Overview

Attic Inc. ("Attic", "we", "us") operates a personal storage service in Denver, Colorado. This policy describes what information we collect when you use attic.it.com, app.attic.it.com, or our driver and operations apps — and what we do with it.

The short version: we collect what we need to pick up, store, and return your things — plus what's necessary to run the business. We don't sell personal data and we never share the contents of your crates.

What we collect

You give us

Name, email, phone, billing address, and service address.
Payment card details, handled by our PCI-compliant payment processor (Stripe). We don't store card numbers on our servers.
Crate labels, descriptions, and optional photos you attach to crates in the app.
Messages you send to support.

We collect automatically

Standard server-log information — IP address and browser/OS — recorded when you use our sites and apps.
Chain-of-custody records: QR scans of crates at pickup, arrival, shelf placement, and return.

Why we collect it

To provide the service: schedule pickups, deliver crates, show you where your stuff is.
To bill you: apply the flat $15/crate/month and handle refunds.
To keep things safe: investigate any claim, loss, or dispute.
To keep things running: investigate problems and fix bugs.

We share personal information only with:

Service providers who help us run the business: Stripe (payments), Clerk (account sign-in and identity), Resend (transactional email), Klaviyo (waitlist and marketing email), Google Maps Platform (address autocomplete and serviceability — the address you type is sent to Google to suggest and verify it), HarperDB (database), and Vercel (hosting).
Authorities if legally required, and only the minimum necessary.

We never sell your data or share it for advertising.

Your choices

You can access, correct, or delete your account data by emailing privacy@heyattic.com.
You can opt out of non-essential notifications in the app settings.
Colorado residents have additional rights under the Colorado Privacy Act — we honor all of them.

Retention

We keep account data for as long as you're a customer, plus three years after you close your account (to satisfy tax and legal obligations). Chain-of-custody scan records are retained for seven years. Crate photos you upload are deleted 90 days after a crate is returned or removed.

Security

We encrypt data in transit (TLS 1.3) and at rest. Access to customer data inside Attic is role-based and audit-logged. Drivers and operations staff see only the information they need to do their job — never your billing details or crate contents beyond what you've labeled.

Children

Attic isn't for children. We don't knowingly collect information from anyone under 13. If you think a child has signed up, email us and we'll remove the account.

Changes

If we change this policy in a material way, we'll email account holders at least 14 days before it takes effect.

Contact

Questions? privacy@heyattic.com — a real human at Attic reads these.