Privacy Policy

Last updated: June 2026

This Privacy Policy explains how LootMachi (“LootMachi,” “we,” “us”) collects, uses, and shares information when you use our website and our iOS and Android mobile apps (together, the “Service”). By using the Service you agree to this policy.

1. Who we are

The Service is operated by LootMachi, based in Telangana, India. For any privacy question or request, contact support@lootmachi.com.

2. Information we collect

Information you provide

• Account — when you sign up or sign in with an email address and password, we receive your email address, display name, and, if provided, profile photo.
• Profile — optional details you add: first and last name, bio, a phone number, notification preferences, and favourite categories. All of these are optional; the sign-up form works if you leave them blank, and you can clear any of them later in Settings → Profile. We do not currently use your phone number to contact you — it is stored only on your profile, and it is deleted with your account.
• Content — deals you submit, votes, comments, reports, and price alerts you create. Submitted/commented content is shown publicly with your display name.
• Search input — text you enter, such as a product search or a price-check query. We do not collect GPS/precise location.
• Support messages — if you email us, we keep your message and contact details to respond.

Information collected automatically

• Usage & device analytics — via Google Firebase/Google Analytics: app and page interactions (e.g. deal views, searches, outbound clicks), device type, OS, app version, and a random app-instance identifier. Used in aggregate to improve the Service. We do not use advertising identifiers (IDFA) or cross-app tracking.
• Outbound click logs — when you tap “Get this deal,” we log the deal and a timestamp (with your account id if signed in) to attribute affiliate commissions and measure popular deals.
• Push tokens — if you enable notifications, a device push token so we can send price-drop and alert notifications you opt into.
• Security signals — IP address and app-attestation (App Check) tokens, used transiently for rate-limiting and abuse prevention.
• Cookies (website) — a sign-in/session cookie and analytics cookies. See Cookies below.

3. How we use information

• operate, maintain, and secure the Service and your account;
• personalize your feed and show your saved items, alerts, and history;
• send notifications and emails you opt into (e.g. price-drop alerts, digests);
• attribute affiliate commissions and measure which deals are popular;
• detect, prevent, and respond to fraud, abuse, and security issues;
• comply with legal obligations.

Where required (e.g. EEA/UK), our legal bases are: performance of a contract (running your account), legitimate interests (security, analytics, improving the Service), consent (notifications, certain analytics), and legal obligation.

4. AI features

Some features use AI providers (e.g. Anthropic) to analyze deal content (title, price) for a legitimacy/“deal check” signal, or to process a search/scan query you submit. These providers process that content to return a result and do not use it to identify you. AI results can be wrong — always confirm the final price and terms on the retailer’s site.

5. How we share information

We do not sell your personal information. We share it only with:

• Service providers (sub-processors) that run the Service on our behalf: Google Firebase/Google Cloud (authentication, database, hosting, cloud functions, analytics, push messaging, app attestation), Apple (push notifications on iOS), and our email provider (Resend) for transactional emails.
• Retailers and affiliate networks — when you click an outbound deal link (e.g. Amazon Associates and other affiliate networks), the destination receives the referral so a commission can be attributed. Your activity on their sites is governed by their privacy policies.
• Legal / safety — to comply with law, enforce our terms, or protect rights, property, and safety.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.

6. Data retention

We keep account and content data while your account is active. When you delete your account, we delete or de-identify your personal data within a reasonable period, except where we must retain limited records for legal, security, or fraud-prevention purposes. Public content you posted may be removed or anonymized.

7. Your rights and choices

• Delete your account & data — in the app: Settings → Delete account. This removes your sign-in and associated profile data. You can also email support@lootmachi.com.
• Access, correct, export, or restrict — under India’s Digital Personal Data Protection Act, 2023 (and equivalents such as the GDPR if you are outside India), you may request a copy of your data, correction or completion, erasure, and the identities of anyone we have shared it with. You may also nominate another person to exercise these rights on your behalf. Email us to exercise these rights; we will verify and respond as required by law. We do not discriminate for exercising your rights.
• Notifications — turn push/email notifications off any time in the app or your device settings.
• Analytics — you can limit analytics via your device settings and our cookie controls on the website.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. If you are not satisfied with how we handle a request, you may escalate to our Grievance Officer (see the contact section below) and, after that, to the Data Protection Board of India.

Withdrawing your consent

Where we rely on your consent, you may withdraw it at any time, and doing so must be as easy as giving it was. In practice:

• Analytics and non-essential cookies — reopen the cookie banner on the website, or decline; on mobile, use your device’s analytics/advertising controls.
• Push and email notifications — Settings → Notifications in the app, or the unsubscribe link in any email.
• Everything else — deleting your account withdraws consent for the personal data tied to it. Settings → Delete account, or email us.

Withdrawing consent does not undo processing we already carried out lawfully, and it may stop parts of the Service working — you cannot, for example, keep saved deals or price alerts without an account. Where the law requires us to keep something (tax and accounting records, or data needed to defend a legal claim), we keep only that, and only for as long as required.

7A. If something goes wrong (personal data breach)

If a personal data breach affects your data, we will notify the Data Protection Board of India and every affected person, as required by the DPDP Act. Our notice to you will describe, in plain language, what happened, the data involved, what we have done about it, what we suggest you do, and how to contact us about it. We will not wait for a complete investigation before telling you.

8. Cookies

The website uses a strictly-necessary session cookie to keep you signed in, and analytics cookies to understand usage. You can control non-essential cookies through the cookie banner and your browser settings. The mobile apps do not use browser cookies but use the local storage and identifiers described above.

9. Children’s privacy

The Service is not directed to children. Under India’s DPDP Act a “child” is anyone under 18, and we do not knowingly collect their personal data, profile them, or target advertising at them. You must be 18 or older to create an account. If you believe a child has given us personal data, contact us and we will delete it.

10. Security

We use industry-standard safeguards (encryption in transit, access controls, app attestation, and Google Cloud’s infrastructure security). No method of transmission or storage is 100% secure, but we work to protect your information.

11. International transfers

We use Google Cloud and Firebase, so your information may be processed outside India, including in the United States and the European Union. The DPDP Act permits such transfers except to countries the Government of India has restricted; where required we also rely on appropriate contractual safeguards (such as Standard Contractual Clauses).

12. Mobile app permissions

• Notifications — to deliver price-drop and alert notifications you opt into.
• Camera — only if you use barcode/deal scanning; images are processed to read the code and are not stored for advertising.
• Internet/network — required to load deals and sync your account.

You can change permissions any time in your device settings.

13. Changes to this policy

We may update this policy; we will revise the “Last updated” date and, for material changes, provide additional notice. Continued use after changes means you accept the updated policy.

14. Contact & Grievance Officer

Questions or requests: support@lootmachi.com.

As required by India’s Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, complaints about your personal data or about content on the Service can be sent to our Grievance Officer at grievance@lootmachi.com. We acknowledge complaints within 24 hours and resolve them within 15 days.

See also our Terms of Service, Affiliate Disclosure, and Support.