Privacy Policy

Effective date: November 6, 2026

Who we are

Mall Rat Alerts ("we", "us") is a free, unofficial fan text alert service at mallratalerts.com, operated by [OPERATOR LEGAL NAME], [OPERATOR ADDRESS]. Contact: hello@mallratalerts.com.

What we collect

• Your mobile phone number.
• Which alert campaign you signed up for (for example, Twilight Town Mall), and whether you joined on the web or by texting a keyword such as FOB.
• Consent records: the time you signed up, the version of the consent text you agreed to, the form version, your answer to the 18+ question, and salted one-way hashes of your IP address and browser user agent. We do not store your raw IP address.
• Optional signup context: the page you signed up on, the referring site, and campaign tracking tags (UTM parameters) if they were in the link you followed.
• Bot-check results, if a bot check (Cloudflare Turnstile) is enabled on the form.
• Text replies you send us: the keyword (such as FOB, YES, STOP, HELP, or START), its time, and the message ID. When you join by texting a keyword, that text is your consent record and we store the keyword, time, and message ID. For any other text you send, we record only that a message arrived and its length, not what it said. Later, when alerts launch: line type and carrier information about your number from our SMS provider, and delivery status.
• Website usage analytics, described below.
• If you use a tip jar in the future, the payment processor (Stripe) holds your payment details. We would see only the name and email you give Stripe, the amount, and the card brand and last four digits.

Why we collect it

To send the alerts you asked for, to prove you consented, to honor opt-outs, and to prevent abuse and fraud.

Who processes it for us

We use service providers that run the service on our behalf: Amazon Web Services (hosting and data storage), Twilio (receiving and sending texts and number lookup), PostHog (website analytics), Cloudflare (bot checks, if enabled), and Stripe (tips, if enabled). They may only use your information to provide their service to us.

Website analytics (PostHog)

We use PostHog, hosted in the United States, to understand how people use this website so we can improve the signup form. PostHog records page views and form steps (for example, "signup submitted", "signup succeeded", or the type of error), the alert campaign, the page address and referring site, campaign tracking tags, your browser and device type, and an approximate location that PostHog derives from your IP address. When you text us, our server may also send PostHog a count of which keyword arrived, tied to a salted one-way hash rather than your number.

We never send your phone number, the contents of your texts, or what you type into the form to PostHog. Analytics on this site is cookieless: it does not set cookies or store an identifier on your device, and we do not record your screen or clicks. We only remember your analytics choice on your device. You can turn analytics off with the "No thanks" button on the analytics notice, and we do not load it at all if your browser sends a Do Not Track or Global Privacy Control signal.

Mobile information and SMS consent

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

What we do not do

• We do not sell or rent your personal information.
• We do not use advertising or tracking cookies, and our analytics is cookieless.
• We do not put ads or third-party offers in texts.

How long we keep it

• Waitlist signups that are never confirmed are deleted after about 30 days. Signup and consent event records are kept for at least 90 days for abuse prevention.
• Active subscriptions are kept while you are subscribed.
• After you opt out, we keep a minimal suppression and consent record (phone number, campaign, timestamps, and how you opted in and out) for up to 5 years so we never text you again by mistake and can show that we had consent.
• Server logs are kept for 14 days, with phone numbers masked.

Your choices

You can opt out at any time by replying STOP to any text or using the unsubscribe page. To ask us to delete your information, email hello@mallratalerts.com from or about the number. We will delete your profile and keep only the minimal suppression record described above.

Children

The SMS service is only for people 18 and older. We do not knowingly collect information from children under 13.

United States only

The service is offered to US mobile numbers only, and data is stored in the United States.

Changes

If we change this policy, we will post the new version here with a new effective date. If a change materially affects how we use your phone number, we will ask for your consent again.