Privacy Policy

Who we are

"Little Deals" (the "app," "we," "us") is a community-built guide available as a website / progressive web app and as a native iOS app, operated by Chase McElroy, an individual based in California. Cars That Fit on carsthatfit.com (formerly mobilemamas.com) is operated by Bradley Operations Group LLC, a California limited liability company based in Newport Beach, California. You can reach us anytime at hello@littledealsapp.com.

Information we collect

Account information

Signing in is optional. On the website you use a passwordless "sign-in link": you give us your email address, and we email you a link to click — there's no password to create or remember. On the native iOS app you can use that same emailed link, or Sign in with Apple (which may share your Apple-provided name/email with us for account identity). We use a service called Supabase to manage sign-in. Your email is used to identify your account, sync your saved places and family setup across your devices, and — if you use Cars That Fit while signed in — sync your car preferences and saved cars. We may also use your email to contact you about your account if needed. After you sign in, you may optionally save a display name and public social handles (Instagram, X, TikTok, YouTube, Facebook) so we can credit you on contributions you submit — these are stored with your account and deleted or unlinked when you delete your account. Little Deals accounts are for parents and other adults — when you sign up we ask for your birth year only to enforce 18+; we store a yes/no eligibility flag on your device (not the year itself) and never send the year to our servers. When you sign in from a device that passed that check, we record a one-time “attested 18+” timestamp on your account — the date you attested, never your age or birth year. We don’t independently verify age on the server. Browsing without an account never asks your age.

Sign in with Apple — native iOS app

On iOS you can choose Sign in with Apple. Apple may provide your name and email (or a private relay email) so we can create your account. When you delete your account we revoke the Apple authorization on our side (Guideline 5.1.1(v)) and remove your Little Deals data. Sign in with Apple is optional — the emailed sign-in link is always available.

Passkey sign-in (Face ID / Touch ID) — on our website

On our website, once you've signed in, you can optionally create a passkey so next time you can sign in with Face ID, Touch ID, or your device PIN instead of waiting for an email link. (The native iOS app uses Sign in with Apple and/or email sign-in links — no passkeys.) Passkeys use your device's built-in authenticator: your face, fingerprint, and PIN never leave your device and are never sent to us. All that's stored with your account (through Supabase, our sign-in provider, already listed below) is a public-key credential — a cryptographic key that lets us verify it's really you, but that can't be used to reconstruct your biometrics. Setting up a passkey is entirely optional and you can skip it; a small note is kept on your own device to remember that this device has a passkey set up. Deleting your account removes the credential along with the rest of your data.

Location

• Approximate (coarse) location. When the app loads, our hosting provider tells us a rough, city- or region-level location derived from your internet (IP) address so we can show deals near you. This is not precise GPS, and we don't prompt you for it.
• Precise location (only when you ask). If you tap "Near me," your device asks your permission and provides your GPS location — but we never send your exact coordinates to our servers. Your device rounds your location to roughly a kilometer (about half a mile) before anything is sent, which is all our backend needs to find and rank nearby deals. The live "you are here" dot on the map runs entirely on your device — your movements are never transmitted. A rounded copy is cached on your own device (so the app can show what's nearby next time without re-asking); a precise "Near me" fix is ignored after about 12 hours, and you can clear the cache anytime via your browser/app data. The permission itself is controlled by your device settings. On the native iOS app, "Near me" uses your device's approximate (reduced-accuracy) location as a single fix — it does not continuously track you as you move.

Activity in the app

• Saved favorites — places you bookmark. They live on your device, and when you sign in they also sync to your account so they follow you across your devices — on both the website / progressive web app and the native iOS app. They're deleted with your account.
• Recent searches — your last few city/place lookups, kept on your device; on the website / web app they also sync to your account when you're signed in, so they follow you across devices (on iOS they currently stay on your device).

Requests and confirmations

A few taps send a small signal to our backend so we can keep the guide accurate and decide where to expand. Deal confirmations and city/metro requests are both tied to your account (see why below); we never publish who confirmed what.

