Privacy Policy

Stupid Good (“Stupid Good”, “we”, “us”) is a personalized venue-discovery service that helps you find restaurants and bars worth going to. This policy applies to visitors, registered users, and subscribers of our website, apps, and related services (together, the “Service”).

We collect the following categories of information:

• Account information. We use Amazon Cognito to manage sign-in. Depending on how you register, this includes your email address, phone number, and/or basic profile details from a social sign-in provider (for example, your name and email from Google). Authentication is handled by our identity provider; we do not store your password.
• Profile & taste preferences. Dietary preferences, cuisines and dishes you like, saved cities, and your answers to onboarding questions — used to personalize your recommendations.
• Usage & analytics. First-party analytics events about how you use the Service, such as searches you run, lists you view, venues you open, and messages you send the Concierge. These are our own events; we do not use third-party advertising trackers.
• Content you submit. Ratings and reviews, saved and shared lists, itineraries, and your conversations with the AI Concierge.
• Device & log data. IP address, device and browser type, and log data. We capture your IP address server-side for security and consent logging and remove it before it enters our analytics pipeline.

We use your information to:

• generate personalized recommendations and rank venues for you using our scoring engine;
• power the AI Concierge and answer your questions;
• operate, maintain, secure, and support the Service, including fraud prevention;
• understand how the Service is used and improve our products through analytics;
• run rewards and wallet-credit promotions and process subscription billing; and
• communicate with you about your account and, where you’ve opted in, send marketing messages.

The AI Concierge answers your questions using a third-party large-language-model provider (OpenAI). When you send a message to the Concierge, your query and the context needed to answer it are transmitted to that provider for the sole purpose of generating a response and operating the Service. Please do not send sensitive personal information (for example, government identifiers, payment-card numbers, or health details) to the Concierge.

We do not sell your identifying personal information — such as your name, email, phone number, IP address, device identifiers, or your individual profile, browsing history, or taste preferences. We share personal information only in these situations:

• Service providers. Cloud infrastructure and identity (Amazon Web Services), our AI provider (OpenAI), our payment processor, email and SMS delivery, and analytics processors — each only to the extent needed to run the Service.
• Legal requirements. To comply with applicable law, enforce our Terms, or protect the rights, property, and safety of our users and the public.
• Business transfers. If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

Aggregated, de-identified insights. We may sell, license, or share aggregated and de-identified insights about venues and dining trends — for example, which venues, dishes, and cuisines are popular in a city, or how sentiment for them is changing over time. These insights are built from combined data across many people, meet a minimum group size before any data point is published or shared, and are not designed to identify you. We commit not to re-identify this information, and we contractually require the businesses that receive it not to re-identify anyone and not to re-sell anything about an individual. Under laws such as California’s CCPA/CPRA, some of this sharing may be treated as a “sale” or “share,” so we give you the right to opt out (see below).

Do Not Sell or Share My Personal Information. You can opt out of the sale or sharing of your personal information at any time in either of two ways. First, enable the Global Privacy Control (GPC) signal in your browser: we automatically honor it as a valid do-not-sell instruction. Second, email privacy@stupidgood.ai to request the opt-out manually, and we will process it like the other privacy requests described in Section 7. Once you opt out, we exclude your data from the aggregated insights we share, and we do not discriminate against you for opting out.

We keep account and profile information for as long as your account is active. Analytics events are retained on a tiered schedule and deleted no later than 730 days after collection. Consent records are kept as a compliance record even after account deletion, with your account identifier removed. When you delete your account, we remove or anonymize your personal data as described in the next section.

Depending on where you live — including under the GDPR and California’s CCPA/CPRA — you may have the right to access, export, correct, or delete your personal information, to opt out of the sale or sharing of your personal information, and to object to or restrict certain processing. You can:

• export a copy of your data from your account or by request;
• delete your account, which removes or anonymizes your personal data across our systems — some records, such as consent logs and financial records, are retained where the law requires;
• opt out of analytics and marketing through our consent controls; we honor Global Privacy Control (GPC) browser signals;
• opt out of the sale or sharing of your personal information (“Do Not Sell or Share My Personal Information”) by enabling the Global Privacy Control (GPC) signal in your browser, which we honor automatically, or by emailing us to request the opt-out manually.

To make a request, email privacy@stupidgood.ai. We respond within the timeframes required by applicable law (for example, 30 days under the GDPR and 45 days under the CCPA), and we will not discriminate against you for exercising your rights.

We use cookies and browser storage (localStorage) to keep you signed in, remember your preferences, and measure usage. You control these through our consent banner, which gives “Reject All” equal weight to “Accept All” and can be reopened at any time from your privacy settings. The categories are:

• Strictly necessary (functional). Always on and cannot be turned off, because the Service cannot function without them (for example, keeping you signed in).
• Analytics. First-party measurement of how the Service is used. On by default; you can turn it off.
• Marketing. Used to deliver and measure promotions. You can turn it on or off.
• Session replay. Off by default and opt-in only. If you turn it on, our analytics provider records how you interact with a page (such as clicks, scrolling, and on-screen actions, with your typed inputs automatically masked) so we can diagnose usability problems. You can turn it back off at any time.
• SMS marketing. Off by default and opt-in only. If you opt in, we may send occasional promotional text messages; message and data rates may apply, and you can reply STOP to opt out at any time. Transactional texts, such as security codes, are separate and are not marketing.

We honor the Global Privacy Control (GPC) browser signal, and you can also clear cookies in your browser at any time.

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you in the product. Your continued use of the Service after an update means you accept the revised policy.

Questions about this policy or your data? Email us at privacy@stupidgood.ai.