Website Privacy Notice

Effective Date: September 2, 2026

Introduction

Third Ralph, LLC, doing business as Unspending Spree ("we," "us," or "our"), publishes this notice to explain what information we collect from visitors to our website and what we do with it.

This notice covers the website only. That means the pages at unspendingspree.com, the waitlist form, the survey and feature-request forms we link to from our emails, and the address those forms submit to (waitlist-api.unspendingspree.com). It does not cover the Unspending Spree application itself. If you create an account and use the app, the Privacy Policy for the app applies to that use.

The website never connects to a bank account, never takes a payment, and never asks for your account numbers or the amounts in your accounts. Before you create an account it asks three one-tap questions about your habits, described in Section 1.1. The only place you can type freely is the survey and feature-request forms, and we ask you not to put financial details there.

This notice applies to visitors located in the United States. We do not offer the website or the app to residents of other countries.

This notice describes our practices. Where applicable law requires your separate consent for a particular use of your information, we will ask for it.

Table of Contents

1. Information We Collect
2. How We Use Your Information
3. Who Receives Your Information
4. Cookies and Similar Technologies
5. How Long We Keep Information
6. Your Choices and Rights
7. Security
8. Children
9. Changes to This Notice
10. Contact Us

1. Information We Collect

1.1 Information you give us

Waitlist. When you join the waitlist we collect your first name, your email address, and the state you live in, chosen from a list that also offers "Outside the United States". If you have an invitation code, you can enter it too; the code is optional. We also record the date you joined and your position on the list. When we invite you to create an account, we record the date we sent the invitation and the code it carried.

The three questions before signup. The "Start unspending" buttons open three questions, each answered with one tap: whether you carry a balance on a credit card from month to month, and how often; about how many subscriptions you pay for; and whether a renewal has surprised you this year. The website keeps your answers in your browser's session storage, for that tab only, and adds them to the link to the app's signup page. Each question page also tells our server when it was shown, when it was answered and when it was left, and we keep only a count of each per day; the count carries no identifier, no cookie and not your answer. If the app cannot open an account for you yet and you save your spot on the waitlist from that page, your answers are stored on your waitlist entry with your email address. The app's Privacy Policy describes the signup page. Answers stored on a waitlist entry go to Loops, which sends our email, and we may use them to choose which waitlist emails you get. If you later create an account in the app, we tell Loops to stop the waitlist emails. Loops is not told about your account.

Survey. We may email waitlist members a link to a short survey. If you complete it, we collect your answers: which description of your financial situation you chose; a short written description of what frustrates you most about money (up to 500 characters); what you did the last time you tried to get on top of your debt, chosen from a list with an optional note of your own (up to 150 characters), and how it went; the tools you currently use (including any you type in yourself); how you would feel if the app did, or did not, offer each of three features; four monthly prices, in dollars, at which you would find an app like ours too cheap to trust, a bargain, getting expensive, and too expensive; and whether you want early access. Your answers are stored with your email address.

Feature requests. We may email waitlist members a link to a feature-request form. If you use it, we collect the request you write (up to 2,000 characters), how urgent you rate it, and the fact that you accepted the submission conditions shown on the form. Your request is stored with your email address.

Email. If you email us at info@unspendingspree.com or privacy@unspendingspree.com, we receive whatever you include in the message.

The survey and feature-request forms accept free text, and we store what you type as written. Please do not include account numbers, balances, or other financial details.

1.2 Information collected automatically

One cookie, set before you choose. The website uses a consent-preference tool to remember your cookie choices. When you first load any page, the tool assigns your browser a random identifier and stores it in a cookie named commspref_visitor_id and in your browser's local storage, before you have made any choice on the banner. The cookie lasts 365 days. The identifier is a random value; it contains nothing about who you are and we do not connect it to your name, your email address, or anything you submit. Your choices, once you make them, are stored in local storage and in a second cookie named commspref_consent, which lasts 365 days, and are sent with the identifier to the consent-preference service we operate. Section 4 has the details.