• Deal confirmations (tied to your account) — when you answer whether a deal worked for your family (thumbs up / thumbs down), we record the place, whether it worked, and which account voted, and use the running tally to keep deal info accurate. This changed on July 20, 2026: confirmations used to be fully anonymous, but a single device could repeat them and inflate a deal's score — which made the number families rely on untrustworthy. Confirming now requires signing in, and each account gets one vote per place (changing your mind updates that vote rather than adding another). You can also add an optional note with your confirmation ("tell us more") — notes are seen only by our team, are never shown publicly, and are stored with your vote. We store the place, your yes/no, and any note you chose to add — nothing else about you — the link is never shown publicly or to other users, and deleting your account deletes your confirmations. You can browse and use every deal without ever confirming one.
• City & metro requests (linked to your account) — asking us to cover a place we don't list yet requires signing in. For a city request we store the area's name and state, the city's approximate public-centroid coordinates (a published city center, not your location), a timestamp, a running count, and your account id; a metro request additionally records which screen it came from. We link these to your account so we can gauge real demand and prevent abuse.
• Problem reports (anonymous — not linked to you) — tapping "Deal not honored here? Report it" sends us the place you were looking at, the reason ("not participating"), and a timestamp, so our team can re-check that listing. This changed on July 28, 2026: reports used to stay on your device only, where nobody could act on them. Reporting does not require signing in, and we do not record who reported — not your account, even if you're signed in. Repeat reports for the same place are counted together, so what we see is "this place has N reports," never who sent them. A report goes into our internal review queue and is read by a person; it never changes or removes a listing by itself. A copy also stays on your device so the app can show you that you already reported it — clearing your app data clears that copy.

Family setup and Cars That Fit account sync

If you use Cars That Fit on carsthatfit.com, you can tell the tool about your household and what you need from a car. Depending on what you choose to enter, this can include children's car-seat stages and selected seat models, an optional age in whole years for each child you add (up to six) — stored with the month and year you entered it, so the tool can tell how much time has passed (after about a year it asks you to confirm rather than ageing a child silently) — a separate optional youngest-child age in whole years used for deal starring, whether you are planning for another child, your garage dimensions, a rough monthly car budget, vehicles already in your household, and preferences such as body style, powertrain, third row, price range, and must-have features. It can also include cars you save or compare, per-car preference overrides, and items you check during a dealer visit. We use these answers to tailor vehicle-fit results and, when you are signed in, to make your setup available in Little Deals and Cars That Fit on your other devices.

Before you sign in, a family setup is stored only in that browser or app installation and is not tied to an account. Changes you make while signed out stay on that device unless you later sign in. When you sign in to Little Deals on the website or iOS, or to Cars That Fit, we store the shared family setup on Supabase against your account so it can follow you among those clients. Cars That Fit also stores its car preferences and saved-car identifiers so those can follow you to other Cars That Fit browsers.

Optional household sharing: each adult uses a separate account. If you create a household and another adult accepts an invitation, its members can access the household's shared My Stuff setup: the child-related information described above, adult riders, owned vehicles, garages, car seats and strollers, where that gear is used or stored, and any seat-expiration information you enter. Your chosen display name identifies you to members. Owners and Editors can change the shared setup; Viewers can read it. Joining shows which setup will be kept, and replacing a setup requires an editing role and an explicit choice.

Shopping flows start private. A household invitation does not automatically share your car, seat, or stroller purchase flows. A flow becomes available to another adult only after they accept its own invitation. Accepted flow members can see its title, preferences, candidate shortlist, each member's likes, purchase/archive status, and recorded update attribution. Editors can change preferences and candidates; Viewers can read and like existing candidates. Likes remain attributed to the adult who made them, and only the flow's creator can delete the flow. Personal saved-car bookmarks remain separate from these shared lists.

An expired or revoked unused invitation does not grant access. Leaving a household or flow ends access through that membership. When leaving a household, you choose whether to keep a personal copy of its My Stuff setup or leave it behind; the remaining members can keep using the shared setup. A copy deliberately kept after leaving is separate from the live household. Shared changes are synchronized between authorized members; changes made offline can wait on the device until a connection returns.

