Outgrown — Privacy Policy

Last updated: May 23, 2026

This Privacy Policy explains what personal data Outgrown collects, why we collect it, how we use and protect it, and what rights you have. We've tried to write it in plain language. If anything is unclear, email us at hello@getoutgrown.com.

This policy is designed to meet the requirements of the EU General Data Protection Regulation (GDPR), because many of our users live in the European Union.

1. Who is responsible for your data (the "data controller")

The data controller for Outgrown is currently Michael LaMaina, operating Outgrown ("we," "us," "our"). The Operator intends to transfer operation of Outgrown to a Delaware limited liability company; if that happens, that company will become the data controller and we will update this policy.

Contact: hello@getoutgrown.com

2. The data we collect

We collect only what we need to run Outgrown.

Data you give us directly

• Account information: your name (or display name), email address, and password (stored only in encrypted/hashed form — we never store your password in readable form).
• Profile information: your neighborhood or general area, and any optional details you choose to add.
• Listings you create: descriptions, photos, categories, the age range and size the item suits, and the neighborhood where the item is.
• Claims and messages: the items you claim and any messages you send to other users through the platform.

Data about children

You may enter information that relates to a child — for example, the age range, size, or gender an item suits. Please do not include any information that directly identifies a child (such as a child's full name, photo, or specific personal details). Outgrown is used by adults to pass on items, and we ask you to keep listings about the item, not the child.

Data we collect automatically

• Technical data: basic information your device and browser send when you use the service (such as IP address, browser type, and general device information), and limited information needed to keep you logged in and the service secure.
• Usage data: basic information about how you use the app, so we can keep it working and improve it.

Data we do not collect

• We do not store your full payment-card details. If and when paid features launch, payments are handled by a third-party payment processor.
• We do not sell your personal data to anyone, ever.
• We do not show third-party advertising or share your data with advertisers.

3. Why we use your data, and our legal basis

Under the GDPR we must have a "legal basis" for using your data. Here is what we do and why:

We will not send you marketing emails without your consent, and you can unsubscribe at any time.

4. Who we share your data with

Other users

The whole point of Outgrown is connecting parents, so some of your information is visible to other users by design:

• Your display name and general neighborhood/area are visible on your listings;
• The items you list are visible to others browsing the platform;
• When you claim an item, the person giving it can see your display name and your message so they can arrange the hand-off.

Your email address and password are never shown to other users.

Service providers (data processors)

We use a small number of trusted third-party services to run Outgrown. They process data only on our instructions and only as needed to provide their service:

• Railway — hosting our application and database;
• Vercel — hosting our web app;
• Cloudinary — storing and delivering the photos you upload;
• Resend — sending our service emails (such as verification and notifications);
• A payment processor (e.g. Stripe) — only if and when paid features launch, to handle payments.

Some of these providers are based in the United States. Where your data is transferred outside the European Economic Area, we rely on appropriate safeguards (such as the providers' standard contractual clauses or equivalent mechanisms) to protect it.

Legal reasons

We may disclose data if required by law, to enforce our Terms, or to protect the rights, safety, or property of our users or others.

5. How long we keep your data

We keep your data only as long as we need it:

• Account data: for as long as your account is open. If you delete your account, we delete or anonymize your personal data, except where we must keep some of it to comply with the law or resolve disputes.
• Listings and claims: for as long as they are active, and for a reasonable period afterward to keep records of completed exchanges and the community's impact.
• Technical and security logs: for a limited period needed for security and troubleshooting.

6. Your rights

Under the GDPR, you have the following rights over your personal data. You can exercise any of them by emailing hello@getoutgrown.com:

• Access — get a copy of the personal data we hold about you;
• Rectification — correct data that is wrong or incomplete;
• Erasure — ask us to delete your data ("the right to be forgotten");
• Restriction — ask us to limit how we use your data;
• Portability — receive your data in a portable format, or have it sent to another service;
• Objection — object to our using your data on the basis of legitimate interests;
• Withdraw consent — where we rely on your consent, withdraw it at any time.

We will respond to your request within the time required by law (normally one month). You also have the right to lodge a complaint with a data protection authority — in Spain, this is the Agencia Española de Protección de Datos (www.aepd.es); in other EU countries, your national authority.

7. How we protect your data

We take reasonable technical and organizational measures to protect your data, including:

• Encrypting passwords (we never store them in readable form);
• Serving the entire service over secure (HTTPS) connections;
• Restricting access to personal data;
• Designing the platform so users cannot access each other's private data.

No online service can be 100% secure, but we work to keep your data safe and to fix any issues promptly.

8. Children's privacy

Outgrown is intended for adults (18+). We do not knowingly collect personal data from children, and accounts may only be created by adults. While listings may refer to the age or size an item suits, we ask users not to include information that directly identifies a child. If you believe a child has provided us with personal data, please contact us and we will delete it.

9. Cookies and similar technologies

Outgrown uses a small amount of local storage in your browser to keep you logged in and to make the service work. We explain this in our Cookie Policy.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make a material change, we will take reasonable steps to let you know (for example, by email or a notice in the app). The "Last updated" date at the top shows when it last changed.

11. Contact

If you have any questions, requests, or concerns about your privacy or this policy, please contact us at:

hello@getoutgrown.com

We collect as little as we can, we never sell your data, and we only use it to help one family pass things on to another.