Privacy policy

This policy explains how STX.NYC handles information when you visit this site, sign in, participate in a local promotion, contact us, or use shop-management tools. STX.NYC is part of STX.AI. For privacy questions, contact steve@stx.ai.

STX+ and linked services have their own privacy practices. This policy covers STX.NYC’s use of information, not everything those other services do.

• Account information: when you sign in with STX+, we receive your account identifier and, if provided, your display name. We create a local player record and handle. This sign-in requests identity only, not access to your email address.
• Promotion activity: scans and code use, claim times, participating shop, order channel associated with a code, pieces collected, streaks, points activity, gifts, season records, perk tickets, and redemption history. Shop information comes from the code or promotion; it does not require your phone’s precise location.
• Optional information: an email you submit for a season reminder, contact messages, and access requests where a private promotion uses an allow list.
• Shop tools: staff and owner access records, report-recipient addresses, settings, and goals submitted to the repeat-visit advisor.
• Technical information: cookies, browser-stored settings, and technical request or error information processed by the services that operate the site.

Please do not include sensitive personal information or customer contact lists in a contact message or an advisor goal.

We use information to authenticate you, control access to private promotions, record activity, maintain your collection and season record, issue and redeem the shop’s perks, prevent repeated claims or redemptions, protect the service, resolve support requests, and prepare loyalty reports.

We use a reminder email you provide to send the requested season reminder. Shop reports summarize visits and promotion activity so authorized owners can understand repeat visits. Rehearsal records are marked as test and excluded from real owner totals and rankings.

Where privacy law requires a legal basis, these uses relate to providing the service you request, operating and securing the service, meeting legal obligations, or your consent where required.

• STX services: STX+ handles sign-in; points-delivery features use STX.BUZZ when connected. Relevant account identifiers and activity details are used for those functions.
• Operating providers: Lovable Cloud hosts the application and stores its records. Resend handles outgoing email through the connected sending service. Providers process the information needed to operate their part of the service.
• Participating shops: authorized staff can validate perk tickets, and owners receive shop-related loyalty reports and redemption information.
• Other members and viewers: where a promotion offers a board, gifts, or a shareable season record, a handle and associated activity or record may be visible in that view. Do not use a handle you consider private.
• Legal and safety needs: information may be disclosed when required by law or reasonably necessary to address fraud, protect people, or defend legal rights.

Following a link to STX+, STX.RSVP, or another website takes you to a separate service with its own terms and privacy policy.

When an authorized owner requests ideas, the goal they type and summarized shop metrics are sent to Lovable AI Gateway and its model provider to produce recommendations. The request does not include a member contact list or individual claim history.

AI output may be inaccurate and needs human review. Provider handling is subject to the provider’s applicable terms; this policy does not promise a particular provider retention period.

STX.NYC uses cookies for sign-in, access checks, and security. Current maximum lifetimes include 10 minutes for a sign-in attempt, 180 days for a member session, 12 hours for a staff session, and 8 hours for an owner session. A private-promotion pass lasts up to 12 hours and cannot outlast the signed-in session. Access-request state can also last up to 12 hours.

Some settings and Backstage or rehearsal state use local or session storage. Clearing browser data removes those browser records but does not delete server-held claims or account records. Blocking cookies can prevent sign-in and private-promotion access.

The current application does not include a dedicated third-party advertising or analytics tracker. Hosting and operating services may still process technical information to deliver and protect the site.

Information is kept as needed to operate accounts and promotions, preserve claim and redemption history, resolve disputes, prevent misuse, and meet applicable obligations. A season ending or signing out does not automatically delete its records. Retention depends on the record and purpose; there is no single published deletion period for all records.

Access controls, signed session cookies, and server-side claim and redemption checks help protect records. No online service can guarantee complete security. Please protect your STX+ account and do not share staff or owner access details.

Operating providers may process information outside your state or country. Applicable safeguards and privacy protections depend on the provider and relevant law.

You can sign out, clear browser storage, choose not to provide a reminder email, and avoid optional sharing. For a reminder cancellation or a request to access, correct, delete, or restrict information, email steve@stx.ai with the request and your STX.NYC handle, if you have one. Never send a password or an owner access key.

We may need to verify your identity. Requests are handled according to applicable law, including any exceptions for security, legal obligations, and necessary transaction records. Depending on where you live, you may also have rights to portability, objection, withdrawal of consent, or a complaint to your privacy regulator.

STX.NYC does not currently offer a self-service account-deletion button. Requests about the underlying STX+ account should also be directed to STX+.

STX.NYC does not request a date of birth. Please do not submit information about a child who cannot lawfully use the service. A parent or guardian who believes a child’s information has been submitted can contact us to request review and removal as applicable.

We may update this policy as the service or its data practices change. The date above identifies the latest revision. Material changes will be communicated where required by law.

For questions about this policy or a privacy request, contact steve@stx.ai.