Company
Privacy policy
Last updated Oct 5, 2026
Flatcart collects only what we need to run the site and the services you ask for. We don't sell your personal information. This policy explains what we collect, why, who helps us process it, and how to see, correct or delete it. Questions or requests: hello@flatcart.ca.
What do we collect when you browse?
We use Google Analytics 4 to understand how the site is used: which pages are read, how people arrive, and roughly where they are (city level). Google Analytics sets cookies in your browser and processes this information on our behalf. It does not tell us who you are. You can block it with your browser's cookie settings, a content blocker, or Google's Analytics opt-out add-on.
When you send us a form or sign in, our server briefly uses your IP address to limit abuse (for example, too many sign-in attempts in an hour).
Your browser also keeps a few settings on your own device, which we never see: the Costco warehouse you chose as "My Costco", and whether you have already signed up for or dismissed our email prompt.
What do we collect when you sign up or create an account?
| What you do | What we keep | Why |
|---|---|---|
| Sign up for the weekly email | Email, and if you give them: first name, nearest city, province, membership level, whether you have a Costco credit card | To send the email and skip what doesn't apply to you |
| Create an account | Email, a scrambled (hashed) password, your Costco, your first name if you give it, your email choices and whether you agreed to marketing email, with the date | To sign you in, keep your price alerts, show prices and deals at your Costco, and list what you've shared. Delete your account anytime from your account page |
| Set a price alert | The product and your target price | To email you when the price drops |
| Report a price or add a photo | The price, warehouse and date, your photos, and your email if you give it | To check the report before it is published |
| Upload a receipt | The receipt image (a photo or a digital receipt), and the items, prices, warehouse, date and total we read from it | To publish real Costco prices (never who paid them) and count your points. An AI service (Anthropic) reads receipts on our behalf and, under its commercial terms, does not train on them. We never keep membership or card numbers |
| Review a Costco location | Email, your review, and if you give them: a name to show and a photo | To check the review before it is published. Approved reviews show your review, the name you chose and your photo; your email is never shown |
| Earn points | The points each approved contribution earned | To set your level and how many products you can track. Points have no cash value |
| Report a Costco gas price | The price, grade, warehouse and time, and if you give them: a photo of the sign and your email | To check the price before it is published. Only the price and time are shown; the photo and email never are |
| Suggest an edit to a page | Your email and your suggestion | To check and fix the page, and to reply if we have a question |
| Use “Find my nearest Costco” | Nothing. Your browser uses your location once to sort the list; it is never sent to us | To show the closest locations |
| Apply to be a Price Scout | Name, email, phone, city, warehouses, visit frequency and phone model | To review your application and contact you |
| Email yourself a credit card summary or a guide | Nothing: the address is used once to send the email (a scrambled version is kept for a day to stop abuse) | To send the summary you asked for. You are not added to any list |
| Ask for a quote (tires, hearing, optical, business) | Name, email, phone, postal code and your message | To reply to your request |
We ask only for what each form needs. Receipts, product photos and applications are private: only you and our editors can open them. A photo you add to a warehouse review becomes public only if the review is approved, and only with your permission.
What do we collect from service providers and people requesting help?
Independent providers who apply to our member services directory give us their contact details, the services and areas they cover, and photos of the front and back of their driver's licence with its expiry date. We use the licence only to confirm who the provider is before a profile goes live. The images are stored privately, only our admins can open them, and they never appear on a profile or anywhere public. We delete them if an application is rejected, and on request at any time. A provider's email and phone are never published. People who request help give us their contact details and what they need, which we share only with the independent provider or providers who offer that service. When you order a service, your messages, prices and job history are kept with the job, and card payments are handled by Stripe: we never see or store your card number. Providers see your first name, not your email or phone.
Do we send marketing email?
Only if you ask. The weekly email goes to people who signed up for it, and account holders choose separately whether to receive marketing email. Price alert emails are ones you set up. Every email has a one-click way to stop it, as Canada's anti-spam law (CASL) requires.
Which cookies do we use?
- Google Analytics cookies, to measure how the site is used (see above).
- A sign-in cookie (`cc_session`), only if you sign in. It keeps you signed in for up to 30 days, can't be read by scripts on the page, and is removed when you sign out.
Retailer links can take you to sites such as Amazon or Best Buy, which set their own cookies under their own policies. Some of those links earn us a commission; Costco links never do. When you click one, we record the product and retailer, not who you are. The same goes for credit card links: when you click to apply or to see a card at its issuer, we record the card, the page and where on it you clicked, not who you are.
Who processes your information for us?
We use a small number of service providers, each only for the job below. Some store data outside Canada, including in the United States, where it may be subject to local law.
| Provider | What for |
|---|---|
| Vercel | Hosting the site and its server |
| Neon | The database that stores sign-ups, accounts and submissions |
| Google (Analytics) | Site analytics |
| Resend | Sending email, including price alerts and password resets |
| Stripe | Card payments for services ordered on Flatcart, and payouts to providers |
| YouTube (Google) | Videos in some guides. Nothing loads from YouTube until you press play; then the player comes from youtube-nocookie.com under Google's privacy policy |
How long do we keep it?
Sign-in sessions expire after 30 days and password reset links after 1 hour. Abuse-prevention records keep your IP address only for the time window they check. Everything else (sign-ups, accounts, alerts, reports, receipts, applications and quote requests) is kept until you ask us to delete it or it is no longer needed for the reason you gave it to us.
How do you see, correct or delete your information?
Email hello@flatcart.ca from the address you used with us and tell us what you'd like: a copy of your information, a correction, or deletion. We reply within 30 days. To stop emails, use the link in any email; to stop analytics, block cookies or use Google's opt-out add-on. If you aren't satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.
How do we protect it?
Passwords are stored only as scrambled hashes, sign-in tokens are stored hashed, the site runs over HTTPS, and uploads can be opened only by you and our editors. No system is perfectly secure; if a breach put you at real risk, we would tell you and the Privacy Commissioner, as Canadian law requires.
Will this policy change?
If we change what we collect or how we use it, we will update this page and its date. Big changes will be announced in the weekly email before they take effect.