Discounts For Good
Privacy notice
What we collect when you use Discounts For Good, why, who sees it and how long we keep it.
Draft 0.1 of 19 October 2026. This page is being reviewed and is not yet in force.
1. Who we are
Discounts For Good is run by The Ticket Bank Ltd (company number 12149865, registered in England and Wales), registered at 15 Paternoster Row, Sheffield S1 2BX. We are the controller of the personal information this notice describes. Questions and requests go to our privacy contact at [privacy contact email].
Tickets For Good is a separate company and a separate controller. Nothing about you moves between us: if you arrived through a Tickets For Good link, we record only that the link brought you here.
2. What this notice covers
The Discounts For Good app, the emails we send about your account and the pages at discountsforgood.app. When you open a deal, the brand’s own website takes over and its own privacy notice applies to anything you do there, including any purchase.
3. The information we collect
What you give us
- Your email address, which is how you sign in. There is no password.
- Your name, if you choose to add it.
- Your choices: the offers you save, the brands you follow, your notification settings and the consent choices you make in the app.
What we record as you use the app
- Sign-in codes, kept only as a one-way hash for the five minutes they are valid, and the sessions that follow: a random token, when it expires, and the internet address and device type it was made from, for up to 30 days.
- Taps on offers: which offer, brand and programme, when, from which app version and platform, and the random reference we attach to the link (section 5).
- The campaign or link that brought you to the app, so we know which promotion worked.
- If you turn notifications on, the device token the operating system gives us to deliver them, with the platform and app version.
- If you browse without signing up, a guest account with no name or email, so what you save or follow carries over when you sign up. Idle guest accounts with nothing saved are removed after 90 days.
What we receive from affiliate programmes
When a purchase is made through one of our links, the programme reports it to us: the programme and brand, the amount and the commission, the date and status, and the random reference from your tap, which we match to your account. The brand’s website handles your order and payment; we never see your payment details or what you bought beyond what the report shows.
With your consent only
Usage analytics, if you turn on “Help improve the app” (section 7).
Crash reports
If the app crashes or fails, a technical report with nothing that identifies you (section 7).
4. Why we use it and our lawful basis
| Purpose | Information | Lawful basis |
|---|---|---|
| Your account and signing in | Email, name, sign-in codes, sessions | Our contract with you |
| Saves, follows and voucher codes | Your choices and your account | Our contract with you |
| Opening deals and matching purchases to the right member | Taps, the random reference, programme reports | Our legitimate interest in running the service and being paid the commission it earns |
| Keeping financial records | Commission records | Legal obligation (six years of accounting records) |
| Notifications you have turned on | Device token, your settings | Our contract with you; you control each type in the app and in your device settings |
| Service emails: sign-in codes, a welcome, confirmation of deletion | Email address | Our contract with you |
| Security, fraud and abuse prevention | Sessions, internet addresses, rate-limit counters | Our legitimate interest in protecting the service and its members |
| Usage analytics | How the app is used, under a per-install identifier | Your consent |
| Crash reports | Technical details of a failure | Our legitimate interest in keeping the app working (strictly necessary, nothing identifying) |
| Marketing email | Email address | Your consent. [Not collected at launch unless the client decides otherwise (E11)] |
Where we rely on a legitimate interest we have weighed it against your interests and rights; you can ask us for that assessment.
5. Clicks, affiliate links and commission
We earn a commission when you buy through a deal in the app. To make that work, the link you tap carries a random reference that we create for that tap. It is the only thing we send to the brand or its affiliate programme: never your name, email, account or any device identifier. The programme later tells us which references led to a purchase, and we match them to your account so the commission is recorded. We do not sell your information and we do not use it for advertising. Voucher codes are shown to signed-in members only.
6. Notifications and marketing
Notifications are off until you turn them on, type by type: new offers from brands you follow, saved deals about to end, and the occasional campaign from us. Change them any time under Account → Reminders, or in your device’s settings. We do not send marketing email at launch; if that changes, it will be a separate choice you make, with an unsubscribe link in every email.
7. Analytics and crash reporting
“Help improve the app” is off until you turn it on. When it is on, we record how the app is used (screens, searches performed, offers saved or opened) under an identifier created on your device, never your email, your account, your search text or any voucher code, so the data is not linked to you. It is processed by PostHog in the European Union and kept for 12 months. Turn the switch off and the identifier is discarded.
Crash reports are always on, because they are the only way we learn the app failed. They carry technical details, the app version and nothing that identifies you: emails, codes, links and names are removed before anything leaves your device, and no account identifier is attached. They are processed by Sentry in the European Union.
8. Who we share information with
Service providers that process it for us, under contract, and only for the purposes above:
- Vercel (hosting, London region) and Neon (database, London).
- Cloudflare (images and files, European Union).
- Resend (sending email, European Union).
- Expo, Apple and Google (delivering notifications to your device; the token and the message only).
- PostHog (analytics, European Union; only if you opt in) and Sentry (crash reports, European Union).
- GitHub (our nightly encrypted backup runs on its servers before it is stored). [Confirm the runner’s region and the transfer mechanism with legal]
Affiliate programmes and brands receive the random reference described in section 5 and nothing else. We may also share information where the law requires it, with our professional advisers, or as part of a sale or reorganisation of the business, in which case this notice continues to apply.
9. Where your information is held
In the United Kingdom and the European Union. Where a provider processes information outside them, it does so under the UK’s international data transfer agreement or the European Commission’s standard contractual clauses. [Legal to confirm each provider’s mechanism]
10. How long we keep it
| Information | Kept for |
|---|---|
| Your account, saves, follows and settings | Until you delete your account |
| Sign-in codes | Five minutes |
| Sessions | Up to 30 days, or until you sign out |
| Taps that did not lead to a purchase | 13 months, then the link to your account is removed |
| Purchase and commission records | Six years, as financial records, under a pseudonym once your account is deleted |
| Your consent choices | For as long as we rely on them, and six years after you withdraw them |
| Notification device tokens | Until 90 days without use, or the device is gone |
| Usage analytics | 12 months |
| Email delivery records and addresses that must not be emailed again | [Retention decision E5] |
| Backup copies | Seven days of database history and 35 days of encrypted backups |
11. Deleting your account
In the app: Account → Account security → Delete account. Your personal details, saves, follows, notification settings and sign-in details are deleted straight away, and we email you a confirmation. Purchase and commission records are kept under a pseudonym because we must keep financial records, and a record of your consent choices is kept as evidence; neither identifies you. Backup copies expire within 35 days. You can also ask by email from the address on your account, as the deletion page explains.
12. Your rights
You can ask for a copy of your information, have it corrected or deleted, restrict or object to how we use it, receive it in a portable form, and withdraw any consent at any time (in the app, or by email). Write to [privacy contact email]; we may ask you to confirm the request from the email address on your account. If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
13. Children
Discounts For Good is for people aged [16] and over. We do not knowingly keep an account for anyone younger; tell us if you think we have one.
14. Changes to this notice
The version and date at the top change when this notice does. A change that matters to you is announced in the app or by email before it takes effect.