Privacy Policy

Last updated: February 5, 2026

1. Introduction

Stacker Tracker ("Service") is operated by Present Future Labs Inc. ("Company," "we," "us," or "our"), a corporation incorporated under the laws of British Columbia, Canada. We are committed to protecting your privacy and handling your personal information responsibly.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this policy carefully. By using the Service, you consent to the data practices described in this policy.

If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

2. Information We Collect

2.1 Information You Provide Directly

Phone Number: Required for account creation, SMS verification, and delivery of notifications
Email Address: Used for receipts, account communications, and marketing emails (if you opt in)
Lightning Lane Entries: Attraction names, return window times, and park selections you manually enter
Preferences: Settings such as grace period overrides and notification preferences
Support Communications: Content of any messages you send to our support team

2.2 Information Collected Automatically

Device Information: Browser type, operating system, device type
Usage Data: Pages visited, features used, time spent on pages, click patterns
Log Data: IP address (anonymized), access times, error logs
Analytics Data: Aggregated usage patterns and feature adoption metrics

2.3 Information We Do NOT Collect

Disney account credentials or passwords
Precise location data or GPS coordinates
Contacts, photos, or files from your device
Data from other apps on your device
Social Security numbers or government IDs
Financial information (payment processing is handled by Stripe)

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

Contract Performance: Processing necessary to provide the Service you requested (e.g., sending SMS notifications, managing your account)
Consent: Processing based on your explicit consent (e.g., marketing emails)
Legitimate Interests: Processing necessary for our legitimate business interests, such as improving the Service, preventing fraud, and ensuring security, balanced against your privacy rights
Legal Obligations: Processing necessary to comply with applicable laws and regulations

4. How We Use Your Information

We use the information we collect for the following purposes:

4.1 Service Delivery

Sending SMS notifications about your Lightning Lane stack
Computing lane timelines, grace periods, and rebooking eligibility
Providing the dashboard and management features
Processing payments and managing subscriptions
Authenticating your identity via SMS OTP

4.2 Communications

Sending transactional emails (receipts, account updates, security notices)
Sending marketing emails (if you opt in) including tips and product updates
Responding to your support inquiries

4.3 Service Improvement

Analyzing usage patterns to improve features and user experience
Identifying and fixing bugs and technical issues
Developing new features based on aggregated user behavior

4.4 Safety and Compliance

Preventing fraud, abuse, and unauthorized access
Complying with legal obligations and law enforcement requests
Enforcing our Terms of Service

5. SMS and Mobile Information

We collect your mobile phone number solely to deliver SMS notifications related to your Lightning Lane stack management. Regarding your mobile information:

We will NOT sell, rent, loan, trade, lease, or otherwise transfer your phone number to third parties for promotional purposes
We will NOT share your phone number with third parties except as necessary to deliver the Service (e.g., Twilio for SMS delivery)
Consent to receive SMS is not a condition of purchasing the Trip Pass
You may opt out at any time by replying STOP or adjusting your settings
Standard message and data rates from your carrier may apply
Carriers are not liable for delayed or undelivered messages

6. Email Communications

6.1 Transactional Emails

You will receive transactional emails related to your account, including purchase receipts, security notices, and important service updates. These are not marketing messages and cannot be opted out of while maintaining an active account.

6.2 Marketing Emails

If you opt in during registration, we may send you marketing emails including tips, product updates, and promotions. You can unsubscribe at any time by:

Clicking the unsubscribe link in any marketing email
Toggling off marketing emails in your Settings
Emailing support@presentfuture.io

Unsubscribe requests are processed immediately. You will continue to receive transactional emails after unsubscribing from marketing emails.

7. Information Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

7.1 Service Providers

We use trusted third-party service providers to operate the Service:

Supabase — Database hosting and user authentication
Twilio — SMS delivery
Stripe — Payment processing
Vercel — Application hosting
Resend — Email delivery
PostHog — Product analytics
Google — Web traffic analytics (Google Analytics)

These providers are contractually obligated to use your information only to provide their services to us and to maintain appropriate security measures.

7.2 Legal Requirements

We may disclose your information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

7.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on our Service before your information becomes subject to a different privacy policy.