Where you came from, and a second cookie you can decline. When you arrive, the website notes in your browser's session storage, for that tab only, where you came from: the campaign labels on the link you followed (utm_source, utm_medium, utm_campaign, utm_content, and utm_term), the site that referred you, the first page you landed on, and the time. Session storage is cleared when the tab closes and is not gated by the banner. If you accept the marketing category on the banner, the same values are also stored in a cookie named us_first_touch on the unspendingspree.com domain for 90 days, so that if you come back later and create an account in the app, the account records that first arrival. The cookie holds no identifier and nothing you typed. If you decline the marketing category, no such cookie is set, and the values travel only on the signup link you click during that visit. Section 4 has the details.

Google Ads tag, only if you accept marketing. If you accept the marketing category on the banner, the website loads Google's advertising tag from Google's servers. Until you accept, the website does not load it. Once loaded, the tag runs in your browser and sends Google information about your visit: the page you are on, the page that sent you there, your IP address and browser details (which any request to Google's servers carries), and, if you arrived by clicking one of our Google ads, the click identifier Google added to that ad's link. Before the page address and the referring address reach Google, the website removes everything in them except that click identifier, so the email token in a survey link, your waitlist position, and your state are not sent. The tag also stores cookies on our domain whose names begin with _gcl_, which Google uses to connect your visit to an ad click. If you join the waitlist, the tag also tells Google that a join happened, with a random reference number so the join is counted once; it does not send your name, email address, state, or waitlist position. We use this to measure which of our Google ads bring visitors to the site and lead to waitlist joins. We tell the tag not to use your visit for ad personalization. We do not send Google your name, your email address, or anything you type into our forms. Section 4 has the details.

Meta pixel, only if you accept marketing, and only on our home page. If you accept the marketing category on the banner, our home page loads Meta's pixel from Meta's servers. Until you accept, it does not load, and no other page of the website loads it. Once loaded, the pixel tells Meta that the home page was viewed and, if you then press "Start unspending", that you did. With each, it sends the page address, including the campaign labels on the link you followed and, if you arrived by clicking one of our ads on Facebook or Instagram, the click identifier Meta added to that ad's link; the page that sent you there; and your IP address and browser details, which any request to Meta's servers carries. The website also reports the same two events to Meta from our own server, with the page address without anything after it, your IP address, your browser details and the two cookies described next, so that Meta counts each once even if your browser blocks the pixel. The pixel stores two cookies on our domain, _fbp and _fbc, holding a random browser identifier and the ad click identifier. We use this to measure which of our ads on Facebook and Instagram bring visitors to the site. We have turned on Meta's Limited Data Use setting, under which Meta handles this information as our service provider where a state's privacy law provides for that, and we have turned off the pixel's automatic collection of clicks and page details. We do not send Meta your name, your email address, or anything you type into our forms. Section 4 has the details.

Google Analytics, only if you accept analytics. If you accept the analytics category on the banner, the website loads Google Analytics from Google's servers to count visits and see which pages people read. Until you accept, the website does not load it. If you accept neither the analytics nor the marketing category, your browser sends nothing to Google on our behalf. Once loaded, Google Analytics runs in your browser and sends Google a record of each page you view: the page address and the page that sent you there, stripped in the same way as for the Google Ads tag, the page's title, how long the page was open, your IP address, and browser and device details such as screen size and language. Google uses your IP address to estimate the city and region you are in. The tag stores two cookies on our domain, _ga and one whose name begins with _ga_, holding a random identifier that lets Google Analytics tell a returning browser from a new one. We have turned off Google signals and ad personalization for our Google Analytics property. Section 4 has the details.

Bot check on the waitlist form. The waitlist page runs Cloudflare Turnstile to tell people from automated scripts. Turnstile runs in your browser and collects the browser and device signals described in Cloudflare's privacy policy. We receive a token that says the check passed; we do not receive the signals.

