfilment partners. Your name, address and phone number, to deliver products you request.
  • Infrastructure providers that host the Service and its database (currently Vercel and Supabase), which process data on our behalf under contract.
  • Professional advisers such as lawyers, accountants and auditors.
  • Authorities, when required by law, to respond to a lawful request, to protect the rights, property or safety of Orrie Bag or others, or to enforce our Terms.
  • A successor, if Orrie Bag is involved in a merger, acquisition or sale of assets; we will notify you before your information becomes subject to a different privacy policy.

We do not sell personal information, and we do not share it with third parties for their own advertising.

5. How long we keep it

  • Account, profile and vault: while your account exists. When you delete your account in the app, we erase your profile, sessions and vault immediately.
  • Financial records (top-ups, credit transactions): 7 years after the transaction, as required for tax and accounting, even after account deletion.
  • Opening history in the feed: kept in de-identified form after account deletion (no name, no account link).
  • Shipping records: 3 years after delivery, for warranty and dispute handling.
  • Security logs (network addresses, request timing): up to 90 days.

6. Security

We protect personal information with encryption in transit, secure storage of session tokens on your device, server-side control of every balance and outcome, and access controls on our systems. No method of transmission or storage is completely secure; if we learn of a breach that affects you we will notify you as the law requires.

7. Your choices and rights

  • See, correct or delete your information. You can change your display name and shipping details in the app and delete your account from the Profile screen. For anything else, contact us at support@orriebag.com.
  • Marketing. Opt out at any time using the link in the message or by contacting us.
  • Regional rights. Depending on where you live you may have the right to access, correct, delete, restrict or object to our use of your information, to receive a copy of it in a portable format, to withdraw consent, and to complain to a data-protection authority. To exercise these rights contact us at support@orriebag.com; we may need to verify your identity first.
    • European Economic Area, United Kingdom and Switzerland: the legal bases in Section 3 apply.
    • California: in the last 12 months we collected the categories of information listed in Section 2 for the purposes in Section 3 and shared them with the recipients in Section 4. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use or disclose sensitive personal information for purposes other than those permitted. You will not be discriminated against for exercising your rights. -

8. Children

The Service is for adults. We do not knowingly collect personal information from anyone under 18, and we close accounts and delete information if we learn that a user is under 18. If you believe a minor has used the Service, contact us at support@orriebag.com.

9. International transfers

We are located in the United States and our providers may process information in the United States and other countries. Where information is transferred out of a region that restricts such transfers, we rely on appropriate safeguards such as standard contractual clauses.

10. Cookies and similar technologies (web)

The web version of the Service stores a session token and your engine preference in browser storage so that you stay signed in. We do not use advertising cookies.

11. Changes to this policy

We may update this policy. We will change the "Last updated" date and, for material changes, notify you in the app or by email before they take effect.

12. Contact

El Camino Studio LLC

8 The Green, Suite B, Dover, DE 19901, United States

support@orriebag.com