Privacy Policy

Who we are

TownSquare is a UK-based hyperlocal offers platform operating in the West Midlands. You can contact us at [email protected].

What we collect

• Account: email, display name, password hash (argon2id).
• Location: postcode sector (e.g. “B15 2”) by default, not full postcode. Full coordinates only if you explicitly opt in.
• Preferences: interest categories, notification schedule, marketing consent.
• Activity: offer impressions, clicks, saves, and redemptions tied to your account.
• Reviews: rating and optional review text after a verified redemption.
• Essential cookies: one HTTP-only session cookie (ts_access) and a refresh token cookie (ts_refresh).
• Optional analytics: PostHog, only if you accept analytics cookies.

Why we collect it (lawful basis)

• Performance of contract: to operate the account, deliver offers, and process redemptions.
• Legitimate interest: anti-fraud, abuse prevention, product improvement.
• Consent: marketing emails, analytics cookies, push notifications.
• Legal obligation: VAT records for redemption transactions (retained 7 years).

Retention

• Account data: until you delete your account. After deletion, PII is scrubbed within 30 days.
• Redemption records: retained 7 years for tax purposes.
• Access logs: 90 days.
• Backup copies: 30 days.

Your rights

• Access: request a copy of your data via /api/v1/me/export or email.
• Erasure: delete your account from settings. Soft-delete is immediate; scrub within 30 days.
• Rectification, restriction, objection, portability.
• Complain to the ICO: ico.org.uk.

Third parties (data processors)

Each has a Data Processing Agreement in place before launch.

• Stripe — payments
• Expo — push notification delivery
• Cloudflare — CDN, WAF, R2 object storage
• Mapbox — maps
• Sentry — error reporting
• PostHog — product analytics (only with consent)

Changes

We will notify you of material changes via email and in-app notice at least 14 days before they take effect.