Privacy Policy

RWCBM (“we,” “our”) operates the RWCBM website at rwcbm.com and the RWCBM mobile app for Android and iOS. This policy explains what information we collect when you use those products, how we use it, who we share it with, and the choices you have.

By creating an account or using the app, you agree to this policy. If you do not agree, do not use the service. If you have questions, write to privacy@rwcbm.com.

We collect only what we need to run the network. Categories:

• Account information. When you sign up we use Clerk for authentication. Clerk receives your email or username and password, manages session tokens, and tells us your Clerk user ID. We store name, optional username, optional profile photo, and the optional contact details (personal email, phone, city, state, bio, social links) you choose to share on your profile.
• Business listings. If you add a business or family shop, we store the business name, description, photos you upload, category, contact details you publish, optional website / shop URL / Google Business Profile link, and the city and state.
• Posts, requests, and deals. We store the text, images, audio, and video you post: chapter posts, requests and opportunities, Give Back deals, applications you send, and direct messages you send to other members.
• Activity data. Limited records of the actions you take that make the network work: deal redemptions you initiate, rewards you give and receive, requests you help fulfill, borough memberships, message read state, and timestamps.
• Device + technical data. Standard server logs (IP address, user agent, request path, response status, timestamp) for security, debugging, and abuse prevention. Crash diagnostics from the mobile app via Expo when crashes occur.

We do not collect: precise location, contacts, microphone or camera data outside of media you explicitly upload, advertising identifiers, browsing history outside our domain, or financial account information. We do not use cookies for advertising.

• To create and operate your account.
• To show your posts, requests, deals, and business listings to other members per the borough and visibility settings you choose.
• To deliver direct messages and notifications inside the app and via email (account-related and content you have asked to follow).
• To compute network-level statistics (total open requests, total given back, rep score, etc.).
• To enforce our community rules and prevent abuse.
• To debug, secure, and improve the service.

We share information only with the service providers that run our infrastructure, and only the data they need to do their job. We do not sell personal information and do not share it with advertisers.

• Clerk (clerk.com) - authentication and session management. Receives the credentials you sign in with, plus the profile fields you supply via Clerk.
• Vercel (vercel.com) - hosting for the website and serverless API. Sees request and response data and stores server logs.
• Vercel Postgres + Vercel Blob - our database and file storage for the data you create (profiles, businesses, posts, media).
• Resend (resend.com) - transactional email delivery (sign-in links, daily digests you opt into, notification emails).
• Expo / EAS (expo.dev) - mobile build and over-the-air update delivery. Sees crash diagnostics and update-fetch metadata.
• Other members. Anything you post inside the app is visible to the audience you publish it to (your borough, the whole network, or a specific recipient for DMs). Your display name, optional username, optional photo, and any contact details you flip the “share” toggle on are visible to other signed-in members.
• Law enforcement, when required. If served a valid legal request, we may disclose the minimum information necessary to comply. We will push back on overbroad requests and, where legally permitted, notify the affected member.

Account data is kept for as long as your account exists. When you delete your account, we remove your profile and personally identifying fields within 30 days; some content (such as posts you authored in a borough feed) may remain attributed to “A former member” if other members have already relied on it. Backups roll off on a 30-day schedule. Server logs are retained for up to 90 days for abuse prevention.

• Edit your profile. Update or hide your bio, photo, social links, location, and the “share my personal email / phone” toggles from the Profile screen.
• Delete content. You can delete your own posts, requests, deals, and businesses from their detail pages.
• Delete your account. Email privacy@rwcbm.com from the address on file. We confirm and process the deletion within 30 days.
• Email preferences. Daily-roundup and notification emails are opt-in. You can turn them off from Profile settings or via the unsubscribe link in each email.

If you are in the European Economic Area, the United Kingdom, or California, you have rights under GDPR / CCPA including the right to access, correct, or delete your personal data; to object to or restrict certain processing; and to data portability. To exercise any of these, email privacy@rwcbm.com from the address on your account. We will respond within 30 days.

RWCBM is intended for adults engaged in business. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, email privacy@rwcbm.com and we will remove it.

All traffic to rwcbm.com and the mobile API runs over TLS. We use Clerk for authentication, store passwords only as Clerk hashes them, and follow the principle of least privilege for internal access. No system is perfect; if you spot a vulnerability, please report it to security@rwcbm.com.

We may update this policy as the product evolves. Material changes will be announced inside the app and dated at the top of this page. The “Last updated” line tells you when the current version took effect.

Privacy questions: privacy@rwcbm.com
Security reports: security@rwcbm.com
General support: support@rwcbm.com