Privacy Policy

Cottageproduce.com (the “Site”) is owned and operated by Oregon Off Market LLC. This Site is part of a network of affiliated online directories, advertising platforms, and Software-as-a-Service (SaaS) applications (collectively, the “Network”).

This Privacy Policy applies to all digital properties owned and operated by Oregon Off Market LLC within the Cottage Produce Syndicate Network. These ‘Network Sites’ include, but are not limited to:

• ▪ downtownwest.com
• ▪ spx.trade
• ▪ parking.services
• ▪ tourist.services
• ▪ downtownwestlinn.com
• ▪ cottageproduce.com
• ▪ cottageproduce.app (Play Money SaaS Application)

All data processing, membership advertising, ‘Scribe’ services, and SaaS financial dashboard utilities on these domains are governed by the terms of this master policy.

Purpose and Agreement

The purpose of this Privacy Policy is to inform users of the collection, use, and retention of personal data and the specific rights of our users. This Privacy Policy is incorporated by reference into our Terms and Conditions (“Legal Terms”). By using our Site or any site within our Network, you agree to these practices.

Consent and Sensitive Data

By using our Site, users consent to the conditions set out in this Privacy Policy.

Sensitive Geolocation Data: In compliance with the Oregon Consumer Privacy Act (OCPA), we require explicit “opt-in” consent before processing sensitive data, such as precise geolocation (within 1,750 feet) related to cottage produce operation locations or local advertisements.

Sensitive Financial Data (Play Money App): For users of the Play Money application, we require explicit authorization (via Google OAuth and Plaid Inc.) to access your bank balances. This connection is strictly read-only.

Our Core Commitment: Data is Never Sold

We do not, and will never, sell user data. We do not participate in behavioral tracking networks, data broker exchanges, or multi-site tracking monetization algorithms. Your private data remains entirely your own.

Data Collection, Siloing, and App Sponsorships

We limit data collection to what is adequate, relevant, and reasonably necessary to provide our services. Because we operate both public directories and private financial dashboards, data is strictly categorized and handled as follows:

1. Public Contributions (Bulletin Boards & Ads)

Intra-Network Syndication: Content you publicly post (including contact info and locations on classified ads) may be syndicated and broadcast across our Network of subsites and made available for search engine indexing to maximize ad exposure.

Purpose of Use: This data is primarily used to facilitate the advertising of goods/services, administer accounts, and provide administrative support.

2. Private Financial Data & Sponsorship Panels (Play Money SaaS App)

Strict Infrastructure Siloing: Financial data accessed via the Play Money app (such as account balances provided by Plaid) is strictly siloed from public directories. It is processed dynamically solely to calculate and render your personal allocation dashboard. We do not store your transaction history on our servers.

Visual Sponsor Displays: The application interface features a rotating display space dedicated to curated Network sponsors and local business banner advertisements. These placement ads are static, display-only, and featured strictly for visual consumption. We do not expose, share, or sell your private financial metrics, account statuses, email identities, or cash balances to these featured sponsors.

Third-Party Disclosures

We do not pass data to advertising networks. We share specific operational data points strictly with the following vetted integration partners to process authentication, infrastructure security, and payment:

• Plaid Inc.: To establish secure, read-only connections to your financial institutions for the Play Money dashboard. Plaid’s processing of your financial data is governed by their own Privacy Policy. We do not view, store, or sell your transaction history.
• Google (OAuth): Used for secure user account identification and authentication across our SaaS applications. Please refer to our dedicated Google OAuth Integration & User Data Protection section above for complete disclosures regarding Data Access, Usage, Storage, and Sharing.
• Google ReCaptcha: For web security and bot protection.
• Stripe Merchant Services: Used exclusively to manage volume-based computational data processing billing. Our system executes metered invoices based strictly on the allocation volume requirements processed during your monthly cycle, executing card actions in complete compliance with PCI-DSS thresholds. We do not store or monitor payment cards on our primary host servers.
• The Public/Subscribers: Classified ad details and location information are displayed to the public or site subscribers as intended by the directory nature of the service.

Data Retention and Security

Retention and Deletion: We retain your personal and financial data only for as long as your Play Money account is active. Because we are a read-only analytics tool, we do not store your transaction history on our servers; we only store your Plaid access tokens and custom vault configurations. You can instantly delete your account and permanently sever your bank connection at any time using the ‘Delete Account’ button in the app’s settings. Alternatively, you may submit a manual deletion request to [email protected]. We will permanently revoke your Plaid access tokens, sever the connection to your bank, and wipe your user profile within 30 days.

Data Sync and Token Economy Protocols: To ensure absolute resource efficiency and platform stability, the Play Money application utilizes a metered data synchronization framework. Live bank updates are executed via a passive 6-hour automated server cycle that triggers strictly during periods of user engagement. Manual data push requests are managed through a secure, monthly allotted token bank. These token allocations are dynamically computed based on your monthly data volume usage tier, stored permanently within your profile database, and roll over securely at the end of each billing cycle. Unused synchronization tokens are securely retained and may be utilized to activate zero-data-share third-party platform incentives or specialized vendor rewards. All financial transactional profiles processed during a synchronization push are handled strictly in memory and are entirely excluded from persistent server storage.

Zero-Knowledge Architecture: The Play Money application utilizes cryptographic vault mechanisms. Your 4-digit Vault PIN acts as a local key. We do not store this PIN in plain text.

Security: We utilize industry-standard browser encryption and reasonable server-side security safeguards. However, as the Internet can be insecure, we cannot guarantee absolute security. Users are strictly advised not to store passwords or sensitive personal info in plain text on the Site.

Children’s Privacy

We do not knowingly collect data from individuals under 18 years of age. Our services are strictly intended for users 18 and older. If we discover data from a minor has been collected, it will be deleted immediately.

Your Oregon Privacy Rights (OCPA)

If you are an Oregon resident, you have specific rights regarding your personal data:

• Exemption from Sale/Targeted Ads: Because we naturally enforce a zero-sale architecture and completely avoid cross-context targeted tracking networks across our app environment, you are automatically opted-out of data commercialization loops globally.
• Universal Opt-Out / Global Privacy Control (GPC): We honor universal browser opt-out signals (like Global Privacy Control). If your browser transmits a GPC signal, our system natively respects your session choice.
• Right to Access/Correct/Delete: You may contact us at the email above to request a copy of your data, or to have it corrected or deleted. Note: For Play Money users, deleting your account will instantly purge your associated vault configurations from our database.
• Right to Appeal: If we decline to take action on your data request, you have the right to appeal. Submit your appeal in writing to our email within 45 days. If the appeal is denied, you may file a complaint with the Oregon Department of Justice.

Modifications

We may amend this Privacy Policy from time to time to maintain compliance with the law or reflect changes in our data processing practices, including the addition of new SaaS applications or network sites. The “Effective Date” will be updated accordingly. We will notify users of significant changes via email or a prominent notice on our Site.