RAINCHECK PRIVACY POLICY

Last updated: September 28, 2026
Effective: September 1, 2026
Version: 2.0

RainCheck Agent, LLC (“RainCheck,” “we,” “us,” “our”) operates the RainCheck mobile application and the RainCheck merchant portal (together, the “Service”).

This policy explains what we collect, why, who we share it with, how long we keep it, and what you can do about it.

We want to be direct about something unusual up front: RainCheck contains no analytics software, no crash reporting, no advertising SDKs, no attribution tools, no cookies for tracking, no web beacons, and no behavioral tracking of any kind. We do not sell personal information. We do not share it for targeted advertising. We do not track you across other apps or websites. If you have read a privacy policy that describes those things, it was not this one.

Contact: privacy@raincheckagent.com
RainCheck Agent, LLC, 741 Chicago Drive, Holland, Michigan 49423

1. WHO THIS COVERS

• Consumers – people who use the RainCheck app to make fuel offers, buy RainDrops, and redeem them.
• Merchants and merchant staff – businesses in the RainCheck network and the employees they authorize to use the merchant portal.

Where something applies to only one group, we say so.

2. AGE

The Service is for adults 18 and older. We do not knowingly collect information from anyone under 18. If you believe a minor has given us information, email privacy@raincheckagent.com and we will delete it.

Because we do not knowingly collect information from anyone under 18, we do not sell or share the personal information of consumers under 16, and we have no actual knowledge of doing so. The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13; consistent with the Children's Online Privacy Protection Act (COPPA), if we learn we have collected such information, we will delete it.

3. WHAT WE COLLECT

3.1 Consumers – information you give us

3.2 Consumers – location

We collect one approximate home location and a search radius. We do not track your movements.

• When you set your search area, the app asks for foreground-only location permission and takes one approximate reading at that moment.
• We store that single coordinate pair and your chosen radius.
• When you post an offer, a copy of that coordinate is saved with the offer, so later changes to your home location do not move an existing offer.

We do not collect: background location, continuous or periodic tracking, location history or trails, precise real-time location, or your street address. The app never requests “Always” location permission.

3.3 Consumers – payment

We never receive, store, or transmit your full card number, expiration date as entered, or security code. Card entry happens inside Stripe’s interface, and card data goes to Stripe directly.

We store only a Stripe customer identifier, a payment method identifier, and display-only metadata Stripe returns to us: card brand and last four digits. These are shown so you recognize your card. They cannot be used to authorize a charge.

We also store a card fingerprint – an irreversible identifier Stripe derives from your card. It is not your card number, cannot be reversed into one, and cannot be used to charge anything. We use it for exactly one purpose: adding up how much has been spent across accounts that share a card, so that the daily spending limit described in our Terms of Service cannot be exceeded by opening a second account.

This identifier is kept for 24 months after your last transaction, and it is deliberately not erased when an account is deleted. Erasing it would mean anyone could reset their spending limit by closing an account and opening a new one with the same card, which is the specific thing it exists to prevent. It is removed on its own schedule, by time, whether or not the account still exists.

3.4 Consumers – records created by using the Service

• Purchases – fuel type and grade, gallons, price, total, Station, date, Stripe payment identifier
• Offers – your target price, gallons, fuel type, and the home coordinate snapshot from §3.2
• RainDrop transfers – who gave, who received, and how much
• Dispense and return events – Station, amount, time
• Ratings – scores and any comment you write
• Search parameters – the fuel and price criteria you set
• Notifications – a record of messages we send you, including content
• Verification codes – one-time codes with expiration and use status, stored hashed

3.5 SMS

The Service currently delivers verification codes and notifications by email. We store your phone number and an SMS-consent preference. No current feature sends SMS. If that changes, we will update this policy and honor your preference before sending anything.

3.6 Device information

If you enable push notifications, we store a push token issued by Expo, which routes messages to your device. It is not a hardware identifier and does not track you.

We do not collect advertising identifiers (IDFA/AAID), vendor identifiers, device serial numbers, your device phone number, contacts, photos, calendar, microphone, camera roll, or files on your device.

