Privacy Policy

1. What This Policy Covers

This Privacy Policy explains what information DivvyUp collects, how we use it, and the choices you have. It applies to our website and mobile app (the "Service").

2. Information We Collect

• Account information — name, email address, password (stored hashed), and account type (consumer or business).
• Business information — business name, address, and campaign details for business accounts.
• Location data — with your permission, your device's fresh precise latitude and longitude, accuracy, and device-recorded timestamp are briefly transmitted to verify that you entered a deal's geofence. We do not store those coordinates as a continuous location history. We record the resulting geofence event (which campaign, event type, and when).
• Push notification token — a device identifier used to deliver optional deal and account notifications and measure delivery outcomes.
• Activity data — deals viewed, survey responses, promo codes issued, and app interactions.
• Yard sign referrals — when you tap Claim Offer, Request Service Quote, or Visit Website on a yard sign page, we record the sign, action and time. A random first-party browser ID stored on this device for up to 90 days helps estimate distinct referred browsers; our server keeps only a business-scoped hash of that ID, not your IP address or device fingerprint in this record. Clearing site storage resets the browser ID.

3. How We Use Information

• To deliver location-based deal notifications when you enter a participating business's geofence;
• To show nearby deals and operate consumer features like surveys and promo codes;
• To give businesses aggregate campaign analytics (visits, notification delivery, survey results);
• To show businesses aggregate yard sign referral actions and separately count saved claims and quote inquiries. Browser counts are estimates, not confirmed individuals, purchases, or sales.
• To secure accounts, prevent abuse, and comply with legal obligations;
• To communicate with you about the Service (e.g., email verification).

4. Location Data — the Details

• When your device reports a geofence entry, fresh precise location, accuracy, and timestamp are sent over an encrypted connection and used briefly to verify that the device is within the participating business's geofence. The precise coordinates, accuracy, and device-recorded timestamp are not written to our geofence-event record.
• We do not build a continuous history of your movements; we record discrete geofence entry or exit events after verification.
• Businesses see aggregate and per-event campaign statistics — not a live map of individuals.
• Foreground and background location are optional. Background location is used only for geofence features. You can decline or disable either permission at any time; the rest of the Service remains available, but affected nearby or arrival features stop working.
• Push notifications are also optional and separately controlled in device settings. Turning them off stops alerts, not account access.

5. What We Share

• With businesses — campaign analytics tied to their own campaigns, such as geofence visit counts, notification outcomes, and survey responses you choose to submit.
• Service providers — infrastructure providers that host our servers or uploaded images, deliver email and push notifications (including Expo's push service), process payments (Stripe), and support business relationship management (HubSpot). They process only the information needed for those functions under their applicable terms and obligations.
• Legal — if required by law or to protect the rights, safety, or property of DivvyUp or others.
• We do not sell your personal information.

6. Data Retention

• Account and business profile data are kept while the account is active and removed when the account is deleted, subject to the exceptions below.
• Raw geofence entry/exit records and raw activity-feed events become eligible for scheduled deletion after 90 days.
• Yard sign referral action records, including the business-scoped browser hash, become eligible for scheduled deletion after 90 days. The local browser ID rotates after 90 days and can be removed sooner by clearing site storage.
• Survey answers and associated reward or redemption records are eligible for scheduled deletion after 365 days while the account is active, and are removed sooner when the applicable account is deleted.
• Support and contact messages become eligible for scheduled deletion after 365 days. Account deletion scrubs the account link and the sender's identifying fields from retained support records.
• A push token is kept while it is registered to your account so we can send notifications. It is replaced when your device supplies a new token and removed when it is reported invalid, notifications are unregistered, or the account is deleted.
• Uploaded files referenced by retained content follow that content's deletion. Unfinished or unreferenced uploads are removed by orphan cleanup. File deletion may be queued and retried, so removal from object storage can complete shortly after the account or record disappears from the Service.
• Payment, communications, or other processor records may remain with the processor where it must retain them for tax, accounting, fraud-prevention, dispute, or other legal obligations.

7. Security

We use industry-standard safeguards, including encrypted connections (HTTPS) and hashed passwords. No system is perfectly secure, so we cannot guarantee absolute security.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

9. Your Choices and Rights

• Update your profile information in the app's settings;
• Turn off location access or notifications in your device settings at any time;
• Download an authenticated JSON copy of your account data from in-app Settings;
• Correct your profile or permanently delete your account in in-app Settings;
• If you cannot sign in or an in-app control is unavailable, email contact@divvyup.shop for access, correction, export, or deletion help;
• Depending on where you live, you may have additional rights (such as access, correction, and deletion) under local law.

10. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify you through the Service or by email before they take effect.