Removal by the owner: an owner can remove another adult. Shared access ends immediately, including shopping shared between that adult and the household. Each creator keeps their own shopping privately. The removed adult’s existing personal setup stays unchanged. They alone can choose a copy of the household’s cars, crew and gear for 30 days; it excludes private shopping and VINs. Restoring requires a comparison and explicit choice. Declining deletes the copy’s contents immediately. Restore receipts expire with the original copy; expired copies and receipts are hidden immediately and deleted hourly. Clearing your Cars setup or deleting your account erases your copies and receipts. An offline device clears protected household data when it next checks access.

Recent household changes: household members can see the latest 20 inventory and placement changes from the past 30 days. Activity records contain an actor reference, time, item type, opaque item identifier, and action—not child names, VINs, notes, or copies of your setup. Your current display name is shown only while you remain a member. Expired events are hidden immediately and deleted by an hourly cleanup. Clearing your Cars setup erases your activity; account deletion removes your actor reference from any remaining shared events. Private shopping is not included.

Synced records include update timestamps. The family setup can also include a coarse app, device, or browser label such as “Little Deals iOS” or “iPhone · Safari,” used only to help you identify two conflicting setups. We do not use that label for analytics or advertising. Recommendations and vehicle-fit calculations still happen on your device. Signing out stops that client from syncing, but does not delete information already stored with your account.

Any child-related information is entered by you as the parent or caregiver, not collected from a child. We do not ask for a child's name or birth date. Accounts remain adults-only. One sign-in is shared between Little Deals and Cars That Fit — it is the same account on both. When a client detects that both the device and account family setups changed, it asks which setup to use instead of silently overwriting one. Sign-in choices, household joins, and conflict resolutions keep separate recovery copies on that device, stamped for the signed-in account. A copy expires 30 days after it was saved and is not extended by viewing or restoring it. Copies without a verifiable account stamp are not offered for restore. Clearing Cars setup, deleting the account, or clearing that app or browser's storage removes eligible copies. These copies are not a cross-device backup.

Deleting your account removes your personal server setup, Cars That Fit preferences, saved-car records, likes, and memberships. Shared household data and shopping flows may remain with other active members; responsibility for a shared flow can transfer to a remaining member. Shared records with no remaining members are deleted. Account deletion does not erase a personal copy another adult deliberately kept after leaving. “Clear my setup” clears the setup from the current client and, only while you are signed in, records the clearing on that client and retries sending it to your account when sync is reachable; while that retry is pending, the client does not restore the stale account copy. In Cars That Fit, its clear control also clears car preferences and saved cars; in Little Deals, it clears the shared family setup only. If you are signed out after previously syncing, sign back in before using that control, delete your account, or email us. Because a sync request can fail while offline or during a service error, use Delete account or email us if you need confirmed deletion of your synced account data. The shared-data retention rules above still apply when other members remain.

Cars That Fit launch notifications

While Cars That Fit is in private preview, its front door offers a single field for an email address if you would like to hear when the site opens. If you enter one, we store the address, where you entered it (the app door or a car page), the dates you entered it, and how many times — nothing else, and no account is created. We use it for one launch email and nothing further; we never sell or share it. The list is deleted after that launch mailing (or earlier on request). Because no confirmation step is required, someone else could type your address — the launch email says so and asks you to ignore it if that happened. To be removed sooner, email hello@littledealsapp.com.

Contributions you submit

If you add or edit a listing, or submit a family event, we collect what you provide — including free-text you write. For events, we ask for a public social media handle (Instagram or X), which is shown publicly alongside the event as creator attribution ("see more of their content"). Don't put anything in a contribution that you wouldn't want shown publicly. Edits to a chain's listing may be verified against an email domain associated with that brand. All contributions are reviewed by us before they go live.

Push notifications

The app does not currently send push notifications, and it collects no push token. If we add notifications in a future update, allowing them would let Apple issue your device a push token that we'd store only to deliver the alerts you turned on — for example when new deals arrive in your area — linked to your account so you could manage or remove your devices, and deleted with your account. A token like that is never shared for advertising and can't read anything on your phone, and notifications would always be optional and off until you allow them. We'll update this policy and Apple's app privacy labels before any notification feature ships.

Technical/log information

Like most websites and apps, our hosting and content-delivery providers automatically process basic technical information needed to deliver the app securely and reliably (for example, IP address and request data). We don't combine this into advertising or tracking profiles.

