Privacy Policy

This Policy applies to the SaveAtCost.co website, account dashboard, native mobile application, browser extension, and related support. The entity responsible for the processing described here is the operator of SaveAtCost.co.

It does not govern a retailer, Stripe-hosted checkout or portal pages, or other third-party websites and services that publish their own privacy notices.

• Account and profile data: first and last name, country, email address, password hash, email-verification status, role, account dates, and login/security status.
• Membership and preference data: primary and optional secondary Costco membership numbers, membership level, Costco Visa indicator, and optional email preferences.
• Purchase and receipt data: receipt and order identifiers, membership number shown on the receipt, warehouse number/name, region, channel, transaction date and type, item numbers and descriptions, quantities, prices, discounts, taxes, returns, fuel details, and totals.
• Derived and shopping-planning data: spending totals, trips, frequently purchased and unique items, price observations and trends, possible adjustment matches, saved shopping-list items, suggestion dismiss/snooze/block preferences, notification settings, and other dashboard summaries. Personalized shopping suggestions, scores, and explanations may be calculated on demand or refreshed in the background and stored in cached suggestion snapshots.
• Authentication and security data: password-reset and verification records, rotating web and mobile session records, browser-extension device authorization, rate-limit buckets, request identifiers, security events, and IP-derived abuse-prevention signals.
• Billing data: Stripe customer and subscription identifiers, tier, status, trial and renewal dates, and payment-event records. SaveAtCost does not store full payment-card numbers.
• Communications: support messages and the delivery status of account emails. ZeptoMail open and click tracking are disabled in the implemented email client.
• Device and usage data: browser- or app-supplied request information, device platform, notification-token metadata when notifications are enabled, page/API path, HTTP method and status, timestamps, error details, and non-sensitive interface preferences.

The application does not request GPS or precise device location. Receipt data may identify a warehouse and its address, city, state, or region. IP addresses or related network information may indicate an approximate area and may be processed for security, rate limiting, hosting, and delivery.

When you actively use the extension on supported Costco pages, it reads Costco-session values locally to request your Costco order and receipt records, then sends supported Costco purchase data to your authenticated SaveAtCost account. The extension also stores SaveAtCost connection tokens and short-lived cached data in extension storage.

Where mobile receipt import is enabled, the app opens a restricted Costco page only after you consent. The SaveAtCost bridge does not intentionally copy Costco passwords or session-token values from that page; it sends credential-free page identity and status metadata, a one-way source-account identifier, and validated Costco receipt records needed for upload to your authenticated SaveAtCost account. If you select Costco’s Keep me signed in option, Costco’s first-party cookies and website storage may remain in the operating system WebView data store for future imports. SaveAtCost does not copy those cookie values into its app storage, backend, or logs. You can remove the retailer session from the importer, and SaveAtCost also requests its removal when you sign out or switch SaveAtCost accounts.

SaveAtCost does not ask for or store your Costco password, and its import clients are designed for supported Costco receipt pages rather than general browsing-history tracking. Retailer session data remains subject to the retailer, operating-system, WebView, and browser environments. Production mobile import remains disabled unless the required retailer authorization and release review are documented.

• Create, verify, secure, authenticate, and support web, mobile, and browser-extension sessions and connections.
• Import, organize, search, display, export, and delete receipt and order history.
• Calculate spending summaries, price observations, trends, on-demand shopping suggestions, estimated list totals, and possible price-adjustment matches.
• Store and apply shopping-list actions and suggestion preferences, including add, check, remove, dismiss, snooze, block, and restore actions.
• Provide Free and Pro features, Stripe checkout, subscription status, cancellation access, and billing support.
• Send account verification and recovery email and, when enabled, available product or price messages.
• Prevent abuse, enforce access boundaries, investigate errors, maintain service reliability, and comply with law.
• Improve matching, validation, performance, and interface behavior using operational information and de-identified or aggregated analysis where appropriate.

Where a law requires a legal basis, processing may rely on performance of our contract with you; our legitimate interests in operating, securing, troubleshooting, and improving the Service; your consent for optional communications where required; and compliance with legal, tax, fraud-prevention, or dispute obligations. You may withdraw consent for future optional processing without affecting earlier lawful processing.

We disclose information only as reasonably needed to operate the Service, complete a request, protect rights and systems, comply with law, or support a business transaction. Service providers must receive only the information needed for their role.

The implemented Service does not contain first-party advertising, behavioral-advertising pixels, affiliate tracking, or a product-analytics script. We do not sell personal information or share it for cross-context behavioral advertising as those terms are commonly defined. If these practices change, this Policy and any required consent or opt-out controls must be updated before the change is enabled.

The website uses HTTP-only access and refresh cookies needed to keep an account signed in and secure. The mobile app stores its SaveAtCost session in platform-secure storage and may use non-sensitive local preferences and cache. A receipt-filter preference may be stored in session storage until the browser tab or session ends. An enabled retailer page uses its own first-party cookies and WebView storage for sign-in and receipt import; if you select Keep me signed in, that retailer session may persist on the device until retailer expiry, explicit removal in the importer, SaveAtCost sign-out or account switch, app-data clearing, or app removal. Turnstile and Stripe may use their own necessary technologies when you interact with their widgets or hosted pages. See the Cookie Policy for names, purposes, duration, and controls.

Account, membership, receipt, saved-list, suggestion-preference, notification-preference, and derived dashboard data are generally retained while the account is active. Rotating sessions, one-time verification and recovery records, rate-limit buckets, import locks, and payment-event deduplication records use expiration or bounded-retention fields. Operational records are kept only as long as reasonably needed for security, reliability, disputes, and legal obligations.

Cached shopping-suggestion snapshots have a 24-hour freshness window. They can remain in storage after that window until refreshed, invalidated, or removed; freshness expiry is not a guaranteed deletion deadline.

When an eligible account-deletion request completes, the application deletes the user’s account, receipts, derived analytics, saved-list records, cached suggestion snapshots, suggestion preferences, settings, sessions, and other measured owned records from the active database. Some information may remain temporarily in backups or where retention is required for billing, fraud prevention, legal obligations, or disputes, then be deleted or isolated under the applicable retention process.

The code uses password hashing, short-lived access tokens, rotating refresh sessions, HTTP-only cookies, email verification, account lockout, rate limits, Turnstile, origin and method checks, authorization controls, signed Stripe webhooks, security headers, and sanitized operational logging. No service can promise absolute security. Use a unique password and contact support promptly if you suspect unauthorized access.

Depending on where you live, you may have rights to access, correct, delete, or obtain a portable copy of personal information; object to or restrict certain processing; withdraw consent; appeal a decision; or complain to a privacy authority. These rights can have exceptions. We will verify requests and respond as required by applicable law.

• Update profile, membership, personalized-suggestion, and optional email preferences in account settings.
• Download the account JSON export from account settings.
• Request permanent account deletion from account settings after resolving an active or unresolved subscription.
• For another privacy request, email support@saveatcost.co with the account email and the request type. Do not send a password, full payment-card number, or retailer password.

The Service is not directed to anyone under 18, and we do not knowingly create accounts for children. If you believe a child provided personal information, contact support@saveatcost.co so the report can be reviewed and appropriate deletion steps taken.

Service providers and infrastructure may process information in countries other than where you live. Where required, the responsible operator must use a lawful transfer mechanism and appropriate safeguards.

The operator’s legal identity and postal address still require confirmation.

We may update this Policy as the Service or law changes and will update the date above. We will provide additional notice for material changes when required. Questions and privacy requests may be sent to support@saveatcost.co. A verified operator legal name and postal notice address must be added before this draft is treated as final.