Privacy policy

Information we collect

For each visitor to our website, our web server automatically recognizes the consumer’s domain name and e-mail address (where possible).

We collect the domain name and e-mail address (where possible) of visitors to our web pages, the e-mail addresses of those who communicate with us via e-mail, user-specific information on what pages consumers access or visit, information volunteered by the consumer (such as survey responses, account registration, donation or order details, name, mailing address, and phone number), and aggregated, anonymized analytics data through tools such as Vercel Speed Insights and Google Analytics.

When an approved administrator or staff member uses HometownLift POS, we process account and organization information such as name, e-mail address, user and organization identifiers, role, and organization membership. We also process the transaction details needed to operate and reconcile the organization’s point of sale, including items, amounts, purchase type, receipts, refunds, and Stripe payment and reader identifiers. Stripe processes card details; HometownLift does not receive or store full card numbers.

Where an organization connects Clover, HometownLift BoothOS processes the authorized merchant identity, catalog and item mappings, order and payment references, transaction amounts and statuses, and register and cashier identifiers needed for sales review and recovery. Connection credentials are stored encrypted on our servers. Clover handles card entry in its payment flow; connecting Clover does not automatically enroll customers in text messages or identify a volunteer for check-in.

Booth workflows also process customer details provided at checkout, pickup status, text-message consent and delivery status, uploaded prize photos, and the registration or attendance identifiers needed for authorized check-in. These records are available to authorized users of the relevant organization as needed to operate those workflows.

App users may create profile information and Roundtable messages or submit safety reports. We store this user content, related account identifiers, and moderation records so organizations can collaborate and HometownLift can investigate abuse. The app and our service providers may also process an app version, operating-system and device information, push-notification token, reader status, and diagnostic or error information needed to secure, support, and troubleshoot the service.

How we use information

The information we collect is:

• used to provide, secure, support, and improve our services;
• used to customize the content and/or layout of our pages for each individual visitor;
• used to notify users about service or transaction updates;
• shared with agents or contractors who assist in providing support for our internal operations (for example, payment processors, hosting providers, and e-mail delivery vendors);
• used by us to contact consumers for marketing purposes;
• not shared with organizations for commercial purposes;
• disclosed when legally required to do so, at the request of governmental authorities conducting an investigation, to verify or enforce compliance with the policies governing our services and applicable laws, or to protect against misuse or unauthorized use of our services;
• disclosed to a successor entity in connection with a corporate merger, consolidation, sale of assets, or other corporate change.

Cookies and local storage

We keep our use of cookies to a minimum and do not use advertising, cross-site, or behavioral-tracking cookies. Specifically:

• Essential session cookie. When you sign in, we set a secure cookie that keeps you logged in and maintains your session. This cookie is required for the site to work and is not used for tracking or advertising.
• Local browser storage.We store certain preferences and state directly in your browser (in local storage, not cookies) —such as your display theme, whether you have dismissed the “install app” prompt, your scroll position when navigating, and point-of-sale session details for organizers running a booth. Information needed to submit or recover a purchase is also sent to our service; local storage is not the only copy of a sale.
• Mobile app storage and device permissions.HometownLift POS stores its sign-in session in iOS secure storage and keeps limited preferences and point-of-sale state on the device. Camera access is used to scan HometownLift ticket and station QR codes. Bluetooth, local-network, location, and NFC capabilities are used to discover and operate Stripe card readers or Tap to Pay on iPhone. Stripe Terminal collects coarse location for app functionality and product-interaction information for app functionality and analytics; its iOS privacy manifest declares both categories as not linked to the user and not used for tracking. Face ID, when enabled by the user, unlocks a saved login and is evaluated by iOS; HometownLift does not receive biometric data.
• Clover device storage. BoothOS keeps limited installation and pending-payment references on the device so an interrupted purchase can be checked without starting another charge. Recovery sends the relevant references and result information to our service. Clearing app data does not cancel a payment or delete its server records. Camera access supports authorized QR check-in; selecting a prize photo makes that selected image available for upload.
• Performance analytics.We use Vercel Speed Insights to measure page-load performance. It is cookieless and does not identify you or follow you across other websites. Where we enable Google Analytics, it is used only for aggregate, anonymized site usage (see “Third-party services” below).

We do not serve banner ads, and we do not use affiliate, referral, or IP-based tracking cookies. Most browsers let you refuse or delete cookies; if you block the essential session cookie, you may not be able to stay signed in.

