Privacy Policy

Last updated: November 14, 2026. Effective: November 14, 2026.

Summary

We collect what you give us (like your email and receipts) and basic technical data needed to run the site.
We do not sell your personal information, and we do not share it for targeted ads.
Your precise location stays on your device. We never collect or store it.
Businesses see counts of visits and new vs returning customers, never your name or contact details.
We use trusted providers to run the service: Supabase, Cloudflare and Stripe.
You can see, correct, export and delete your data, wherever you live in the US.
AT Rewards is not for children under 13.

This summary helps you read the full text below. The full text is what applies.

This policy explains what AT Rewards ("we", "us") collects through aroundtownrewards.com and our web app (the "service"), how we use and share it, how long we keep it and the choices you have. It covers members and visitors. It is also our notice at collection under California law. Businesses that use our partner portal should also read the Partner and Merchant Privacy Policy.

"Personal information" means information that identifies or could reasonably be linked to you. It does not include deidentified or aggregated data.

1. What We Collect

Account details: your email, name if you give it, and your password (stored only in scrambled, hashed form by our sign in provider). If you choose to give us a phone number, we store it.
Area: a ZIP code or city you type in, to show you local businesses.
Receipts: the photo you upload and what we read from it, such as the business, date, time, items, totals and payment type. Receipts can show the last digits of a card. We use them only to check the receipt.
Rewards activity: offers you claim, points earned, spent, gifted or reversed, perks and gift cards you redeem, and Prize Drop entries.
Invites: who invited you, and who joined through your link.
Your choices and content: likes, follows, "not for me" ratings, business suggestions and nominations, and messages you send us.
Ask AT questions: the questions you ask and the answers given.
Technical data: IP address, browser and device type, pages viewed, and error and security logs. Your IP address may suggest your general area. We do not use it to find your precise location.

2. Where It Comes From

You, when you sign up, scan receipts, claim offers, ask questions or contact us.
Your device, when you use the service (technical data).
Other members, when a friend invites you.
Businesses, when they confirm or dispute a visit or perk use, or tell us about a return.
Service providers, such as gift card providers that confirm a delivery.

3. How We Use It

To run your account, check receipts, add points and deliver perks, gift cards and prizes.
To show offers and businesses near the area you chose, and to sort them by what you like.
To prevent fraud, such as duplicate or edited receipts and fake accounts.
To show businesses counts of visits and of new vs returning customers.
To answer your Ask AT questions and your messages to us.
To send account messages and, if you agree, marketing emails or texts.
To improve and secure the service, meet legal duties, enforce our terms and defend legal claims.

We do not use your personal information for purposes that are not reasonably related to these without telling you and, where the law requires, asking for your consent.

4. Location

We do not collect or store your precise location. If you allow it, your phone or computer uses its location on the device only, to find and sort Offers Near You. That location is never sent to our servers. You can say no or turn it off at any time in your device or browser settings, and the rest of the service works the same.

If you type a ZIP code or city, we may store it to show you local businesses.

5. Ask AT and Automated Tools

Ask AT is an AI assistant that runs on Cloudflare Workers AI. Your question is sent to Cloudflare to create the answer. Please do not include personal or sensitive information in questions.

If Ask AT cannot answer a question, we save the question without your name or contact details and show it to the business owner so they can add the answer.

We use automated tools to read receipts and to check them for fraud and duplicates. These checks may hold a receipt for review. We do not use automated processing to make decisions that have legal or similarly significant effects on you. If you disagree with a decision about your receipts or points, email [email protected] and a person will look at it.

6. What Businesses See

Businesses on AT Rewards see counts, such as how many visits, perk uses and new vs returning customers came from their offers. They never see your name, email, phone or other contact details. When you like, follow or rate a business, the business sees totals, not who you are.

8. Cookies, Ads and Do Not Track

We use cookies and similar storage on your device that are needed to sign you in, remember your settings and keep the service secure. We may measure how the service is used in aggregate.

There are currently no ads from third party ad networks on the service, and we do not use third party advertising cookies or pixels. If that changes, we will update this policy first and give you a way to opt out.

There is no common standard for "Do Not Track" signals, so we do not respond to them. We honor Global Privacy Control (GPC) signals as a request to opt out of sale and sharing, even though we do neither.

