App and Extension Privacy Policy

Last updated: 1 November 2026

This notice covers the CouponAlert app, its Safari and Chrome browser extensions, and the cloud service. The website privacy notice covers visits to couponalert.app.

1. Who is responsible

2. What we process and why

Local use, accounts, and synchronization

You can store manually entered coupons locally without an account. Cloud features require sign-in. Google or Apple supplies a provider-specific identifier, email address, and, if available, your name. Apple can supply a relay address. We use these details to create and recognize your account, authenticate you, and synchronize your coupons. Verified identities with a matching email address may be linked to the same account.

Coupon records include the code, discount, merchant name and website, description, expiry date, and creation/update dates. We store local coupons and preferences on your device, cloud coupons on our server, and session credentials in device or browser storage. Providing account and coupon data is necessary for the associated feature, not a statutory obligation. You can use local features or manual entry instead of optional import features.

The legal basis is performing the service you request, Article 6(1)(b) GDPR. Necessary device storage and access for sign-in, saved coupons, preferences, and the enabled extension are based on Section 25(2)(2) TDDDG.

Scanning and AI-assisted import

When you request a scan or import a shared image, the selected image is uploaded to our server and sent to OpenAI to extract the coupon fields. Uploaded material can contain names, addresses, or other personal information visible in the image; crop or remove information not needed for the coupon before submitting it.

We use the results to create a coupon in your account. Extraction is automated and may be inaccurate, so check the result. It does not make decisions about you with legal or similarly significant effects. Sending pictures to OpenAI requires your permission before the first upload, based on Article 6(1)(a) GDPR. The AI processing setting covers both picture scanning and forwarded email extraction. You can withdraw it in Settings to stop both; manual coupon entry remains available. Camera or photo access is limited by your device permissions; granting that permission does not itself authorize unrelated processing.

We do not keep an image archive as part of your account. Images are processed temporarily by our service; processed copies may remain in device caches. Provider retention is separate: OpenAI's API may retain inputs and outputs in abuse-monitoring logs, normally for up to 30 days, with exceptions for legal or safety reasons. These are not promises of zero retention. See OpenAI's API data controls. We do not use submitted content to train our own models.

Email imports and verification

If you register an import address, we store that address and its verification status and send a verification email. Verification links are valid for 30 minutes. Expired unverified address records and their codes are erased by cleanup at server startup and hourly. When you forward a message to the CouponAlert import mailbox, our email host receives its headers, body, and any attachments. Email import is off until you enable AI processing in Settings or approve the combined permission when scanning a picture. For accounts that enable it, our importer checks the sender, processes the message's text through OpenAI, and stores the extracted coupon and a message identifier to prevent duplicate imports. Attachments are not used by the email extractor. If the associated account has not enabled AI processing, received messages are deleted without sending their contents to OpenAI. You can turn AI processing off in Settings to stop future picture and email extraction.

The source is the sender and any people whose information appears in the forwarded message. Forward only material you are entitled to submit and avoid sensitive or unnecessary third-party information. Successfully imported messages and permanently rejected messages are deleted from the import mailbox in the same processing cycle. Messages that fail temporarily remain for retry, for no more than 30 days after receipt unless a specific legal obligation or legal claim requires longer retention. Deleting a coupon does not itself delete a retained mailbox message. Contact us if such a message needs to be located and erased. AI processing of your forwarded email text is based on your consent under Article 6(1)(a). Account storage and address verification are based on Article 6(1)(b); abuse checks and limited handling of incidental third-party data rely on Article 6(1)(f), our interest in secure, reliable imports.

Subscriptions

We use RevenueCat to show subscription offers and manage purchases and entitlements. Its SDK starts when the app opens, including before sign-in and before a purchase. It creates or uses an app-specific identifier stored on your device, and can receive your IP address, technical app and device information, purchase or receipt information, entitlement status, and subscription offer views. RevenueCat can derive the country from an IP address and use it in customer information and subscription analytics. After sign-in, our account identifier may be associated with that subscription information. A generated identifier is pseudonymous, not necessarily anonymous. We do not intentionally send coupon or forwarded email content to RevenueCat. Apple, or the applicable app store, processes payments; we do not receive full payment-card details.

We rely on Article 6(1)(b) GDPR where processing is necessary to provide, restore or manage a purchased subscription, and Article 6(1)(c) for applicable accounting obligations. For initialization and offering subscription options before a purchase, we rely on Article 6(1)(f): our interest in presenting paid options, evaluating those offers, and operating subscription functionality. You can object to processing based on legitimate interests as described in the rights section; rights relating to direct marketing apply where relevant. Store operators process data for their own payment, security and legal purposes under their own notices.

Merchant information and links

To build a future merchant directory, we retain merchant names and, where provided, website domains from saved cloud coupons in a separate candidate table, together with the source category (manual, image scan or email import). The table contains no account or coupon identifiers, codes, images or emails. Merchant names and domains can sometimes identify a person. We use them under Article 6(1)(f) GDPR for our legitimate interest in improving merchant matching. You may object as described below. Candidates are retained while needed for this purpose and are not automatically published as suggestions. Contact us to request review or removal of a candidate.

The app also requests merchant logos from Google's favicon service using the merchant domain, revealing your IP address and technical request data to Google. The same legitimate-interest basis applies. Opening a merchant or redemption link sends a browser request to that website, which is responsible for its own processing.

Browser extensions

With the browser access you grant, the extension checks URLs and hostnames of accessible tabs for checkout/cart pages and matches them against your saved coupons on your device. This can include open tabs, not only the focused tab. It downloads and caches your coupon list, displays matches, copies a code when requested, and can send your requested coupon deletion to our server. It does not send your browsing URLs to CouponAlert or create a server-side browsing history. Matching uses URLs and your saved coupons, not checkout form fields. Notifications are inserted into the visited page, so that page's scripts may be able to read the coupon details displayed there.