App Tracking Transparency. Because we do not track you across other companies' apps or websites, do not use the Apple advertising identifier (IDFA), and do not use device fingerprinting, the app does not present Apple's App Tracking Transparency permission prompt – there is no cross-app or cross-site tracking to permit. The categories of data we collect are also reflected in the App Store privacy information ("privacy label") for the app, and this policy is made available to you both before you download the app and while you use it.

3.7 Technical information

• IP address and user-agent – recorded when you accept the Terms of Service, and for merchant staff, recorded with each portal action, as a security and audit record
• Rate-limiting counters – short-lived counters keyed to an email address (hashed) and IP address, used to stop automated attacks on sign-in and password reset

3.8 Merchants and merchant staff

Business: business name, Station address and coordinates, optional Station phone, Stripe Connect account identifier, and an indicator of Stripe’s verification status.

Staff: name, email, password (bcrypt hash), role, and for PIN-protected functions a hashed PIN and hashed security answer. PINs and security answers are never stored in readable form. We keep an append-only log of staff actions including IP and user-agent.

We do not collect or store merchant bank account numbers, routing numbers, EINs, TINs, or Social Security numbers. Business verification and bank details go directly to Stripe through Stripe’s own onboarding, and Stripe holds them.

3.9 What we do NOT collect

• No analytics, telemetry, crash reporting, attribution, or advertising SDKs
• No cookies or similar technologies used for tracking or advertising
• No web beacons or pixel tags
• No card numbers or security codes, ever, anywhere
• No background or precise location
• No cross-app or cross-site tracking
• No biometric identifiers
• No consumer health data
• No data from data brokers or public-record aggregators
• No sale of personal information, and no sharing for cross-context behavioral advertising

4. HOW WE USE INFORMATION

• Create and secure your account and verify it is you
• Match your offers to participating Stations and process purchases
• Let you send RainDrops to other users
• Authorize dispensing and process returns
• Send transactional messages – verification codes, receipts, service notices
• Detect, investigate, and prevent fraud, abuse, and unauthorized access
• Meet legal, tax, accounting, and financial recordkeeping obligations
• Operate, maintain, and improve the Service

We do not use your information for advertising, profiling, or automated decision-making that produces legal or similarly significant effects. We do not sell it.

Marketing messages. The messages described above are transactional – they relate to your account and your transactions, and you cannot opt out of them while you keep your account. If we ever send promotional email, each message will identify itself as an advertisement, include a valid postal address for RainCheck, and include a working unsubscribe link that we will honor promptly. Any marketing text messages will be sent only if you have opted in, and you can stop them at any time by replying STOP. These practices follow the federal CAN-SPAM Act and the Telephone Consumer Protection Act, and are also addressed in our Terms of Service.

5. WHO WE SHARE WITH

Only service providers performing functions for us, and only what each needs:

Each is bound by contract to use the information only to perform its function for us.

We also disclose when required by law or valid legal process; to protect the rights, safety, or property of RainCheck, our users, or others; and in a merger, acquisition, or sale of assets, in which case this policy continues to apply to the transferred information until it is superseded by a policy of which you receive notice.

Law enforcement. We require valid legal process. We review each request for legal sufficiency and scope, and we will notify you unless legally prohibited or unless notice would create a risk of harm.

6. RAINDROPS AND FINANCIAL RECORDS

RainDrop balances, transfers, and redemptions are financial records. We keep them even after you delete your account, because we must maintain accurate financial and tax records and resolve payment disputes. After deletion these records are no longer linked to your identifying information.

The Terms of Service, not this policy, govern how RainDrops work – including that face value never expires, that we pay out your balance if you delete your account, and what happens if a Station closes.