8. Cookies and Tracking Technologies

We use cookies and browser storage as follows:

8.1 Essential (Required)

These cannot be disabled without breaking core functionality:

Authentication cookies: Managed by Supabase for secure session management
Consent preference: Stored in your browser to remember your cookie choice
Temporary auth data: Phone/email stored briefly during sign-up (cleared after verification)

8.2 Analytics

We use basic web analytics that run automatically to measure site traffic. Detailed product analytics are only enabled if you click "Accept All" on our cookie banner:

Google Analytics: Basic web traffic measurement (page views, referral sources, device type). Data is processed by Google per their privacy policy. IP anonymization is enabled by default in Google Analytics 4.
PostHog analytics: Privacy-friendly product analytics to help us improve the Service. IP addresses are anonymized. Only enabled with your consent — you can decline by clicking "Essential Only" on the cookie banner.

8.3 What We Do NOT Use

Third-party advertising or marketing cookies
Social media tracking pixels
Cross-site tracking technologies
Fingerprinting or device identification

9. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

Encryption of data in transit (TLS/HTTPS) and at rest
Secure authentication via SMS OTP (no passwords stored)
Access controls limiting employee access to personal data
Regular security assessments and monitoring
Use of reputable, security-certified service providers

While we take reasonable precautions, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

10. Data Retention

We retain your personal information as follows:

Account Data: Retained while your account is active and for 30 days after deletion request
Lightning Lane Entries: Retained for 90 days after the park day date, then automatically deleted
SMS Message Logs: Retained for 90 days for troubleshooting, then deleted
Payment Records: Retained for 7 years as required for tax and legal compliance
Aggregated Analytics: May be retained indefinitely in anonymized form

When you delete your account, we will permanently delete your personal data within 30 days, except where retention is required by law.

11. Your Privacy Rights

11.1 Rights for All Users

Regardless of your location, you have the following rights:

Access: Request a copy of your personal data
Correction: Update or correct inaccurate data
Deletion: Request deletion of your data
Portability: Export your data in a machine-readable format (JSON)
Opt-out (SMS): Reply STOP to any message or adjust settings
Opt-out (Email): Click unsubscribe or adjust settings

You can exercise most of these rights directly in your Settings page.

11.2 Additional Rights for Canadian Residents

Under PIPEDA and British Columbia's PIPA, you also have the right to:

Withdraw consent for data processing at any time, subject to legal or contractual restrictions
Challenge the accuracy and completeness of your personal information
File a complaint with the Office of the Privacy Commissioner of Canada

11.3 Additional Rights for California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected
Right to Delete: Request deletion of your personal information
Right to Opt-Out of Sale: We do not sell your personal information
Right to Non-Discrimination: We will not discriminate against you for exercising your rights

To exercise your CCPA rights, contact us at support@presentfuture.io. We will respond within 45 days.

11.4 Additional Rights for EEA/UK Residents (GDPR)

If you are located in the European Economic Area or United Kingdom, you have additional rights under GDPR:

Right to Restrict Processing: Request that we limit how we use your data
Right to Object: Object to processing based on legitimate interests
Right to Lodge a Complaint: File a complaint with your local data protection authority

12. International Data Transfers

Your information may be processed and stored on servers located outside of Canada, including in the United States, through our third-party service providers.

When we transfer data internationally, we ensure appropriate safeguards are in place, including:

Standard contractual clauses approved by relevant authorities
Adequacy decisions where applicable
Service provider certifications and compliance programs

By using the Service, you consent to the transfer of your information to jurisdictions outside your country of residence, which may have different data protection standards.

13. Children's Privacy

Stacker Tracker is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13.

If we learn that we have collected personal information from a child under 13, we will promptly delete that information. If you believe a child under 13 has provided us with personal information, please contact us at support@presentfuture.io.

14. Data Breach Notification

In the event of a data breach that affects your personal information, we will:

Notify affected users via email within 72 hours of becoming aware of the breach
Notify relevant regulatory authorities as required by law
Provide information about the nature of the breach and steps we are taking to address it
Recommend steps you can take to protect yourself

15. Automated Decision-Making

The Service uses automated processing to calculate grace periods, rebooking times, and notification schedules based on the data you provide. These calculations are purely informational and do not have legal or similarly significant effects on you. You can always override automated suggestions by manually adjusting your settings or entries.

16. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any personal information.

17. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by:

Posting the updated policy on this page with a new "Last updated" date
Sending you an email notification (if we have your email address)
Displaying a prominent notice within the Service

Your continued use of the Service after the effective date of the revised policy constitutes your acceptance of the changes.

18. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about how we handle your data, please contact us:

Present Future Labs Inc.
Attn: Privacy Officer
200-1462 W. 8th Ave
Vancouver, BC V6H 1E1
Canada

Email: support@presentfuture.io

We will respond to privacy-related inquiries within 30 days.