The Safari extension obtains session credentials through the app's native bridge and shared secure storage. The Chrome extension has its own Google or Apple sign-in flow and stores its session in local extension storage. Cached coupons, credentials, and short-lived tab state support the enabled extension. The legal basis is Article 6(1)(b) GDPR and, for necessary device access, Section 25(2)(2) TDDDG. Revoke site access, disable, or remove the extension in your browser to stop this processing.

Reminders, support, and security

Expiry reminders are scheduled locally if you enable notifications; this does not send your coupon list to a remote notification service. You can switch reminders off in the app or system settings. Scheduling your requested reminders is based on Article 6(1)(b).

If you contact support, we process your contact details, message, and relevant account information to answer it (Article 6(1)(b) for contractual enquiries, otherwise Article 6(1)(f), our interest in responding to enquiries). Technical access and error logs can include IP address, time, requested route, response details, and account identifier. They support security and troubleshooting under Article 6(1)(f). We do not operate advertising tracking in the app or extensions or sell your personal data.

3. Who receives data and international transfers

Access is limited to people maintaining the service and providers needed for the relevant feature: IONOS for API/database hosting in Germany; mailbox.org for email; Google for sign-in and favicons; Apple for sign-in and store services; OpenAI for extraction; RevenueCat for subscriptions; and Cloudflare for encrypted database backups. Providers acting on our instructions are processors; sign-in providers, app stores and external websites also have their own controller responsibilities. We may disclose data to public authorities where legally required, or to advisers where necessary to establish or defend legal claims.

We have data-processing agreements with IONOS, mailbox.org, OpenAI, RevenueCat and Cloudflare for the services they provide on our instructions.

OpenAI’s API can process submitted images and email text in the United States and other countries; we do not use a special regional data-residency setting. RevenueCat states that customer data is sent to its infrastructure in the United States. For OpenAI, its processing terms provide for EU standard contractual clauses or an adequacy decision for relevant onward transfers. OpenAI publishes its subprocessors and processing locations. The RevenueCat and Cloudflare processing agreements provide for EU standard contractual clauses for relevant transfers without an adequacy decision. Cloudflare receives encrypted backups in an EU-jurisdiction R2 bucket; associated service data or support access may be processed elsewhere. Where applicable, an adequacy decision under Article 45 GDPR can also provide the transfer basis; for the United States, the EU–US Data Privacy Framework applies only to participating organizations.

Apple and Google process data for their own sign-in, store or favicon services under their own notices. See Apple’s privacy policy and Google’s transfer information. EU storage alone does not exclude access from another country. You can ask us for information and a copy of the safeguards applicable to your data.

4. How long data is kept and how deletion works

• We store one account choice covering AI picture scanning and email import, together with the notice version and the time of each recorded grant or withdrawal. The current choice and history remain until account deletion. For choices made before history was introduced, only the last known choice and its time may be available. Withdrawal stops future processing and does not undo processing already carried out or remove previously imported coupons.
• Account data and active cloud coupons remain while your account exists. Removing a coupon hides it from normal use. Soft-deleted records are permanently erased after 30 days by an hourly cleanup, also run at server startup. Until then, deleted coupons support import deduplication and usage checks. Removed import addresses are erased from the active database. Contact us to request earlier erasure without closing your account.
• Account deletion in Settings removes your account, coupons, linked identities, import-address records, and session records from our active database. We also queue a request to delete the RevenueCat customer linked to your account, including its associated aliases. A minimal instruction containing your account identifier and retry timing remains until RevenueCat accepts the request; failed requests are retried automatically. RevenueCat completes deletion asynchronously. This does not cancel your app-store subscription. Apple authorization is revoked where applicable. Local coupons and scheduled reminders are cleared. Delete cached extension data or remove the extension on other devices; offline copies cannot be remotely erased while those devices are disconnected.
• Encrypted database backups are configured for a 30-day retention period. Deleted data may remain in those backups until expiry. Backups are used for recovery, not routine access.
• Temporarily failed import emails are deleted from the import folder on the next mail poll once 30 days have passed since the mail server received them, including messages marked read. Their contents are not sent to AI during this cleanup.
• Access/error logs are retained for up to 30 days after creation. Support correspondence is retained for up to 30 days after receipt. A specific legal obligation or a need to establish, exercise or defend a legal claim may require longer retention of the relevant records. Such records are not kept in routine use for unrelated purposes.
• Session data remains until revoked or expired and cleaned up. Local preferences and caches follow the app, browser and operating-system storage lifecycle; secure credential storage can survive reinstalling an app. Signing out or removing browser data is more reliable than uninstalling alone for clearing those credentials.
• Deleting an account does not cancel a store subscription or automatically erase records held by the store or RevenueCat. Contact us for help with provider erasure requests; legally required transaction records may remain.

Your choices and data-protection rights

Contact [email protected] to request access to your personal data, correction, erasure, restriction of processing, or a portable copy of data you provided where the GDPR conditions apply. We normally respond within one month. If a permitted extension is needed, we explain it within that month. Requests are normally free; we may ask for proportionate information to verify your identity.

You can withdraw consent at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing before withdrawal. Where processing relies on legitimate interests, you can object for reasons relating to your particular situation. If data were used for direct marketing, you could object to that use at any time without giving a reason.

You can complain to a supervisory authority, particularly in the EU country where you live or work or where an alleged infringement occurred. For a private business based in Bavaria, the competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA). You do not have to contact us first.

Changes to this notice

We update this notice when processing changes and provide additional notice where required. A privacy notice is information about processing, not blanket consent to new purposes.