Gramm-Leach-Bliley Act (GLBA). Payment processing is performed by Stripe, and RainCheck does not itself extend credit, issue a payment card, take deposits, or transmit money. We therefore do not believe RainCheck is a "financial institution" subject to the federal Gramm-Leach-Bliley Act. To the extent GLBA nonetheless applies to any of our activities, this policy serves as our GLBA privacy notice: the categories of nonpublic personal information we collect are described in Section 3; we do not sell that information and do not disclose it to nonaffiliated third parties except to service providers that perform functions for us and to carry out the transactions you request (disclosures permitted without an opt-out under GLBA); and the measures we use to protect the confidentiality and security of that information are described in Section 8. Because we do not share nonpublic personal information outside those permitted purposes, no opt-out is required and no annual GLBA notice is required unless our practices change.

7. RETENTION AND DELETION

You can delete your account any time in the app.

When you request deletion:

1. Your account is immediately marked for deletion, you are signed out on all devices, and you cannot sign in again.

2. Any uncaptured payment authorizations are cancelled.

3. We pay out the face value of any RainDrops you still hold (Terms of Service §8.8).

4. After 30 days, we permanently remove identifying information from your account record – name if any, email, phone, username, profile photo, Google link, home location, and card display details.

Retention by category:

Some records are append-only and are not deleted, specifically Terms acceptance records and merchant staff activity logs. These contain minimal personal information (identifier, timestamp, IP, user-agent) and exist as an audit trail.

Two things deliberately outlive your account, and you should know what they are:

• The card fingerprint described in Section 3.3, removed on its own 24-month schedule.
• Contact details on an unsettled cash-out record. If you delete your account while we still owe you money we could not return to a card, we keep the email address and phone number attached to that record so we can pay you. They are removed when the balance is settled. If we owe you nothing, nothing is kept.

Everything else identifying you is removed 30 days after you request deletion.

RainDrops you gave to other people belong to them. Deleting your account does not reclaim them.

8. SECURITY

• Passwords stored using bcrypt (cost factor 12). We cannot read them
• PINs and security answers stored as bcrypt hashes, never readable
• One-time codes and reset tokens generated with a cryptographically secure random source, stored hashed, single-use, time-limited, and attempt-limited
• Session revocation – changing your password, deleting your account, or signing out invalidates sessions on all devices immediately
• Encrypted device storage – authentication tokens are held in your device’s secure keystore
• Transport encryption (TLS), security headers, restricted cross-origin policy
• Role-based access control, ownership checks preventing one merchant from reaching another’s data, and verification gating on payment functions
• Rate limiting and attempt limiting on sign-in and account-recovery endpoints
• Bot protection on merchant sign-up and sign-in

No system is perfectly secure and we cannot guarantee absolute security.

Breach notification. If we discover a breach affecting your personal information, we will notify you and the applicable authorities as required by the breach-notification law of your state, without unreasonable delay.

9. YOUR RIGHTS – ALL U.S. RESIDENTS

We extend the following rights to every RainCheck user in the United States, regardless of whether your state’s law requires it and regardless of whether we meet any statutory threshold. We would rather give everyone the same rights than sort you by geography.

You may:

• Know what personal information we collect, use, disclose, and retain, and the categories of recipients
• Access a copy of your personal information
• Correct inaccuracies
• Delete your personal information
• Obtain a portable copy in a structured, commonly used, machine-readable format
• Opt out of sale, sharing, targeted advertising, and profiling – though we do none of these, so there is nothing to opt out of
• Limit use of sensitive personal information – we do not collect any
• Not be discriminated or retaliated against for exercising any of these rights

9.1 How to exercise them

In the app for access, correction, and deletion. Otherwise email privacy@raincheckagent.com or write to the address above.

Verification. We verify by confirming control of the email address on the account, and for sensitive requests by asking you to confirm details only the account holder would know. We do not ask for more information than necessary, and we do not retain what you supply for verification beyond the request.

Timing. We acknowledge within 10 business days and respond within 45 calendar days. If we need more time we will tell you within the first 45 days and take no more than 45 additional days.

Cost. Free, up to twice in any 12-month period. We may charge a reasonable fee, or decline, for requests that are manifestly unfounded, excessive, or repetitive, and we will tell you why.

Authorized agents. You may use an authorized agent. We will ask for written permission signed by you and will verify your identity directly.

9.2 Appeals

If we deny your request, you may appeal. Reply to our denial or email privacy@raincheckagent.com with “Privacy Appeal” in the subject line. We will respond within 45 days with our decision and the reasons for it.

