Privacy Policy

Who we are

"Little Deals" (the "app," "we," "us") is a community-built guide available as a website / progressive web app and as a native iOS app, operated by Chase McElroy, an individual based in California. You can reach us anytime at hello@littledealsapp.com.

Information we collect

Account information

Signing in is optional. On the website you use a passwordless "sign-in link": you give us your email address, and we email you a link to click — there's no password to create or remember. On the native iOS app you can use that same emailed link, or Sign in with Apple (which may share your Apple-provided name/email with us for account identity). We use a service called Supabase to manage sign-in. Your email is used to identify your account, sync your saved places across your devices, and to contact you about your account if needed. After you sign in, you may optionally save a display name and public social handles (Instagram, X, TikTok, YouTube, Facebook) so we can credit you on contributions you submit — these are stored with your account and deleted or unlinked when you delete your account. Little Deals accounts are for parents and other adults — when you sign up we ask for your birth year only to enforce 18+; we store a yes/no eligibility flag on your device (not the year itself) and never send the year to our servers. When you sign in from a device that passed that check, we record a one-time “attested 18+” timestamp on your account — the date you attested, never your age or birth year. We don’t independently verify age on the server. Browsing without an account never asks your age.

Sign in with Apple — native iOS app

On iOS you can choose Sign in with Apple. Apple may provide your name and email (or a private relay email) so we can create your account. When you delete your account we revoke the Apple authorization on our side (Guideline 5.1.1(v)) and remove your Little Deals data. Sign in with Apple is optional — the emailed sign-in link is always available.

Passkey sign-in (Face ID / Touch ID) — on our website

On our website, once you've signed in, you can optionally create a passkey so next time you can sign in with Face ID, Touch ID, or your device PIN instead of waiting for an email link. (The native iOS app uses Sign in with Apple and/or email sign-in links — no passkeys.) Passkeys use your device's built-in authenticator: your face, fingerprint, and PIN never leave your device and are never sent to us. All that's stored with your account (through Supabase, our sign-in provider, already listed below) is a public-key credential — a cryptographic key that lets us verify it's really you, but that can't be used to reconstruct your biometrics. Setting up a passkey is entirely optional and you can skip it; a small note is kept on your own device to remember that this device has a passkey set up. Deleting your account removes the credential along with the rest of your data.

Location

• Approximate (coarse) location. When the app loads, our hosting provider tells us a rough, city- or region-level location derived from your internet (IP) address so we can show deals near you. This is not precise GPS, and we don't prompt you for it.
• Precise location (only when you ask). If you tap "Near me," your device asks your permission and provides your GPS location — but we never send your exact coordinates to our servers. Your device rounds your location to roughly a kilometer (about half a mile) before anything is sent, which is all our backend needs to find and rank nearby deals. The live "you are here" dot on the map runs entirely on your device — your movements are never transmitted. A rounded copy is cached on your own device (so the app can show what's nearby next time without re-asking); a precise "Near me" fix is ignored after about 12 hours, and you can clear the cache anytime via your browser/app data. The permission itself is controlled by your device settings. On the native iOS app, "Near me" uses your device's approximate (reduced-accuracy) location as a single fix — it does not continuously track you as you move.

Activity in the app

• Saved favorites — places you bookmark. They live on your device, and when you sign in they also sync to your account so they follow you across your devices — on both the website / progressive web app and the native iOS app. They're deleted with your account.
• Recent searches — your last few city/place lookups, kept on your device; on the website / web app they also sync to your account when you're signed in, so they follow you across devices (on iOS they currently stay on your device).

Requests and confirmations

A few taps send a small signal to our backend so we can keep the guide accurate and decide where to expand. Deal confirmations and city/metro requests are both tied to your account (see why below); we never publish who confirmed what.

