Your information

Privacy policy

How Rooted handles consumer app information, public listings and private business workflows.

Who operates Rooted

Aymen Norain, an individual based in Massachusetts, United States, operates Rooted. This policy covers the consumer app, website and separate producer and market organizer tools. A public listing does not mean its business created an account or accepted Rooted’s business agreement.

Consumer app and Saved items

The consumer app displays public market, producer, product and event information. Existing account features are optional and do not identify your Apple subscription. Saved markets, producers, products and events stay on your device under the current app design; Rooted does not sync that list to its backend. Removing an account does not cancel an Apple subscription. Feature availability can differ between a development build and a released app.

Location and manual area search

The app requests foreground location only after you choose Use Current Location. Precise coordinates are used on your device to rank nearby listings, are not retained after the app closes and are not sent to Rooted. You can select a city instead. The selected public area is stored on the device. When you use Apple city or ZIP search, Apple receives the search text to return place results. Rooted does not request background location.

Accounts and private business setup

When you use an available account or business setup flow, Rooted processes your account email and profile information, verification and sign-in state, selected business or organization, role and setup details. We use these to authenticate you, recover access, save requested drafts and provide the correct workspace. Private setup contact information is separate from the public business contact information you intentionally publish. Do not submit payment details, government identification or another person’s private information unless a specific authorized process actually requires it.

Claims and authority review

A business claim may include your role, private business contact and an explanation or requested evidence of authority. Rooted’s authorized operators use that information to investigate the claim, communicate a decision, resolve competing claims and prevent unauthorized access. Claim status, review notes and verification references are restricted records, not anonymous catalog data. An email confirmation proves mailbox control and does not establish market authority. You can request organizer access before creating an account. Rooted independently reviews authority and chooses the verified portal recipient; changing the intended recipient before acceptance revokes the earlier application invitation. We do not offer public access to claim documents or advertise document uploads as an available consumer feature.

Public listings and independent sources

Public information can include a business name, city and state, deliberately public contacts and customer locations, general offerings, official buying links, service areas, schedules, exceptions and events. It can come from the business or reviewed public sources. Rooted retains source and review information to check accuracy and freshness; private evidence and operator notes are not included in public catalog projections. Imported market associations do not grant business membership or establish attendance. Tell us about inaccurate information or a location that should not be presented as public.

Agreements, signatures and operational records

Rooted records the exact platform agreement version accepted, the authenticated account reference, audience, request reference and server acceptance time. Business setup and claim records can connect that action to the selected business. Market participation receipts additionally record the signing business, relevant market and organization, typed signer name, agreement version and timestamp. These records support the requested workflow, retries, business disputes, security and legal obligations. Accepting an agreement does not itself authorize a payment, marketing subscription or market attendance.

Who can access information

Public listing information is visible to people using Rooted and may be copied or indexed by others. Private account and workflow information is available only through authorized roles and operations, including appropriate business administrators, claim reviewers and support. Relevant market agreement parties can access their authorized receipts; unrelated users cannot read private signatures or drafts. We use Supabase for authentication and backend services and Vercel for website hosting. These providers process information to supply their services to Rooted. We may disclose relevant records when legally required or reasonably necessary to protect rights, security or safety, and disclose only what is appropriate for that purpose.

Billing, calendar and external destinations

Apple handles consumer in-app purchases. The current consumer app does not send Apple receipts or a Rooted billing identity to Rooted’s server to identify the subscriber. If a separate business purchase is offered, its checkout identifies the payment provider and required billing information before authorization. Add to Calendar opens the system event editor; Rooted does not read your calendar. Directions and official business links open external providers after your action, and those providers’ privacy practices apply. Rooted does not receive a complete history of your external purchases or browsing merely because a listing links to them.

Service logs and additional uses

Hosting, authentication and infrastructure providers may process technical connection and security logs, such as network addresses and request information, to deliver and protect the service. Rooted has not enabled an advertising tracker, consumer analytics or crash-reporting SDK in the current app. We do not sell personal information or use private claim evidence as a public directory product. This policy and a business agreement do not authorize a new AI feature to receive private business contacts or documents. Material new processing requires accurate updated notice and any permission required by law.

Retention, account closure and requests

We keep account and workflow information for the purposes described here, considering an active request or relationship, legal duties, fraud prevention and disputes. Retention differs by record; we do not promise that every record is erased immediately on closure. Some drafts and account links can be removed or disconnected, and producer claim details are scrubbed when the underlying authentication account is deleted. Business agreement receipts, signing names where needed for those receipts, and justified audit or legal records can remain under restricted access. Independently sourced public business facts may remain after a representative closes an account. We assess access, correction and deletion requests under the law that applies, request proportionate identity verification and explain any justified refusal or retention. Rejected or withdrawn organizer claim contact details and review notes are purged after 90 days. Unverified requests expire after seven days; inactive pending requests close after 90 days; application invitations expire after seven days. Expired and revoked intake is also scrubbed after the 90-day retention period. Necessary accepted ownership, legal and audit records remain restricted. Signed-in users can close a sole-owned business, arrange ownership transfer or delete their account from Account and business access. Sole active ownership must be resolved before account deletion; deletion revokes sign-in and current access. Multiple-manager organizer transfers and scoped legacy market transfers require support review. Contact support for other privacy or export requests.

Security and your choices

Rooted uses authenticated and role-scoped access for private workflows. No system can guarantee absolute security. Keep credentials private, maintain current business administrators and report suspected unauthorized access promptly. You may browse using a manual area, choose not to provide optional information, control device permissions and stop using the service. Business agreement acceptance and authority confirmations are for adults; do not include children’s private information in business submissions. Marketing consent, if requested, is separate from operational account notices.

Policy changes

We identify the updated date and provide appropriate notice of material changes. A policy update does not silently create consent for an unrelated data use or erase rights that the law protects. A transfer of the service to a successor must preserve applicable privacy obligations and identify material changes appropriately.

Contact and privacy requests

Contact Aymen Norain, operating as Rooted in Massachusetts, at an.rooted@proton.me for privacy requests, corrections, support or legal notices.

Last updated October 26, 2026.

Account and business access Help