Privacy Policy

Who we are

Foodie Adventure Passport ("FAP", "we", "us") operates a subscription dining-deals service in the Raleigh-Durham-Cary Triangle area of North Carolina. This policy explains what personal information we collect, how we use it, and the choices you have. Questions? Email hello@foodieadventurepassport.com.

Information we collect

• Account data: Name, email address, password, and your home city preference are securely stored in our database provider.
• Payment data: handled entirely by Stripe. We never receive your card number from Stripe. We keep only your subscription status, plan, and Stripe customer reference.
• Redemption activity: which offers you redeem, when, and at which restaurant, plus your optional star ratings and survey comments.
• Proof of Visit photos: if you choose to upload a receipt photo after a redemption, we store that image. A receipt can show the restaurant, date and time, the items you ordered, the tip, and sometimes your name or the last digits of your payment card. Please cover card details before taking the photo — we do not need them. Your browser asks for camera permission only when you choose to take a photo.
• Location: only if you grant browser permission, and only to sort nearby restaurants. We do not track your location in the background or store a location history.
• Push subscriptions: if you enable notifications, we store the browser push endpoint needed to deliver them.

How we use your information

• To operate your Passport: authenticate you, process subscriptions, validate and log redemptions, and track quests, streaks, and rewards.
• To send transactional emails (receipts, renewal reminders, reward claims) via Resend.
• To send push notifications you have opted into — you can turn each category off in Account settings at any time.
• To give restaurant partners aggregate analytics about redemptions at their own venue.
• To verify visits: FAP staff review Proof of Visit photos to confirm that redemptions counted toward quests, streaks, and leaderboard prizes really happened, and to prevent fraud. Restaurant partners never see your photos — they see only whether a visit was verified.

Sharing with restaurant partners

If — and only if — you checked the marketing consent box at signup, we share your email address with a restaurant after you redeem a deal there, so they can send you their own offers. You can withdraw this consent in Account settings, and every partner email must include an unsubscribe link. If you never opted in, your email is never shared. We do not sell your personal information to anyone.

Leaderboard display

The city leaderboard shows only your first name, last initial, city, XP, and streak. You can change your display name in Account settings.

Service providers

We rely on Stripe to process payment information, and on third-party providers for hosting, database, email delivery, and security. Each receives only the data needed to perform its function.

Cookies

We use strictly necessary cookies to keep you signed in. We do not use third-party advertising cookies.

Your rights

• Access & correction: view and edit your profile in Account settings.
• Deletion: use "Delete my account" in Account settings to permanently erase your account, cancel billing, and remove your personal data, including any Proof of Visit photos. Or email us and we'll do it within 30 days.
• Notification opt-out: every category can be disabled in Account settings, effective immediately.

Data retention & security

We keep your data while your account exists. Anonymized, aggregate redemption statistics may be retained after deletion. All traffic is encrypted with HTTPS, database access is protected by row-level security, and redemption tokens expire after 5 minutes. Proof of Visit photos are stored in a private bucket that is never publicly accessible, can be viewed only by FAP staff through time-limited links, and are kept while your account exists. When you delete your account, your photos are deleted with it.

Breach notification

If we ever experience a security incident that compromises the personal information we hold, we will notify affected users without unreasonable delay, consistent with North Carolina's Identity Theft Protection Act. Notification will be made by email or another appropriate method and will include:

• The types of information involved
• What happened and when
• Steps we have taken to secure our systems
• Guidance on how you can protect yourself
• How to contact us for more information

We may delay notification if law enforcement determines that immediate notice would impede an investigation or jeopardize security. Once that restriction is lifted, we will notify you promptly.

Your responsibilities

You are responsible for keeping your account secure. This includes choosing a strong password, storing it safely, and not sharing it with others. If you believe your account has been accessed without your permission, please change your password immediately and contact us so we can help investigate.

When uploading Proof of Visit photos, please avoid including sensitive information such as full payment card numbers. Cover or crop card details before submitting a receipt image.

You are also responsible for keeping your device and browser updated, managing your own notification and location permissions, and reviewing this policy periodically so you understand how your information is used.

Children

Our service is not directed to children under 13, and we do not knowingly collect their data.

Changes to this policy

We'll post any changes here and update the date above. Material changes will be announced by email or in-app notice.