Privacy Policy

Account information. Your email address, password (stored only as a secure hash), display name, and — if you choose to add them — your birth month and day for birthday rewards. Signing in with Apple or Google gives us the email address and name that provider shares.

Business account information. Business name, category, address and locations, hours, phone, website, logo and photos, staff/owner contact details, the deals, events and challenges you publish, and billing records for paid plans (card details are handled by our payment providers, never stored by us).

Location data. With your permission, we use your device's coordinates to sort deals and businesses by distance. Those coordinates stay on your device for the current browsing session and are not saved to our servers — unless you choose one of two things: saving a search with a "near this spot" radius, or turning on nearby deal alerts. In those cases we store the single coordinate point you chose (plus your radius) so the alert or saved search can run when you are not in the app; you can edit or remove it any time in Profile → Notifications and in your saved searches. A city or ZIP you type yourself is saved to your preferences so we can pick the right market.

Device and browser information. Device and browser type, operating system, app version, language, and error diagnostics — used for security, fraud prevention and troubleshooting. AlleyCat does not keep a readable record of your IP address in its own database — where an address is needed to count requests and block abuse it is stored only as a keyed one-way hash, described below; our hosting and security layer sees the address itself momentarily on each request, as every website's does, to route the request and block abuse. Server error diagnostics are stripped of contact details, tokens and message content before they are written down.

App activity. Saved deals, claimed offers and coupon codes, businesses you follow, wallet activity, punch cards and punches earned, rewards earned and redemptions (including timestamps and the business involved), challenge participation, reviews and community posts, searches you run, and your notification and email preferences.

Receipt and photo uploads. When you upload a receipt to earn a punch, we process the image and extract the merchant name, date and total to verify the visit. We do not extract or keep card numbers or individual line items.

Mobile number (optional). If you turn on text alerts for rewards, we save the mobile number you enter and a record that you verified it, so we can send those texts. Turning texts off removes the number, and deleting your account deletes it. We never sell it and never use it for advertising.

Push notification identifiers. If you enable notifications, we store the push token or subscription for that device so alerts can be delivered. Turning notifications off removes it, and deleting your account deletes it.

Analytics and cookies. If you accept analytics cookies, we record product-usage events (see the Cookies section below and our Cookie Policy).

Messages you send us. Support requests, business claims, city requests, privacy requests and report submissions, including the name, email and message text you provide.

Feedback and suggestions. When you use the feedback form we keep the category you picked, your message, the reply email you optionally give us, the page you were on, whether you were on the web or in the mobile app, a short browser/app version string, and your account link if you were signed in. That submission is also emailed to our support inbox so a person can read and act on it. There is no file or screenshot upload on the feedback form.

Security and abuse signals. To stop credential stuffing, spam and scripted abuse we count requests per visitor and record security events such as a rejected sign-in, a password-reset request, an unusual redemption pattern, or a provider failure. Your IP address and email address are never written to those records in readable form: they are turned into a keyed one-way hash first, so a burst can be counted and connected without the log becoming a list of people. The records hold the event type, a severity, the route, a timestamp and short non-sensitive facts such as counts and status codes — never passwords, tokens, request bodies or message content.

Sign-in, reset and confirmation links. Password-reset and email-confirmation links are generated and checked by our authentication provider. AlleyCat never stores, emails onward, or writes those codes into a log, and reset requests always answer the same way whether or not the address has an account.

Things kept only on your device. Some information never leaves your phone or browser: your theme choice, your cookie choices, a draft of an unsent feedback message so you don't lose what you typed, how many times a confirmation email was requested, and a small counter that decides whether the mobile app is allowed to show the App Store's own "rate this app" prompt. Clearing your browser data or reinstalling the app removes them.

We use your information to operate AlleyCat: create and secure your account, show deals near you, run loyalty punch cards and rewards, verify receipts and redemptions, deliver the notifications and emails you opt into, support businesses publishing deals, process subscriptions, respond to your requests, prevent fraud and abuse, meet legal obligations, and improve the product. We may use aggregated, de-identified data for analytics and product development.

