Privacy Policy

• Account: your email address and sign-in details. Passwords are handled by our authentication provider and stored only as secure hashes.
• Profile (optional): username, display name, avatar, bio and privacy setting, if you set them up.
• Date of birth: used only to decide which age-restricted deals you can see and pledge on. It's never shown to other members or venues.
• Location: the city or campus you pick, or, if you allow it, your device's position rounded to about a kilometre, used to show deals near you. Signed in, it's saved on your account; signed out, it stays in your browser.
• Agreements: which version of the Terms and Privacy Policy you agreed to, and when.
• Pledges: the deal, the name and email for your pass, how many spots, your visibility choice, the promoter tag of the link you arrived on, and what you were charged or refunded.
• Social: your friends and friend requests, invites you send and receive, and your notifications.
• Referrals: who invited you, whom you invited, and your fee credit balance.
• Passes: your pass codes and when each pass was scanned at the door.

Payments are processed by Stripe. Your card number is entered into Stripe's secure fields (or your Apple Pay or Google Pay wallet) and goes straight to Stripe. Potful never sees or stores your full card number or security code.

Stripe gives us back tokens (a customer ID and a payment method ID) that let us charge the saved card if a deal you pledged to tips, and refund it if needed. We keep those tokens, the amounts, and the payment status. Stripe's own privacy policy covers how Stripe handles your card.

Pledges are friends-only by default. Unless you choose otherwise at checkout, only your friends on Potful see that you're going to a deal.

• Incognito: switch it on at checkout, or set your profile to Incognito, and you appear to others only as an anonymous attendee.
• Profile privacy: your profile can be public, friends only, or incognito. You can change it any time in Profile & privacy.
• Headcounts are public: everyone sees how many people have pledged, not who.
• We never show your email address or payment details to other members.

Potful does not track your device's location. The "near me" feed filters deals by the city or campus you pick, not by GPS.

Where you're going is confidential. Which deals you pledged to and when your pass was scanned are shown only as your visibility settings allow. We don't sell this information or share it with advertisers.

Venues see what they need to run the deal: headcounts, totals, and pledges per promoter link. At the door, staff see the name on the pass they scan. Venues don't get your email address or payment details from Potful.

• Stripe, to save cards, charge them and issue refunds.
• Our hosting and database providers, who store data on our behalf under contract.
• Venues, only as described above.
• Authorities, when the law requires it, or to prevent fraud or protect people's safety.

We keep your account data while your account is open. Payment records (pledges, charges and refunds) are kept as long as tax and accounting rules require, even after an account is closed.

You can edit your profile, and change who sees you, at any time. To get a copy of your data or close your account, contactPotful support.

Data is encrypted in transit. Access to pledge, payment and pass records is limited to our servers and the people who need it; database rules keep members to their own records. No system is perfectly secure, so tell us right away if you think your account has been compromised.

We'll update this policy as Potful changes. If a change affects how we use data you've already given us, we'll tell you in the app first.