• Deal confirmations (tied to your account) — when you answer whether a deal worked for your family (thumbs up / thumbs down), we record the place, whether it worked, and which account voted, and use the running tally to keep deal info accurate. This changed on July 20, 2026: confirmations used to be fully anonymous, but a single device could repeat them and inflate a deal's score — which made the number families rely on untrustworthy. Confirming now requires signing in, and each account gets one vote per place (changing your mind updates that vote rather than adding another). You can also add an optional note with your confirmation ("tell us more") — notes are seen only by our team, are never shown publicly, and are stored with your vote. We store the place, your yes/no, and any note you chose to add — nothing else about you — the link is never shown publicly or to other users, and deleting your account deletes your confirmations. You can browse and use every deal without ever confirming one.
• City & metro requests (linked to your account) — asking us to cover a place we don't list yet requires signing in. For a city request we store the area's name and state, the city's approximate public-centroid coordinates (a published city center, not your location), a timestamp, a running count, and your account id; a metro request additionally records which screen it came from. We link these to your account so we can gauge real demand and prevent abuse.

Your family setup (stays on your device)

If you tell the app about your household — for example kids' car-seat stages, an optional youngest-child age used to star deals that fit, or, in the Family Cars tool, your garage dimensions and a rough monthly car budget — we use it only on this device to tailor suggestions. This setup is for parents and caregivers; it is stored only in your browser on your own device, is never sent to our servers, and is not tied to any account. Deleting your account does not clear it — use "Clear my setup" in the app, or clear site data. You can clear it anytime.

Contributions you submit

If you add or edit a listing, or submit a family event, we collect what you provide — including free-text you write. For events, we ask for a public social media handle (Instagram or X), which is shown publicly alongside the event as creator attribution ("see more of their content"). Don't put anything in a contribution that you wouldn't want shown publicly. Edits to a chain's listing may be verified against an email domain associated with that brand. All contributions are reviewed by us before they go live.

Push notifications

The app does not currently send push notifications, and it collects no push token. If we add notifications in a future update, allowing them would let Apple issue your device a push token that we'd store only to deliver the alerts you turned on — for example when new deals arrive in your area — linked to your account so you could manage or remove your devices, and deleted with your account. A token like that is never shared for advertising and can't read anything on your phone, and notifications would always be optional and off until you allow them. We'll update this policy and Apple's app privacy labels before any notification feature ships.

Technical/log information

Like most websites and apps, our hosting and content-delivery providers automatically process basic technical information needed to deliver the app securely and reliably (for example, IP address and request data). We don't combine this into advertising or tracking profiles.

Analytics

On the website / progressive web app we use Google Analytics 4 to understand overall, aggregate usage — for example how many people visit, which pages are popular, and roughly where visitors come from — so we can improve the app. We run it in measurement-only mode: Google's advertising features are turned off (no Google Signals, no ad personalization, no remarketing), and — per Google — Google Analytics 4 uses your IP address only momentarily to derive a coarse, region-level location and does not log it for Analytics. We do not use it to build advertising profiles or track you across other sites or apps. To do this, Google Analytics sets a first-party cookie (named _ga) on your device to tell a returning visitor from a new one, plus a related _ga_* measurement cookie; they are not used for advertising. You can clear them anytime via your browser settings, and browser "do not track" / ad-blocking extensions that block Google Analytics will simply opt you out.

In the native iOS app we use TelemetryDeck for the same measurement-only purpose — aggregate, anonymous usage such as which tabs are opened and how often deals are viewed (by category, never which specific place is yours). It collects no advertising ID and no precise location; it uses a hashed device-level identifier to count distinct installs, is not linked to your account, and does not track you across other apps or websites — so it does not trigger Apple's App Tracking Transparency prompt. You can turn this off in the iOS app's Settings. TelemetryDeck is a European company and processes this data in the EU.

What we do NOT do

• We do not include any third-party advertising or marketing SDKs. Our only analytics are measurement-only and tracking-free: Google Analytics on the website and the privacy-preserving TelemetryDeck SDK in the iOS app (see "Analytics" above) — neither shows ads or tracks you across other apps or sites.
• We do not sell or rent your personal information.
• We do not track you across other apps or websites.
• We do not show targeted or behavioral advertising — to anyone, and specifically not to children or teens — and we do not build advertising or marketing profiles about you or your family.