Analytics

On the website / progressive web app we use Google Analytics 4 to understand overall, aggregate usage — for example how many people visit, which pages are popular, and roughly where visitors come from — so we can improve the app. We run it in measurement-only mode: Google's advertising features are turned off (no Google Signals, no ad personalization, no remarketing), and — per Google — Google Analytics 4 uses your IP address only momentarily to derive a coarse, region-level location and does not log it for Analytics. We do not use it to build advertising profiles or track you across other sites or apps. To do this, Google Analytics sets a first-party cookie (named _ga) on your device to tell a returning visitor from a new one, plus a related _ga_* measurement cookie; they are not used for advertising. You can clear them anytime via your browser settings. If your browser sends Global Privacy Control (GPC) or its legacy Do Not Track signal, here is exactly what happens. GPC is a legal opt-out of the sale or sharing of personal information — and we never sell or share anyone's data, signal or not, so everyone already gets what GPC asks for. On top of that, when we see either signal we tell Google Analytics to deny analytics storage: the _ga cookies described above are never set, so we can't recognize you as a returning visitor and your visits are counted anonymously, as one-offs. The measurement-only counting itself — the same ad-free, profile-free tally everyone gets — stays on, because it isn't tied to who you are. An ad-blocking extension that blocks Google Analytics will stop even that.

In the native iOS app we use TelemetryDeck for the same measurement-only purpose — aggregate, anonymous usage such as which tabs are opened and how often deals are viewed (by category, never which specific place is yours). It collects no advertising ID and no precise location; it uses a hashed device-level identifier to count distinct installs, is not linked to your account, and does not track you across other apps or websites — so it does not trigger Apple's App Tracking Transparency prompt. You can turn this off in the iOS app's Settings. TelemetryDeck is a European company and processes this data in the EU.

What we do NOT do

• We do not include any third-party advertising or marketing SDKs. Our only analytics are measurement-only and tracking-free: Google Analytics on the website and the privacy-preserving TelemetryDeck SDK in the iOS app (see "Analytics" above) — neither shows ads or tracks you across other apps or sites.
• We do not sell or rent your personal information.
• We do not track you across other apps or websites.
• We do not show targeted or behavioral advertising — to anyone, and specifically not to children or teens — and we do not build advertising or marketing profiles about you or your family.

Service providers we rely on

We use a small number of trusted providers ("sub-processors") to run the app. They process data only to provide their service to us:

• Supabase — database and account / sign-in (auth).
• Calendly — scheduling for Cars That Fit consultation-draw winners only: if you win a weekly consultation and book your session, the name and email you choose to give Calendly are handled under Calendly's own terms and privacy policy. Nothing is sent to Calendly unless you open the booking link.
• Apple (Apple Inc.) — Sign in with Apple for account sign-in on the native iOS app, and Apple Maps (MapKit), which renders the map inside the iOS app: the approximate region you're viewing is sent to Apple to fetch map imagery (not a precise GPS point or your identity). If we add push notifications in a future update, Apple Push Notification service (APNs) would deliver them.
• Vercel — website and app hosting, and the approximate IP-based location lookup.
• OpenStreetMap — supplies the map tiles on the website / progressive web app (the native iOS app uses Apple Maps instead — see Apple above). Your browser requests map "tiles" for the area you're viewing directly from OpenStreetMap, so the approximate region on screen (not a precise GPS point or your identity) is visible to them. City search in the app uses our own first-party city list, not OpenStreetMap search.
• Google Analytics (Google LLC) — aggregate website usage measurement, run with advertising features disabled (website only; not in the iOS app). When your browser sends a Global Privacy Control (GPC) or legacy Do Not Track signal, we deny analytics storage so the measurement cookie is not set.
• TelemetryDeck (TelemetryDeck GmbH) — anonymous, aggregate usage measurement in the iOS app only; hashed device-level identifier, no tracking, EU-processed.