E-mail and marketing preferences

If you do not want to receive e-mail from us in the future, please let us know by sending us e-mail at support@hometownlift.com.

From time to time, we may make the e-mail addresses of those who access our site available to other reputable organizations whose products or services we think you might find interesting. If you do not want us to share your e-mail address with other companies or organizations, please let us know by e-mailing us at the address above.

If you supply us with your postal address online, you may receive periodic mailings with information on new products, services, or upcoming events. If you do not wish to receive such mailings, please let us know by e-mailing us at the address above. Please provide us with your exact name and address—we will make sure your name is removed from any list we share with other organizations.

Persons who supply us with their telephone numbers online will only receive telephone contact from us with information regarding orders, donations, or registrations they have placed online.

Text messaging (SMS)

If you provide your mobile phone number under one of our on-page SMS disclosures, you consent to receive the transactional text messages described at that consent point: an order-ready pickup alert (up to one automated text per item ordered), up to five automated volunteer shift reminders or updates per shift, a raffle winner notification if your ticket wins, or a registration payment-failure notice. Every message is triggered by your own activity. We do not send marketing or promotional text messages. Message and data rates may apply. The full program is described at hometownlift.com/sms-opt-in.

You can cancel the SMS service at any time by replying STOP to any message, and you can reply HELP for assistance. After you reply STOP we will send one confirmation message and will not send any further texts unless you re-subscribe by replying START.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile opt-in data and consent are never shared with, or sold to, any third party. We share mobile information only with the service providers that help us deliver these messages (for example, our SMS messaging provider), and only for the purpose of sending the notification you requested.

Third-party services

We do not place advertising tags, pixels, or third-party ad networks in HometownLift POS. To operate our website and applications, we rely on a small set of service providers that process limited information on our behalf. For further information, consult their privacy policies:

• Stripe (payment processing)
• Clover (connected point-of-sale and payment services, where enabled)
• Supabase (database and authentication)
• Vercel (web hosting and cookieless performance analytics)
• Resend (transactional e-mail)
• Twilio (text-message notifications)
• Google Analytics (aggregate, anonymized site analytics)

Changes to this policy

From time to time, we may use customer information for new, unanticipated uses not previously disclosed in this privacy notice. If our information practices change in the future, we will post the updated policy to our website to notify you of the change and to provide you with the ability to opt out of the new uses. We will use information for these new purposes only when collected from the time of the policy change forward. If you are concerned about how your information is used, you should check back at our website periodically.

Customers may prevent their information from being used for purposes other than those for which it was originally collected by e-mailing us at support@hometownlift.com.

Access and correction

Upon request, we provide users with access to:

• unique identifier information (e.g., customer or account number) that we maintain about them;
• transaction information (e.g., dates of donations or purchases, amounts, and types) that we maintain about them;
• communications and user content that the consumer or user has directed to our services (e.g., e-mails, customer inquiries, and Roundtable messages);
• contact information (e.g., name, address, phone number) that we maintain about them; and
• a description of any other information we maintain about them.

Consumers can access this information by e-mailing us at support@hometownlift.com. Upon request, we offer visitors the ability to have inaccuracies corrected in contact information, unique identifiers, and transaction information by e-mailing the same address.

Account and data deletion

Account holders can request closure of their sign-in account and deletion or de-identification of associated personal data through our public Account and Data Deletion page. We verify the requester's identity before making irreversible changes. Some records may be retained when needed for payment reconciliation, tax and accounting, fraud prevention, security, disputes, organization recordkeeping, or other legal obligations; retained records no longer provide sign-in access.

Security

When we transfer or receive certain types of sensitive information such as payment or account credentials, the information is exchanged over an encrypted connection (HTTPS/TLS). Payments are processed by Stripe, a PCI-DSS Level 1 certified processor; HometownLift does not store full card numbers on its own servers. We maintain appropriate administrative, technical, and physical safeguards to protect against the loss, misuse, or alteration of information collected through our services.

Filing a concern

If you feel that HometownLift is not following its stated information policy, you may contact us at support@hometownlift.com, your state or local chapter of the Better Business Bureau, your state or local consumer protection office, or the Federal Trade Commission by phone at 1-877-FTC-HELP (1-877-382-4357) or online at reportfraud.ftc.gov.