9. Emails and Text Messages

We send account messages, such as sign in links, receipt results and security notices. These are part of the service.
Marketing emails include an unsubscribe link and our contact details, as the CAN-SPAM Act requires. We act on unsubscribe requests within 10 business days.
We send text messages only if you give us your number and agree. Reply STOP to opt out or HELP for help. Message and data rates may apply. We do not share your phone number with others for their marketing.

10. How Long We Keep It

We keep account details, receipts and rewards history while your account is open, so we can check receipts, handle disputes and prevent fraud.
When you delete your account, we delete or deidentify your personal information within a reasonable time, usually within 30 days. Copies in backups are removed as the backups cycle.
We may keep limited records longer when we need them to prevent fraud (for example, to stop closed accounts from rejoining), meet tax or legal duties, or resolve disputes.
Ask AT questions saved for business owners carry no name or contact details.

11. Security

Data is stored in the United States with encryption in transit and at rest. Access is limited to the people and systems that need it, and members can see only their own records. No system is perfectly secure. If a security incident affects your personal information, we will tell you and regulators as the law requires (in Florida, within 30 days). Please use a strong password and tell us at [email protected] if you suspect a problem.

12. Your Rights

Wherever you live in the US, you can ask to:

know and access the personal information we hold about you, and get a copy in a portable format;
correct it;
delete it (you can also delete your account in the app);
opt out of the sale or sharing of personal information, targeted advertising and profiling (we do none of these);
limit the use of sensitive information (we use it only to provide the service);
withdraw consent you gave for a feature, such as location or texts;
be treated equally: using these rights never lowers your points or service.

How. Use the app or email [email protected] with "Privacy" in the subject. We verify requests by confirming the email you sign in with. An authorized agent can act for you with your signed permission. We answer within 45 days, or tell you if we need more time as the law allows.

Appeals. If we deny your request, you can appeal by emailing [email protected] with "Appeal" in the subject. We answer within the time your state's law sets. If you are not satisfied, you can contact your state attorney general.

13. California

In the past 12 months we collected these categories of personal information: identifiers (name, email, phone, IP address, account ID); customer records (name, phone, and card last digits printed on receipts); commercial information (receipts, offers claimed, points and redemptions); internet activity (how you use the service); visual information (receipt photos); general geolocation (ZIP, city, or the general area suggested by an IP address, never precise location); and inferences (your likes and fraud risk signals). Sources, purposes, recipients and retention are described above. We did not sell or share personal information, and we have no actual knowledge of selling or sharing that of anyone under 16. We collect sensitive personal information (account sign in details) only to provide the service.

Notice of financial incentive. Our points program is a financial incentive under California law. You opt in by creating an account and agreeing to the Terms of Use, and you can leave at any time by deleting your account. It involves the categories above. We believe the value of your data to us is reasonably related to the points you receive: we calculate it in good faith from what businesses pay us for verified visits and perk uses, less the cost of running the program, and pass a share of that value back to members as points.

Shine the Light. We do not share personal information with third parties for their direct marketing.

14. Other States

Residents of Florida, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with privacy laws have rights to confirm, access, correct, delete and get a copy of their personal data, and to opt out of sale, targeted advertising and profiling. We give these rights, and the appeal process above, to every member, whether or not a law requires it. Our points program is a bona fide loyalty program, and no benefit depends on selling personal data. Nevada residents: we do not sell covered information, but you may still send a request to [email protected].

15. Children

The service is not directed to children, and members must be 18 or older. We do not knowingly collect personal information from children under 13. If we learn that we have, we delete it. If you believe a child has given us information, email [email protected].

16. Users Outside the United States

The service is for people in the United States. Our data is stored and processed in the United States, where privacy laws may differ from those in other countries.

17. Other Websites

The service may link to websites we do not run, such as a business's own site or a gift card provider. Their privacy policies apply to what they collect.

18. Changes to This Policy

We will post changes here and update the date at the top. For material changes, we tell you in the app or by email at least 30 days before they take effect. We will not use data we already collected in a materially different way without your consent.

19. Contact

Questions or requests: [email protected]. For privacy requests and appeals, put "Privacy" or "Appeal" in the subject.