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We share only what a provider needs to perform its function for us:

• Hosting, database, authentication and file storage (Lovable Cloud, built on Supabase infrastructure).
• Payment and subscription processing (Stripe on the web; Apple App Store and Google Play, coordinated through RevenueCat, in our mobile apps).
• Transactional and newsletter email delivery, and push notification delivery (Apple Push Notification service, Firebase Cloud Messaging, and your browser's own push service for web notifications).
• Text-message delivery (Twilio), only if you opt into text alerts, and only your number and the message text.
• AI and automated processing providers (see the next section).
• Mapping and address lookup providers, used to place businesses and interpret addresses.
• Product analytics, only after you accept analytics cookies. No analytics provider is switched on today, so even if you accept analytics cookies nothing is currently sent to one; we will update this page before that changes.
• A secure request broker operated by our platform (Lovable) sits in front of payments, text messages, maps, email and AI providers, so it handles those requests on the way through.
• Web push: if you allow browser notifications, your browser's push service receives a subscription address and its encryption keys so it can deliver the message.

We may also disclose information when required by law, to enforce our terms, or to protect the rights and safety of our users, and in connection with a merger or acquisition (we would notify you).

AlleyCat uses AI and automated systems in a few specific places. We want you to know exactly where:

• Search. When you type a natural-language search (for example "cheap tacos open late"), a large language model may help interpret what you meant and turn it into filters. Basic keyword and category browsing does not use AI.
• Receipt verification. An automated vision model reads the merchant name, date and total from receipt images you upload so a punch can be verified. Low-confidence matches are handed back to you to confirm.
• Business marketing tools. If a business owner asks for it, AI can draft deal copy, descriptions and promotional images from the details they enter. This is opt-in per use and never applied to your personal data.
• Recommendations and ranking. What appears near the top of your feed is produced automatically from signals like distance, opening hours, expiry, popularity and the businesses you follow. That ranking is rule-based, not a machine-learning profile of you.
• Moderation. Automated rules screen community posts and deal text for spam, links and abusive content. Automated screening can flag or hold content; consequential removals are reviewed by a person, and you can contact us to dispute an outcome.

Accuracy. AI and automated results can be wrong or incomplete. Search interpretations, receipt readings and AI-drafted copy should be treated as suggestions — always check a deal's own terms with the business before relying on it.

What is sent to AI providers. AI requests are routed through the Lovable AI Gateway to model providers (currently OpenAI and Google models). Only the content needed for the task is sent: your search text, the receipt image and the candidate business names, or the marketing details a business owner typed. We do not send your email address, account identifiers, password, payment details, precise location history, wallet history or contact list to AI providers.

Retention and training. We instruct our AI providers to process this content only to return a result for us. We do not permit our AI providers to use AlleyCat content to train their models, and we do not train any model of our own on your personal information. Providers may retain request data briefly for abuse monitoring under their own terms.

AlleyCat does not make automated decisions that produce legal or similarly significant effects about you. If you would rather not use these features, you can browse by category and city instead of natural-language search, and earn punches with a code or QR scan at the counter instead of uploading a receipt.

We use cookies and similar technologies to remember your preferences, understand how people use AlleyCat, and support features like authentication and analytics. You can change your choices at any time from Cookie settings, or through your browser. Analytics is off until you turn it on. Disabling cookies may affect some features.

AlleyCat does not track you across other companies' apps or websites. We include no advertising or ad-attribution software, we do not share your information with data brokers, and we do not build advertising profiles. Because of that, our iPhone and iPad apps never show the "Allow app to track" request — there is nothing to ask for.

When you scan a receipt or screenshot to earn a punch, we process the image to confirm the merchant, date, and total. Receipt verification is required to operate the loyalty program and occurs regardless of your analytics preferences.

Separately, if you turn on analytics cookies we record product-usage events about these flows so we can fix failures and improve accuracy. Those events are limited to: a scan being started (including how many photos were attached), a scan needing you to confirm a merchant match, a scan being blocked by a guard such as a cooldown or duplicate, a scan failing with an error, a scan being verified, a punch being earned (and whether it came from a receipt, a code, or a QR scan), a reward being earned, a reward code being created, and a reward being redeemed.

These events contain the business involved, punch and reward counts, the source of the punch, and a short error reason when something fails. They do not contain your receipt images, card numbers, or line items. If you leave analytics off, none of these events are sent.

Wherever you live, you can ask us to give you a copy of your data, correct it, export it, or delete it, and you can ask questions about how we handle it. Depending on your location you may also have the right to restrict or object to certain processing, to opt out of the sale or sharing of personal information (we do neither), and to appeal a decision. We will not discriminate against you for exercising these rights.

