Privacy Policy

1. Information you give us

When you create an account or use the Services, we collect information you provide directly, including:

Account information — your name, email address, and password. Passwords are stored only as salted hashes, never in plain text.
Optional profile details — such as a phone number, if you choose to add one.
Purchases — the fact that you bought or were gifted a membership, and the membership's status. Card and bank details are entered on our payment processor's checkout and are handled by them, not stored by us (see Section 7).
Support and feedback — the contents of feedback, bug reports, or messages you send us, and the email address we reply to.

2. Information we collect automatically

When you use the Services, we and our providers collect certain information automatically:

Location information — if you grant permission, we use your device's location to show nearby shops and to send nearby-deal alerts. See Section 8 for details and how to turn this off.
Device and push information — device type, operating system, app version, and, if you enable notifications, a push token that lets us deliver messages to your device.
Usage information — how you interact with offers and shops (for example, impressions, taps, and views), which we use to understand what's useful and to improve the Services.
Attribution and diagnostic information — when you install the app after tapping a StarCard link, we collect limited device and network signals (such as IP address, general device characteristics, and timing) to connect that install to the link that referred you, and we keep basic technical logs to diagnose errors and protect the Services.

3. Cookies and similar technologies

Our websites use cookies and similar technologies that are necessary to operate the site — for example, to keep you signed in, remember your session, and protect against fraud and abuse. We do not use third-party advertising cookies, and we do not use cookies to track you across other sites. The mobile app does not use browser cookies, though it stores small amounts of similar data on your device (such as your sign-in session) to keep you logged in. Most browsers let you control cookies in their settings; blocking essential cookies may prevent parts of the site, such as sign-in, from working.

4. How we use information

We use the information above to:

Provide, operate, and maintain the Services, including your membership and redemptions.
Show you relevant local shops and offers, and — if you opt in — send nearby-deal alerts and other notifications.
Process purchases and prevent fraud and abuse.
Understand usage, measure the performance of fundraising campaigns, and improve the Services.
Communicate with you about your account, transactions, and support requests.
Comply with law and enforce our terms.

5. How we share information

We do not sell your personal information. We share information only as described here:

Service providers — companies that run parts of the Services for us under contract, such as hosting, database, payment processing, push-notification delivery, and email delivery. They may use your information only to provide those services to us.
Merchants — when you redeem an offer in person, the shop sees that a valid member redeemed it. We do not share your account profile with shops for advertising.
Fundraising organizations — we share aggregate, non-identifying campaign results (for example, how many memberships a campaign sold) with the organization a campaign benefits. We do not share your identity with them for their own marketing.
Legal and safety — when we believe disclosure is required by law or necessary to protect rights, safety, or the integrity of the Services.
Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

The service providers we currently use include Stripe (payment processing), Vercel (hosting and file storage), Neon (database), Resend (email delivery), Apple and Google (push-notification delivery), Sentry (crash reporting), and Axiom (diagnostic logs). We will keep this list up to date as our providers change.

Some of the tools we use to operate the program are AI-powered — for example, drafting a shop's public listing from publicly available business information. We do not use your personal information to train AI models, and we do not make automated decisions about you that have legal or similarly significant effects.

6. What merchants see

Participating shops are independent businesses. When you redeem an offer, the merchant sees that a valid member redeemed that offer at their shop, and merchants can see aggregate redemption activity for their own offers over time. Merchants do not receive your name, contact information, or account profile from us, and we do not give merchants member lists for their own marketing. Information a merchant collects from you directly — for example, if you make a purchase at their shop — is governed by that merchant's own practices, not this Policy.

7. Payments

Memberships are purchased through our third-party payment processor. When you check out, your payment details are collected and processed by that provider under its own privacy policy. We receive confirmation of the transaction and limited billing details (such as a processor customer or subscription identifier and membership status) — not your full card number.

8. Location information

Location features are optional. If you allow it, we use your device location to find nearby shops and to send nearby-deal alerts, including — if you grant "always" access — while the app is in the background so alerts can reach you as you move around town. We use location for these features and do not use it to build advertising profiles.

You can turn location access on or off at any time in your device settings, and you can disable nearby alerts in the app. Turning off location may limit nearby features but does not otherwise affect your membership.

9. Push notifications

If you enable notifications, we deliver them through Apple's and Google's push services using a token tied to your device. You can turn notifications off at any time in your device settings or in the app.

10. Data retention

We keep personal information for as long as your account is active and as needed to provide the Services, then retain and dispose of it as required to meet legal, accounting, and fraud-prevention obligations. When information is no longer needed, we delete or de-identify it.

11. Deleting your account

You can permanently delete your account at any time in the app's account settings, or by contacting us at starcard@summitstudio.dev. When you delete your account, we delete or de-identify the personal information associated with it, except for records we are required or permitted to keep for legal, accounting, fraud-prevention, or dispute purposes (for example, purchase records), which we retain as described in Section 10.

12. Security

We use reasonable administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and hashed passwords. No system is perfectly secure, and we cannot guarantee absolute security.

13. Rights and Choices Regarding Your Information

You can:

Access or update your account information in the app.
Turn off location access and push notifications in your device settings.
Ask us to access, correct, or delete your personal information by contacting starcard@summitstudio.dev. We will respond as required by applicable law.

Depending on where you live, you may have additional rights under laws such as those in California and other U.S. states — including the right to know what we collect, to request deletion, and to not be discriminated against for exercising those rights. Because we do not sell personal information, no opt-out of sale is needed.

14. Do Not Track signals

Some browsers can send a "Do Not Track" signal to the sites you visit. There is no common industry standard for responding to these signals, so our websites do not respond to them. Our practices are the same for everyone regardless: we do not sell personal information and we do not track you across third-party sites or services.

15. Children's privacy

The Services are intended for adults. StarCard accounts are not directed to children under 13, and we do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act (COPPA). Although StarCard supports school and youth-group fundraisers, memberships are purchased and used by adults. If you believe a child has provided us information, contact us and we will delete it.

16. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, provide additional notice. Your continued use of the Services after an update means you accept the revised Policy.

17. Contact us

Questions about this Policy or your information? Contact Summit Studio LLC at starcard@summitstudio.dev.