Privacy Policy

Introduction

Jumble App helps you discover handpicked secondhand and vintage clothing, thrift stores and thrift events in your city, and lets you register for Jumble events and use event vouchers.

This policy explains what personal information we collect, why, who we share it with and the choices you have. It applies to visitors and registered users (“Users”) of our websites, thejumbleapp.com and jumbleapp.co.za, and of the Jumble mobile app for iPhone and Android (together, “Jumble App” or the “Jumble Service”).

If you have any questions, concerns or requests, you can always reach us at: hello@jumbleapp.co.za

Responsible Party

The Responsible Party (also called the data controller) is the company that decides how and why your personal information is processed. For Jumble App, that is:

We process your personal information in accordance with the Protection of Personal Information Act, 4 of 2013 (“POPIA”) and other applicable data protection laws.

Information You Give Us

You can browse finds, stores and events without an account. If you create an account or use features that need one, we collect:

• Account details – your email address and password (stored securely by our authentication provider; we never see your password), or your Google account email and name if you sign in with Google.
• Profile – the username or display name you choose.
• Event registrations – when you register for a Jumble event, your name, email address, the event and whether you consented to hearing from us about events.
• Vouchers – the vouchers issued to you for an event and whether, when and by which vendor each one was redeemed.
• Saved items – clothing, stores and events you save.
• Content you submit – details and images of events or listings you create on jumbleapp.co.za.
• Event photos – Jumble events may be photographed or filmed for promotional purposes, so you may appear in photos or videos we publish. If you’d rather not, tell event staff on the day or email us.
• Newsletter – your first name and email address if you subscribe.

Information We Collect Automatically

Device and notification data

If you turn on notifications in the mobile app, we store a push notification token for your device, linked to your account, so we can send you notifications.

Activity

When you are signed in, we record when you open an external link to a store or listing, and when you open a notification, so we can see which finds and messages are useful.

Camera

Vendors at Jumble events use the app’s camera to scan voucher QR codes. Scanning happens on the device: we do not store or upload images from the camera. Only the voucher that was scanned is recorded.

Cookies and local storage

We use cookies and your browser’s or app’s local storage to keep you signed in and to remember preferences such as your city and notification settings. We do not use advertising cookies, and we do not use third-party analytics or tracking.

Server logs

Like most online services, our hosting and database providers automatically log technical information such as IP addresses and request times, to keep the service running and secure.

How We Use Your Information

• To provide the service – creating and managing your account, saving items, registering you for events, issuing and redeeming vouchers, and showing vendors what they are owed for redeemed vouchers.
• Service emails – for example to verify your email address or reset your password.
• Event and marketing communications – emails about Jumble events if you consented when registering, and our newsletter if you subscribed. Every marketing email includes a way to unsubscribe.
• Push notifications – news about new finds, Jumble events and your vouchers, only if you turn notifications on. You can turn them off at any time in the app (Profile → Notifications) or in your phone’s settings.
• Improving Jumble – understanding which listings and notifications people find useful.
• Security and legal compliance – preventing misuse and meeting our legal obligations.

We do not sell your personal information, and we do not use it for third-party advertising.

Who We Share It With

We share personal information only with service providers (“Operators” under POPIA) who process it on our behalf, under appropriate agreements:

• Supabase – our database, authentication and file storage provider. Data is stored in Frankfurt, Germany.
• Google Firebase Cloud Messaging – delivers push notifications to your device.
• Google – only if you choose to sign in with Google.
• Lovable – hosts our websites.
• Vendors at Jumble events – when a vendor scans your voucher, they see the voucher type and its value. They do not see your name or email address.

We may also disclose information where required by law, including South African law or a court order.

Retailers

We do not currently share personal information with the retailers whose products we link to. In future we may share aggregated or anonymised statistics with partner retailers, and limited personal information (such as your email address) with a retailer only to confirm a purchase or referral made through Jumble App. Before we share any personal information with retailers, we will update this policy, let you know and ask for your consent where the law requires it.

Third Party Websites

Jumble App links to third party websites where events, stores and clothing are listed or sold, and some product images are loaded directly from those websites. We have no control over their privacy practices, and we recommend reading their privacy policies before giving them your personal information.

International Transfers

Your information is stored and processed outside South Africa, mainly in the European Union (Germany), and by Google in the United States for push notifications and Google sign-in. We only use providers that protect personal information to a standard comparable to POPIA, as POPIA requires for cross-border transfers.

How Long We Keep Your Information

We keep your personal information only for as long as we need it for the purposes in this policy. Your account information is kept until you delete your account.

When you delete your account, we immediately delete your account, profile, saved items, event registrations, vouchers and notification tokens from our main database. Records of vouchers you redeemed as a vendor are kept, without your details, so we can settle payments. Deleted information may remain in encrypted backups for a limited period until they are overwritten.

Your Rights and Choices

Under POPIA and applicable data protection law, you can:

• Access and correct your information – view and edit your profile in the app or website, or ask us for a copy of the information we hold about you.
• Delete your account – at any time in the app or on thejumbleapp.com under Profile → Delete account, or by emailing us.
• Object or withdraw consent – unsubscribe from emails using the link in any email, and turn notifications off in the app or your phone’s settings.
• Data portability – ask us for a copy of the information you gave us in a commonly used format.
• Complain – to the Information Regulator of South Africa (inforeg.org.za) if you are unhappy with how we handle your information.

To make a request, email hello@jumbleapp.co.za. We may need to confirm your identity first.

Security

We protect your information with encryption in transit (HTTPS), access controls that limit each user to their own data, and reputable infrastructure providers. No system is perfectly secure, but we work to protect your information and will notify you and the Information Regulator of any breach as POPIA requires.

Children

Jumble App is not intended for children under 13, and you must be at least 13 to create an account. We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it and any associated account without delay.

If you are between 13 and 17, you may only create an account and register for events with the consent of a parent or legal guardian, as required by POPIA and our Terms and Conditions. A parent or guardian can ask us to access, correct or delete their child’s information by emailing hello@jumbleapp.co.za.

Changes to This Policy

We may update this policy from time to time. The effective date at the top shows when it last changed. If we make material changes to how we use your personal information, we will let registered users know by email or in the app.

Contact

For any questions, concerns or complaints about how we use your personal information, please contact our Information Officer: