Privacy Policy

Personal users. When you create a free or Premium account, we collect your first and last name, email address, phone number, and a password. Your password is handled entirely by our authentication provider, Supabase — we never see it in plain text.

Businesses.When a business signs up or updates its profile, we collect the owner's first and last name, the business name, description, address, phone number, email, and anything else added to the profile — owner bio, social links, and timeline entries.

Photos. Listing, owner, gallery, and timeline photos are uploaded by our team, sourced either from a professional photo shoot we arrange or from photos a business emails to us directly. If you email us photos, that submission is used to populate your public listing.

Location data.When a business signs up, we send its address to Nominatim (OpenStreetMap) to resolve map coordinates, so the listing can appear in “near me” searches.

Payment information. We never see or store your full card details. Payments and subscriptions are processed entirely by Stripe — we only retain a Stripe customer ID and subscription ID to manage your account.

We track anonymous, aggregate interactions with business listings — phone number clicks, email clicks, page views, address and map clicks, website link clicks, discount reveals, and Facebook, Instagram, or Yelp link clicks. These events are not tied to your identity, IP address, or session; we only know that an interaction of a given type happened, on a given business, at a given time.

Discount redemptions are the one place our tracking isn't anonymous. When you redeem a discount code, we record which account redeemed which discount, and when, so the same code can't be redeemed twice by the same person. A business can mark a redemption as “used” once they've seen it redeemed in person — that's bookkeeping on the same already-collected record, not an additional category of data.

• To operate your account and the directory itself.
• To process payments and manage subscriptions, via Stripe.
• To send transactional email — password setup, receipts, welcome emails, premium-upgrade receipts, and cancellation confirmations — via Resend.
• To resolve a business's location for map and “near me” search.
• To understand aggregate, anonymous engagement with listings.
• To enforce the one-redemption-per-person, per-discount rule.

We use your browser's local storage to keep you signed in between visits. This isn't a third-party tracking cookie — it stores your session on your own device so you don't have to log in on every page.

Uploaded photos are stored in Supabase Storage and served from public URLs — anyone with the link can view them, by design, since they're meant to appear on public business listings.

We don't sell your personal information. We share it with the services that run the site:

• Supabase — database, authentication, and file storage.
• Stripe — payment processing and subscription billing.
• Resend — transactional email (password setup, receipts, welcome emails, cancellation confirmations).
• Nominatim / OpenStreetMap — address geocoding for map search.
• Sentry — error monitoring, which may capture parts of a failing request.

You can update your account information at any time from your account or dashboard settings. You can request that your account and associated data be deleted by contacting us at the email below.

We may update this policy as the product changes. If we make material changes, we'll update the “Last updated” date above.

Questions about this policy? Email us at checklocalfirst@gmail.com.