Service providers we rely on

We use a small number of trusted providers ("sub-processors") to run the app. They process data only to provide their service to us:

• Supabase — database and account / sign-in (auth).
• Apple (Apple Inc.) — Sign in with Apple for account sign-in on the native iOS app, and Apple Maps (MapKit), which renders the map inside the iOS app: the approximate region you're viewing is sent to Apple to fetch map imagery (not a precise GPS point or your identity). If we add push notifications in a future update, Apple Push Notification service (APNs) would deliver them.
• Vercel — website and app hosting, and the approximate IP-based location lookup.
• OpenStreetMap — supplies the map tiles on the website / progressive web app (the native iOS app uses Apple Maps instead — see Apple above). Your browser requests map "tiles" for the area you're viewing directly from OpenStreetMap, so the approximate region on screen (not a precise GPS point or your identity) is visible to them. City search in the app uses our own first-party city list, not OpenStreetMap search.
• Google Analytics (Google LLC) — aggregate website usage measurement, run with advertising features disabled (website only; not in the iOS app). When your browser sends a Global Privacy Control (GPC) signal, we deny analytics storage so the measurement cookie is not set.
• TelemetryDeck (TelemetryDeck GmbH) — anonymous, aggregate usage measurement in the iOS app only; hashed device-level identifier, no tracking, EU-processed.

To deliver these features your device makes requests to the providers above, and they necessarily receive technical data such as your IP address — the same as any website resource. We use them only to provide hosting, maps, and measurement, and never send them your account info, favorites, or precise location. City names you type are resolved against our first-party city list (or Supabase place search) — not sent to OpenStreetMap. We don't control these providers; their handling of data is governed by their own policies.

Children's privacy

Little Deals is a general-audience tool made for parents, caregivers, and other adults to find family-friendly deals. It is not directed to children, and we do not knowingly collect personal information from children. Consistent with the U.S. Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from any child under 13.

Account creation is for adults only — accounts are intended for adults (18+). We ask you to confirm this; we don't independently verify age.

If we learn that we have collected personal information from a child under 13 without the consent required by law (or from anyone under 18 who created an account), we will delete that information and close any associated account as soon as we can. If you are a parent or guardian and believe a child has provided us personal information, contact us at hello@littledealsapp.com and we will promptly delete it.

Your choices and rights

You're in control of your information:

• Delete your account and data in the app under Settings → Delete account, or by emailing us.
• Access or correct the personal information we hold about you by contacting us.
• Clear on-device data (favorites, recent searches, your family setup, cached approximate location) by clearing the app/browser storage on your device — or clear just your family setup from the app's setup / profile sheet.
• Control location permissions in your device or browser settings.

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act (CCPA/CPRA) or the EU/UK GDPR — for example, the right to access, correct, delete, or receive a copy of your personal information, and to be free from discrimination for exercising these rights. We honor these requests for all users. Because we don't sell or share personal information for advertising, there's nothing to opt out of on that front. To make a request, email hello@littledealsapp.com.

Little Deals is operated from, and stores data in, the United States, and is intended for users in the United States. If you access it from outside the U.S., you understand your information will be processed in the U.S.

How long we keep information

We keep account information for as long as your account is active. When you delete your account, we delete your associated personal data (such as your favorites and synced recents). On-device data lives on your device until you clear it (a precise "Near me" fix is ignored after about 12 hours; a city you typed stays on your device until you clear it or pick a new one). Contributions you've submitted and that have been approved produce public listings and events that remain part of the guide even after you delete your account; when you delete your account we unlink them from your identity and delete the details that could tie them back to you — including a published event's public creator handle and social link, and any verification metadata (such as the email domain used to verify a brand edit). The anonymized listing or event content itself stays as part of the guide. We may retain limited information where required for legal, security, or fraud-prevention reasons.

Security

We use reasonable technical and organizational measures to protect your information, including access controls on our database. No method of transmission or storage is 100% secure, but we work to keep what little we collect safe.

Changes to this policy

We may update this policy as the app evolves. When we do, we'll change the "Last updated" date above, and we'll let you know of material changes through the app where appropriate.

Contact us

Questions or requests? Email hello@littledealsapp.com. We'd love to hear from you.