• Correct your information: update your email, name, birthday and preferences in Profile settings, or business details in your dashboard.
• Access or export your data: sign in and use Profile → Privacy & data → Download my data to get an immediate machine-readable copy of your account, wallet, loyalty, reviews, posts and preferences. You can also submit a request in the form below; we answer those within 30 days, or 45 days where the law allows an extension and we tell you why.
• Delete your account: signed in, use Profile → Danger zone. Locked out of your account? Use Delete your AlleyCat account — we email a secure confirmation link to the address on the account before anything is deleted, so nobody can delete an account just by knowing an email address. Deleting your account also deletes the photos and images you uploaded. If you own a business on AlleyCat, deleting your personal account also removes that business listing, its offers and its punch programs, along with the punch cards customers hold there — close or transfer the business first if that is not what you want. Deleting your account does not cancel a subscription bought through the App Store or Google Play: cancel that in your store account. A small number of records are kept with your name and account link removed, so they can no longer identify you: page view counts, vote diagnostics, booking and event records a business needs, privacy request tickets, and which staff member verified a redemption. We also keep a deletion receipt containing your internal account number, a scrambled one-way form of your email address, the date, and counts of what was removed — no name, address, phone number or content — so we can prove the deletion happened if you ever ask.
• Notifications and email: change push and email preferences in Profile → Notifications, or unsubscribe from any email.
• Cookies: use Cookie settings.

Deleting your account permanently removes your profile, saved deals, follows, wallet items, punch cards, unredeemed rewards and push registrations. We keep the limited records the law requires us to keep — for example transaction and tax records for paid subscriptions, and abuse or fraud records — and de-identified aggregate counts that cannot be linked back to you. Deleting your account does not cancel an Apple App Store or Google Play subscription; cancel that in your store subscription settings first.

We verify requests using the email address on the account and respond within 45 days (30 days where local law is shorter). An authorized agent may submit a request with written proof of authority.

We keep information only as long as we need it:

• Account and profile data: while your account is active, then deleted on request or within 30 days of account deletion.
• Receipt images: not stored. The photo is read in the moment to confirm the merchant, date and total, then discarded; we keep only a one-way fingerprint of the image (so the same receipt cannot be reused) plus the merchant, date and total on the punch record.
• Mobile number for text alerts: until you turn texts off or delete your account.
• Punch cards, rewards and redemption history: while your account is active, so you and the business can see what was earned and redeemed.
• Push tokens: until you turn notifications off, the token expires, or your account is deleted.
• Device location coordinates: current browsing session only, except the single saved point behind a saved search or nearby alert, which we keep until you change or remove it.
• Analytics events: retained in aggregate, typically no longer than 24 months.
• Billing and tax records: held by our payment providers (Stripe, and Apple or Google for in-app purchases) as the official record, for as long as the law requires them to keep it. AlleyCat's own copy of your plan status is deleted with your account, and cancelling or deleting here does not erase the provider's billing history — ask the provider directly for that.
• Deletion receipts: the non-identifying record described in Section 7, kept for the period in which a deletion could be disputed and then purged.
• Support and privacy request records: up to 24 months so we can show we handled the request.
• Feedback submissions: up to 24 months, so we can follow up and track whether a problem you reported was fixed.
• Security events and abuse counters: the hashed request counters expire within hours to days as their window closes; security event records are kept up to 12 months for investigations, then removed.

We use reasonable technical and organizational measures to protect your information, including encryption in transit and access controls. No online service can guarantee complete security, so we encourage you to use strong passwords and keep your account credentials safe.

AlleyCat is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us so we can remove it. You must be at least 13 years old (or the minimum age in your country, if higher) to create an AlleyCat account, and business accounts must be created by an adult authorized to act for the business.

AlleyCat is operated from the United States and our hosting, database, email, push, text, payment, mapping and AI providers process information on servers in the United States and, for some providers, in other countries through their own global infrastructure. If you use AlleyCat from outside the United States, your information is transferred to and processed in the United States, where privacy laws differ from those where you live. Where required, we rely on standard contractual clauses or comparable safeguards in our agreements with those providers.

We may update this Privacy Policy from time to time. We will post changes on this page and update the "Last updated" date. Your continued use of AlleyCat after changes means you accept the updated policy. If a change materially reduces your privacy protections, we will give notice in the app or by email to the address on your account before it takes effect.

HolmesLabs LLC operates AlleyCat and is the controller of the personal information described here. For privacy questions or requests, email support@thealleycat.app or use our Support page. You can also submit a formal request with the privacy request form above.