Privacy Policy

1. Scope and roles

This Privacy Policy explains how NeighborBoost (“NeighborBoost,” “we,” “us,” or “our”) handles information through neighborboost.app, the NeighborBoost business dashboard, staff redemption tools, customer claim pages, and connected NeighborBoost devices.

A participating local business controls its offer and its staff access. For information processed on that business’s behalf, the business may also have its own privacy obligations and policies.

2. Information we collect

Customer claim information

The core claim flow records an unguessable claim identifier, fallback claim code, business, device, campaign, offer, creation and expiration times, claim status, redemption status, attribution source, and Friend Pass relationship. A customer name, account, email address, and phone number are not required.

Business-user information

We process business and staff account identifiers, email addresses, password hashes, roles, session information, offer settings, configuration history, and actions taken through the owner or staff interfaces.

Device and service information

We process device identifiers, authentication-token hashes, firmware version, configuration version, heartbeats, operational events, timestamps, network request metadata, request identifiers, and basic security logs. We do not intentionally place Wi-Fi passwords, plaintext account passwords, device tokens, or claim-token secrets in application logs.

Cookies

We use an essential signed session cookie for owner and staff authentication. It is configured as Secure, HttpOnly, and SameSite=Lax in production. We do not currently use advertising cookies, cross-site behavioral tracking, or third-party analytics on the public website.

3. How we use information

• Provide, secure, maintain, and troubleshoot the service.
• Create, validate, and redeem guaranteed offers and Friend Passes.
• Prevent duplicate redemption, abuse, unauthorized access, and event forgery.
• Display tenant-scoped business metrics and clearly labeled estimates.
• Maintain audit records, respond to support or legal requests, and comply with law.
• Improve reliability and usability using operational information that is appropriate for that purpose.

We do not use the core claim flow to require or reward a public review. We do not sell personal information or share it for cross-context behavioral advertising.

4. When information is disclosed

We may disclose information to the participating business responsible for the offer; infrastructure and security providers that help operate the service; professional advisers under appropriate duties; or authorities when reasonably necessary to comply with law, protect rights and safety, or investigate abuse. Providers may process information only for the services they perform for us.

If the business is reorganized, financed, acquired, or sold, information may be transferred as part of that transaction subject to applicable law and the promises in this policy.

5. Retention

We keep information only while it is reasonably necessary to operate the service, preserve claim and redemption integrity, support the participating business, meet contractual or legal obligations, resolve disputes, and protect the service. Retention depends on the record type, campaign lifecycle, business relationship, security need, and applicable law. When information is no longer needed, we take reasonable steps to delete or de-identify it. Backups may retain information for a limited additional period until rotation.

6. Privacy choices and requests

Depending on where you live, you may have rights to request access, correction, deletion, or information about how personal information is handled. Send a request to deallomcconnell@gmail.com. We may need to verify the request and may retain information when permitted or required by law.

Because NeighborBoost does not use advertising cookies or cross-site behavioral tracking, it does not currently respond differently to browser “Do Not Track” signals. Third parties are not permitted to collect personally identifiable information through NeighborBoost for cross-site advertising.

7. California notice

In the preceding 12 months, the service may have processed identifiers for business users, internet or network activity, and commercial or operational records described above. We use these categories to provide and secure the service, prevent fraud, support users, and comply with law. We do not sell these categories or share them for cross-context behavioral advertising. The retention criteria are described in Section 5. California residents may submit the requests described in Section 6, and we will not discriminate for exercising applicable privacy rights.

8. Children

NeighborBoost is a business service and is not directed to children under 13. We do not knowingly collect personal information from children under 13 through the core claim flow. If you believe a child provided personal information, contact us so we can review and address it.

9. Security

We use safeguards designed for the information processed, including HTTPS, tenant-scoped authorization, hashed credentials and device tokens, CSRF protection, secure production cookies, rate limits, input validation, and duplicate-redemption controls. No online system is completely secure, and we cannot guarantee absolute security.

10. Changes to this policy

We may update this policy as the product or law changes. We will post the revised policy here with a new effective date and provide additional notice when required.

11. Contact

Privacy questions and requests: deallomcconnell@gmail.com. Please do not email passwords, Wi-Fi credentials, activation codes, claim links, or other secrets.