Links in our emails. When you click a survey or feature-request link in an email from us, the link carries your email address so that we know whose answers we are receiving. Our website turns it into a signed token that is valid for 30 days and appears in the page address. The token encodes your email address rather than hiding it, so anyone you forward that link to could read the address and could submit the form as you until the link expires.

Server and application logs. Our hosting provider keeps standard web-server logs, which include your IP address, browser type, the page requested, and the time. Our own application logs record that a request happened and what kind it was; they do not record the name or email address you submitted.

1.3 Information we do not collect

The website's only analytics tool is Google Analytics and its only advertising tools are the Google Ads tag and the Meta pixel, all described above, and each loads only if you accept its category on the banner. Apart from the _ga, _gcl_, _fbp and _fbc cookies those tags set, the website sets no cookies other than the three described above. It does not collect precise location, does not buy information about you from data brokers, and does not receive information about you from social networks.

2. How We Use Your Information

We use the information above to:

• Keep the waitlist, tell you when the app opens where you live, and email you an invitation to create an account when your turn comes
• While your spot waits for your state to open, email you now and then until it does, chosen in part from any answers to the three questions saved with your entry, and stop those emails once you create an account in the app
• Decide where to open next and whom to invite first, using the state you give us and any invitation code you enter
• Send you product updates and the survey and feature-request emails described above
• Understand what to build and how to price it, by reading survey answers and feature requests
• Understand what people waiting for the app are dealing with, from the answers to the three questions saved with waitlist entries
• Record which campaign, search engine, or site brought you to us, so that if you create an account in the app the account records that first arrival
• Count visits and see which pages people read, if you accept the analytics category
• Measure which of our Google ads bring visitors to the site and lead to waitlist joins, if you accept the marketing category
• Measure which of our ads on Facebook and Instagram bring visitors to the site, if you accept the marketing category
• Notify the people who run Unspending Spree when someone joins or submits a request
• Protect the forms from automated abuse
• Comply with legal obligations and respond to lawful requests

We do not sell personal information, use it for targeted advertising, or use it to make automated decisions that have legal or similarly significant effects on you.

3. Who Receives Your Information

We share visitor information only with the companies below. Each processes it to provide a service to us. Google also receives what its tags send under Google's own terms and privacy policy.

The consent-preference service (CommsPref) is operated by Third Ralph on Amazon Web Services and is not a third party.

If you follow a link from the website to the app's signup page, the arrival details described in Section 1.2 travel with the link, and the app stores them with your account under the app's Privacy Policy. The waitlist form sends you straight on to create your account when you live in a state where we are open and either you entered an invitation code or we are not requiring codes. That link also carries your state and your invitation code if you entered one, so the app's signup form starts filled in; it does not carry your email address. Because the state and code are in the page address, they can appear in your browser history. The link at the end of the three questions carries your answers in its page address the same way. The app is ours, not a third party.

We may also disclose information when the law requires it, to protect our rights or the safety of others, or as part of a merger, acquisition, or sale of assets, in which case this notice will continue to apply to information transferred.

4. Cookies and Similar Technologies

What is set. On the unspendingspree.com domain: the consent identifier cookie (commspref_visitor_id, 365 days) and, once you choose, the consent choice cookie (commspref_consent, 365 days), with two local-storage entries holding the same identifier and choices; one session-storage entry holding the arrival details described in Section 1.2, for the tab you arrived in; only if you accept the analytics category, the Google Analytics cookies (_ga and one whose name begins with _ga_); and, only if you accept the marketing category, the arrival cookie (us_first_touch, 90 days) holding the same details, plus the cookies the Google Ads tag sets, whose names begin with _gcl_, the cookies the Meta pixel sets on the home page, _fbp and _fbc, and, when you reach the waitlist confirmation page, one session-storage entry holding the join's random reference number, so that reloading the page does not count the join twice. Nothing else.

When they are set. The consent identifier on your first page load, before you interact with the banner, and the consent choice cookie when you make a choice; the identifier exists so that your choice can be remembered, and we treat it as strictly necessary for that purpose. Google Analytics and its cookies only after you accept the analytics category, never before. The arrival cookie, the Google Ads tag and the Meta pixel and their cookies only after you accept the marketing category, never before.

