Privacy Policy

Last updated: 24 May 2026.

Rushstack ("Rushstack", "we", "us") operates the online auction marketplace at rushstack.us and the live sales chat at chat.rushstack.us. This policy explains what personal information we collect, why we collect it, how we use and share it, and the choices and rights you have. By creating an account, placing a bid, or listing an item, you agree to the practices described here.

1. Information we collect

• Account information. Your name, email address, password (stored only as a salted hash — we never see it), and the role you register as (buyer or seller).
• Seller & business information. If you sell, the organisation or company name, payout details, and any tax or identity information required to verify you and remit your earnings.
• Listing & bidding activity. Items you list, descriptions and photos you upload, bids you place (regular and maximum proxy bids), items you watch or add to your wishlist, and your bidding and purchase history.
• Payment information. Payments are handled by our payment processors. We receive confirmation and limited transaction details (amount, status, last four digits) but we do not store full card numbers on our servers.
• Communications. Messages you send through our sales chat or to support, and notification preferences (email and web-push).
• Technical data. IP address, browser and device type, pages viewed, and cookie identifiers, collected automatically to keep the service secure and working.

2. How we use your information

• To create and manage your account and authenticate you securely.
• To run auctions — recording bids, operating proxy (maximum) bidding, determining the winner, and notifying you when you are outbid or win.
• To process payments, calculate the seller commission (5% to sellers, 0% to buyers), issue invoices, and remit payouts.
• To send transactional emails and, where you have enabled them, web-push notifications about your bids, watched items, and wishlist matches.
• To prevent fraud, shill bidding, and abuse, and to keep the marketplace safe.
• To comply with legal, tax, and accounting obligations.

3. Cookies and tracking

We use strictly necessary cookies to keep you signed in and to protect forms against cross-site request forgery (CSRF). We use a small amount of functional storage (such as your watchlist-tracker preference) to remember your choices. We do not sell your data to advertisers. You can clear or block cookies in your browser, but some features — including staying logged in — will stop working.

4. When we share information

• Between buyers and sellers. To complete a sale, we share the limited details needed to fulfil and ship the item. Your bidding identity is shown to others only in masked form (for example, "First L.").
• Service providers. Payment processors, email and hosting providers, and similar vendors who process data on our behalf under contract.
• Legal reasons. Where required by law, court order, or to protect the rights, safety, and property of Rushstack, our users, or the public.
• Business transfers. If Rushstack is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We do not sell your personal information.

5. Data retention & security

We keep your information for as long as your account is active and as long as needed to provide the service, resolve disputes, and meet legal and tax requirements. Passwords are stored only as salted bcrypt hashes, traffic is encrypted with TLS, and access to production data is restricted. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

6. Your rights & choices

• Access, correct, or download the personal information we hold about you.
• Request deletion of your account and associated data, subject to records we must keep for legal or tax reasons.
• Opt out of marketing emails at any time using the unsubscribe link, and disable web-push notifications from your device or settings.
• Depending on where you live (for example, the EU/UK under GDPR, or California under the CCPA/CPRA), you may have additional rights, including the right to object to or restrict certain processing and to lodge a complaint with your data-protection authority.

To exercise any of these rights, contact us at the address below.

7. Children

Rushstack is not directed to children under 18, and you must be at least 18 (or the age of majority where you live) to bid, buy, or sell. We do not knowingly collect data from children; if you believe a child has provided us information, please contact us and we will delete it.

8. International transfers

Rushstack is operated from the United States, and your information may be processed in the U.S. and other countries where our service providers operate. Where required, we rely on appropriate safeguards for international transfers.