If we deny your appeal, you may contact your state attorney general. We will give you the contact information for doing so.

9.3 State-specific disclosures

California (CCPA/CPRA).

Categories of personal information collected in the last 12 months, using the statutory categories:

Sources: directly from you; automatically from your use of the Service; and from Stripe and Google where you connect those services.

Business purposes: as listed in Section 4.

Disclosure for a business purpose: to the service providers listed in Section 5. Each is a “service provider” or “contractor” under the CCPA, contractually restricted from using the information for any other purpose.

Sale or sharing: We have not sold or shared personal information in the preceding 12 months, and we do not do so. We do not use or disclose sensitive personal information for purposes requiring a right-to-limit.

Retention: as set out in Section 7.

Shine the Light (Cal. Civ. Code §1798.83): We do not disclose personal information to third parties for their own direct marketing purposes. If that changes, you may request the required disclosure at privacy@raincheckagent.com.

Do Not Sell or Share My Personal Information: We do not sell or share, so no link is required. If you want written confirmation, email us.

Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas, Oregon, Florida, Delaware, New Jersey, New Hampshire, Kentucky, Nebraska, Maryland, Minnesota, Rhode Island, and any state adopting a comprehensive privacy law. The rights in Section 9 are available to you. We conduct no targeted advertising, no sale of personal data, and no profiling in furtherance of decisions producing legal or similarly significant effects, so consent and opt-out mechanisms for those activities are not applicable. We do not process sensitive data, so no consent is required for it.

Colorado, Connecticut, Montana, Oregon, Texas, New Jersey, Delaware, Nebraska, New Hampshire, Maryland, Minnesota, Rhode Island residents: the appeal process in Section 9.2 applies to you and to everyone else.

Maryland residents: Maryland’s Online Data Privacy Act limits collection to what is reasonably necessary and proportionate. Our collection is limited to what the Service requires to function, as itemized in Section 3, and we do not sell sensitive data or the personal data of anyone under 18.

Minnesota residents: you may question the result of any profiling. We do not profile.

Oregon residents: you may request a list of the specific third parties to which we have disclosed your personal data. Email privacy@raincheckagent.com.

Nevada residents: Nevada law (NRS 603A.300 et seq.) gives you a right to opt out of the sale of certain covered information. We do not sell covered information. To submit a verified request anyway, email privacy@raincheckagent.com.

Washington and Nevada residents: we do not collect, process, sell, or share consumer health data as defined by the Washington My Health My Data Act or Nevada SB 370.

Illinois, Texas, and Washington residents: we collect no biometric identifiers or biometric information.

9.4 Do Not Track

Some browsers send “Do Not Track” signals. There is no common industry standard for responding. We do not track you across other websites or apps regardless of any signal, so the question does not arise. Where a state requires us to honor a universal opt-out mechanism such as Global Privacy Control for sales or targeted advertising, we honor it – although we conduct neither.

10. YOUR CHOICES

• Update your profile in the app
• Delete your account in the app (Section 7)
• Turn off push notifications in your device settings, or in the app
• Manage your SMS preference in the app, and reply STOP to opt out of any text messages
• Opt out of marketing email using the unsubscribe link in any promotional message, or by emailing privacy@raincheckagent.com
• Remove your saved payment method in the app
• Revoke location permission in your device settings. The search-area feature will stop working; nothing else will

11. INTERNATIONAL

The Service is offered only in the United States, and our systems are located in the United States. We do not target or knowingly offer the Service to residents of the European Economic Area, the United Kingdom, or Switzerland. If you access it from outside the United States, you do so on your own initiative and are responsible for compliance with local law.

12. CHANGES

We may update this policy. For material changes we will notify you in the Service or by email and update the date and version above. We will not apply materially different practices to information already collected without giving you notice and, where required, obtaining your consent.

13. CONTACT

RainCheck Agent, LLC
741 Chicago Drive
Holland, Michigan 49423

privacy@raincheckagent.com

If you have a concern we have not resolved, you may contact your state attorney general.