What the banner offers. The banner lets you set preferences for analytics, marketing, and personalization categories. The analytics category controls Google Analytics. The marketing category controls three things: the arrival cookie, the Google Ads tag and the Meta pixel described above. The website does not currently run any tool in the personalization category, so that choice changes nothing about what the site does today. If we ever add such a tool, we will honor the choice you saved and update this notice before the tool starts running.

Where your choice goes. Your identifier, your choices, and the banner's policy version label are sent to our consent-preference service and kept for two years, so that we can show you made a choice if asked.

How to change it. Use the Cookie settings link at the bottom of any page, or the banner's Customize option while the banner is showing. If Google Analytics has loaded, withdrawing the analytics category tells it that you have withdrawn consent and deletes its _ga cookies from our domain, and it is not loaded on later visits. Withdrawing the marketing category removes the arrival cookie. If the Google Ads tag has loaded, withdrawing also tells the tag that you have withdrawn consent and deletes its _gcl_ cookies from our domain, and the tag is not loaded on later visits. If the Meta pixel has loaded, withdrawing also tells it that you have withdrawn consent and deletes its _fbp and _fbc cookies from our domain, and it is not loaded on later visits. Any cookies Google or Meta set on their own domains are outside our reach; your browser's settings can remove them. Clearing your browser's cookies and site data for unspendingspree.com removes all of the cookies on our domain, and the site will assign a new consent identifier on your next visit.

5. How Long We Keep Information

When you ask us to delete your information (Section 6), we delete it from the systems above except where the law requires us to keep it, and we will tell you if anything is retained on that basis.

6. Your Choices and Rights

Email. Every marketing email we send includes an unsubscribe link at the bottom. You can also email privacy@unspendingspree.com to be removed.

Cookies, Google Analytics, the Google Ads tag, and the Meta pixel. See Section 4. Withdrawing the analytics category stops Google Analytics and removes its cookies from our domain. Withdrawing the marketing category stops the Google Ads tag and the Meta pixel and removes their cookies from our domain.

Privacy rights. Depending on where you live, you may have the right to know what personal information we hold about you, to correct it, to delete it, to receive a copy of it, and to opt out of its sale, its use for targeted advertising, or profiling. We do not sell personal information, use it for targeted advertising, or profile you, so there is nothing to opt out of on those counts, but the other rights apply.

How to exercise them. Email privacy@unspendingspree.com from the address you gave us, or write to the mailing address in Section 10. We will verify that the request comes from you, ordinarily by confirming the email address on file, and respond within the period required by applicable law. An authorized agent may submit a request on your behalf where the law permits.

Appeals. If we decline a request, you may appeal by replying to our decision or by emailing privacy@unspendingspree.com with "Privacy Appeal" in the subject line. We will respond to appeals within the period required by applicable law.

No discrimination. We will not treat you differently for exercising any of these rights.

7. Security

Traffic between your browser and the website is encrypted in transit. Submissions are stored on Amazon Web Services in the United States, and access to them is limited to the people who run Unspending Spree.

If a security incident affects your personal information, we will investigate, take steps to reduce harm, and notify affected individuals and authorities within the time and in the manner required by applicable law.

8. Children

The website is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, email privacy@unspendingspree.com and we will delete it.

9. Changes to This Notice

When we change this notice we update the "Last Updated" date at the top. If a change materially affects how we use information you have already given us, we will email waitlist members before the change takes effect, and where the law requires your consent for a new use we will ask for it first.

10. Contact Us

Email: privacy@unspendingspree.com

Mail: Third Ralph, LLC dba Unspending Spree 3201 Bee Caves Rd, Ste 120, #163841, Austin, TX 78716, US

Document Control:

• Version: 2.7 (change history is the policy_versions register, not this document)
• Classification: Public
• Legal Entity: Third Ralph, LLC dba Unspending Spree

Third Ralph, LLC dba Unspending Spree