To deliver these features your device makes requests to the providers above, and they necessarily receive technical data such as your IP address — the same as any website resource. Supabase stores the account information and signed-in synced data described in this policy, including favorites, your shared family setup, and, if you use Cars That Fit, car preferences and saved cars. We do not send that account or family-setup data to our map or analytics providers, and we do not send any provider your precise location. City names you type are resolved against our first-party city list (or Supabase place search) — not sent to OpenStreetMap. We don't control these providers; their handling of data is governed by their own policies.

Children's privacy

Little Deals is a general-audience tool made for parents, caregivers, and other adults to find family-friendly deals. It is not directed to children, and we do not knowingly collect personal information from children. Consistent with the U.S. Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from any child under 13.

Account creation is for adults only — accounts are intended for adults (18+). We ask you to confirm this; we don't independently verify age.

A parent or caregiver using Little Deals or Cars That Fit may choose to store information about their family, including a child's car-seat stage, an optional age in whole years for each child added (up to six, recorded with the month and year it was entered), and an optional youngest-child age in whole years. When the account holder is signed in, that information is stored with their account and synced to their other devices. It is provided by the adult account holder; it is not collected from the child. We do not ask for children's names or birth dates, and we do not use family-setup information for advertising or marketing profiles.

If we learn that we have collected personal information from a child under 13 without the consent required by law (or from anyone under 18 who created an account), we will delete that information and close any associated account as soon as we can. If you are a parent or guardian and believe a child has provided us personal information, contact us at hello@littledealsapp.com and we will promptly delete it.

Your choices and rights

You're in control of your information:

• Delete your account and data in the app under Settings → Delete account, or by emailing us. This also deletes any synced shared family setup, plus car preferences and saved cars from the Cars That Fit tool.
• Access or correct the personal information we hold about you by contacting us.
• Clear on-device data (favorites, recent searches, family profiles, cached approximate location) by clearing the app/browser storage on your device. Clearing browser or app storage by itself does not delete data already synced to your account. “Clear my setup” removes the family profile from that client and, while you are signed in, records the clearing there and retries sending it to the account copy when sync is reachable without restoring the stale account copy in the meantime. If you previously synced and are now signed out, sign back in before using that control, delete your account, or email us. “Clear my setup” is not a confirmed-delete control during an outage. Use Delete account or email us to request confirmed deletion of all associated account data, including the synced family setup, car preferences and saved cars.
• Control location permissions in your device or browser settings.

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act (CCPA/CPRA) or the EU/UK GDPR — for example, the right to access, correct, delete, or receive a copy of your personal information, and to be free from discrimination for exercising these rights. We honor these requests for all users. Because we don't sell or share personal information for advertising, there's nothing to opt out of on that front. To make a request, email hello@littledealsapp.com.

Little Deals is operated from, and stores data in, the United States, and is intended for users in the United States. If you access it from outside the U.S., you understand your information will be processed in the U.S.

How long we keep information

We keep account information for as long as your account is active. When you delete your account, we delete your associated personal data (such as your favorites, synced recents and family setup, and — if you used Cars That Fit signed in — car preferences and saved cars). On-device data lives on your device until you clear it (a precise "Near me" fix is ignored after about 12 hours; a city you typed stays on your device until you clear it or pick a new one). In some family-profile conflicts, the setup you did not choose is kept on that device as a recovery copy. The client removes that backup the next time it runs after 30 days; clearing the app or browser's storage removes it sooner. Contributions you've submitted and that have been approved produce public listings and events that remain part of the guide even after you delete your account; when you delete your account we unlink them from your identity and delete the details that could tie them back to you — including a published event's public creator handle and social link, and any verification metadata (such as the email domain used to verify a brand edit). The anonymized listing or event content itself stays as part of the guide. Problem reports carry no link to any account, so there is nothing about you in one to delete; we keep the report and its count while the listing works through our re-check queue. We may retain limited information where required for legal, security, or fraud-prevention reasons.

Security

We use reasonable technical and organizational measures to protect your information, including access controls on our database. No method of transmission or storage is 100% secure, but we work to keep what little we collect safe.

Changes to this policy

We may update this policy as the app evolves. When we do, we'll change the "Last updated" date above, and we'll let you know of material changes through the app where appropriate.

Contact us

Questions or requests? Email hello@littledealsapp.com. We'd love to hear from you.