Privacy Policy

Effective July 11, 2026

We keep the smallest amount of information that lets the product work: your email address, which Home Depot stores you pay for, what you want to be alerted about, and the fact that you have an active subscription. That is close to all of it.

There are no analytics scripts, no advertising trackers, and no third-party pixels anywhere on this site. We do not sell your data, and we never will. We have never seen your card number.

01Who is responsible for your data

Penny Vulture is operated by [LEGAL ENTITY NAME — TBD], and we are responsible for the information described here. If you want anything explained, changed, or deleted, email support@pennyvulture.com and a human will answer.

02Everything we store about you

This is the complete list — it is the actual contents of our database, not a summary of it.

Your email address, and when you signed up

To sign you in, send the alerts you asked for, and email you about billing.

Your password

Stored only as a scrambled hash we cannot reverse. If you sign in with Google we never receive a password at all.

Which stores you pay for

The store number, when the subscription started, and whether it is active. This is what tells the app which store's items to show you.

Your subscription status

A Stripe customer ID, a subscription ID, and the date your current month ends. Enough to know you have paid, and nothing more.

Your alert preferences

Which kinds of alerts you want, for which stores, and any minimum discount you set.

Where to send alerts

Which of your channels each alert kind goes to. Today that means your email address and the in-app alerts list.

Alerts we have sent you

Which alert went to which of your channels, whether it sent, and whether you have read it — so you don't get the same alert twice.

Items you favourited

The store and item number of anything you hearted.

Your live re-checks

Which item you re-checked and when, only so we can enforce the limit of 10 per day.

Store changes

When you moved a subscription from one store to another, so we can apply the 14-day cooldown.

Server logs

Our hosting providers briefly record IP addresses and request times, as every web server does. We use them to keep the site up and to stop abuse, and we do not build profiles from them.

03What we deliberately do not do

No analytics or tracking. There is no Google Analytics, no Meta pixel, no Segment, no PostHog, no session recorder, and no heatmap on this site. We do not know which pages you visited.
No advertising, ever. We do not run ads, we are not in an ad network, and no advertiser gets anything from us.
We do not sell or rent your data. Not to data brokers, not to retailers, not to anyone. There is no version of this business where we do.
We never see your card. Your card number, expiry, and security code go straight to Stripe and never touch our servers.
We do not track your location. The site never asks your browser or phone for your location. You tell us which store you care about; we do not work out where you are.
No advertising or analytics cookies.Your login is kept in your browser's own local storage, not a cookie. See §6.

04Why we hold each thing

We only use your information to run the product you paid for: signing you in, showing you the right store, sending the alerts you turned on, taking payment, enforcing the limits in the Terms, answering your emails, and keeping the service secure and online.

We do not use it for anything else, and we will not start using it for something new without telling you first.

05Who else touches it

Running the service means a few other companies process some of your data on our behalf. Each one only gets what it needs to do its job:

Supabase

Stores your login and the account database (email, stores, preferences).

Stripe

Takes the payment. They hold your card details — we never receive them.

Vercel

Serves the website. Their server logs briefly record request IP addresses.

DigitalOcean

Runs the servers behind the site.

Cloudflare

Sits between the internet and our servers to route traffic and block attacks. They see requests in transit, including IP addresses.

Google

Only if you choose “Sign in with Google” — they tell us your email address.

Our email provider

Delivers the alert and account emails you ask for.

Beyond that, we share your information only if the law actually requires it — a subpoena, a court order, or similar — or if we ever sell the business, in which case it would move with it and you would be told before anything changed.

06Cookies and local storage

Penny Vulture does not use advertising or analytics cookies. When you log in, your session is stored in your browser's local storage on your own device. We also keep a note there of the last time you opened the feed, so we can show you what is new — that note never leaves your browser.

Clearing your browser data logs you out and wipes both. Nothing is lost but the login.

07The emails we send

You get email from us in two flavours:

Alerts you asked for — penny signals and deals. Turn any of them off from your account page, at any time, in one click. We will not email you about deals if you tell us not to.
Account and billing notices — receipts, payment failures, price changes, and changes to these policies. You cannot turn these off while you have an account, because they are the things you would be angry to miss.

We do not send marketing blasts, and we will not add you to a list you did not ask for.

08How long we keep it

Your account data stays for as long as you have an account. When you delete your account we delete your email, your preferences, your favourites, and your alert history within 30 days.

Two exceptions, both boring: billing records have to be kept for tax and accounting purposes for as long as the law requires, and server logs age out on their own within a short window.

09Your rights

You can get rid of all of it, and it is not a fight.

Email support@pennyvulture.com and ask us to delete your account. We will do it and confirm when it is done — no retention offer, no five-step cancellation maze.

Wherever you live, you can ask us to show you what we hold about you, correct it if it is wrong, delete it, or send you a copy. If you are in California, the UK, or the EU, you have these rights explicitly under your own laws, and we honour them for everyone regardless.

We will never charge you for asking, and we will never treat you differently because you did.

10Keeping it safe

Traffic to the site is encrypted. Passwords are hashed by Supabase and are unreadable to us. Card details are handled entirely by Stripe. Access to the production database is limited to the people who run the service.

No system is perfectly secure, and we would rather say so than pretend otherwise. If we ever have a breach that affects you, we will tell you promptly and tell you what to do about it.

11Children

Penny Vulture is for adults — you must be 18 to have an account. We do not knowingly collect anything from children. If you believe a child has given us information, email support@pennyvulture.com and we will delete it.

12Changes to this policy

If we change how we handle your data in a way that actually matters, we will email you and update the effective date at the top of this page before it takes effect. We are not going to quietly widen this policy and hope you don't read it.

13Contact

Any question about your data, or about this policy: support@pennyvulture.com.