Privacy Policy

PennyStay is a hotel search and booking service owned and operated by Grand Choice Spotlight LLC. This page describes the information the website and the app actually collect, and why.

Questions about your information go to support@pennystay.org.

Sign-in is optional. You can search and book without an account.

When you do sign in, PennyStay uses Supabase Auth. You can continue with Google. On iPhone you can also use Sign in with Apple. If you choose Hide My Email, we receive Apple’s relay address instead of your email. There is no password, no email sign-in, and no phone-number sign-in.

From that sign-in we store an account id, plus the name, email, and phone number Supabase provides. Those account records are kept in our Neon Postgres database. Google sign-in uses the name and email on the Google account. Sign in with Apple uses the name and the email Apple shares, which may be a relay address.

On the website, a cookie keeps you signed in for about 30 days. A short-lived cookie is used only while Google sign-in finishes, and another short-lived cookie is used if an operator is sent to the admin sign-in. On the phone app, the sign-in tokens are kept in the device’s secure storage.

You can sign out from My Trips. Signing out ends the session. It does not delete the account. Delete my account, on that same screen, does.

Checkout asks for a first name, last name, email, and phone number. We also keep the hotel, room, dates, price, currency, booking ID, cancellation terms, and a payment status. Checkout can include a special-requests note that you type. We store that note with the booking and send it to the hotel supplier with the reservation.

Those records are stored in Neon Postgres. They let you open the stay in My Trips, add a guest booking later with the booking ID and the checkout email, and write a review after checkout.

To make the booking, we send your name, email, phone, and the stay details to our hotel supplier, LiteAPI. The hotel needs those details to host you. The same contact details are sent for each room on the booking.

After a booking, we email a confirmation and a PDF receipt to the address on the booking, through Resend. The receipt names Grand Choice Spotlight LLC as the seller. It can include the last four digits of a card when the booking provider sends them. It does not include a full card number. We do not email the hotel. The hotel supplier already sends the reservation to the property. If the hotel confirmation number is not ready at booking, we check again later and email that number to you once. We store whether each email was sent, and the hotel confirmation number when the supplier provides it. Deleting your account clears your name, email, and phone from that record.

People who run PennyStay can open bookings and accounts to handle support and refunds.

Prices on PennyStay show the full stay total, including hotel-collected fees and taxes. The amount shown as 'Charged now' is the only charge PennyStay places on your card. Each hotel-collected item is named and listed with its amount before you pay, and the hotel collects it, not PennyStay.

When you book, you pay that prepaid amount on the secure payment page of our booking partner, LiteAPI by Nuitee. Their payment processor, Stripe, collects and processes your card for that amount. That page opens from PennyStay, but checkout does not show a card form of its own. PennyStay does not see or store your full card number. We receive and store a payment reference, the payment status (for example, paid or refunded), and, when the provider sends them, the card brand and last four digits.

A search sends the destination, dates, number of adults, children, and rooms to LiteAPI so it can return rates. It also sends the currency and guest nationality you picked.

If children are on the trip, we ask for each child’s age from 0 to 17 and send those ages with the search. They are used to price the room. We do not open an account for a child.

Nearby, or “Use my location,” asks the browser or phone for an approximate location and uses those coordinates for that search. The approximate location is sent to the hotel search provider, LiteAPI, so it can return nearby hotels. It is not saved on your account. On the web the coordinates can remain in the page address for that search.

Destination suggestions send the text you type to Google Places when that service is turned on. Otherwise the suggestions come from LiteAPI. We do not save the suggestion session as an account record.

If price comparison is turned on, the hotel name, city, dates, and guest counts are sent to a comparison service (Xotelo). Your name, email, and phone are not included.

The results map loads map tiles from OpenStreetMap. Your browser or phone requests those tiles directly, so that service sees the request for the map area.

On a hotel with dates, you can ask for an email if the PennyStay total drops. We store the email, the hotel, the dates, the number of guests, and the price you saw. If you are signed in, the alert is tied to the account. The alert does not book a room.

Signed-in guests can also watch a hotel or a search from the results and the hotel page. We store the destination or hotel, the dates, the guest counts, an optional maximum price, and the last price we were able to check. Those watches show in My Trips.

If you turn on notifications on the iOS or Android app, we store an Expo push token for the account, plus the language and whether the device is an iPhone or an Android phone. Price drops, a watched stay becoming available, and check-in reminders can be sent through Expo’s push service, which delivers them with Apple Push Notification service and Firebase Cloud Messaging. The website shows the same updates in My Trips and does not register the browser for push. Deleting the account removes the token and those in-app notices.

Alert emails are sent with Resend. If text alerts are turned on, we also store a phone number and can send the same notice by text through Twilio. If text alerts are not turned on, we do not ask for a phone number on that form.

A review is only for a real PennyStay booking, after checkout. We check the booking ID and the guest email. We store the star ratings, an optional rating for cleanliness, location, value, and staff, a title, the review text, and the month of the stay. The email is stored with the review and is not shown on the hotel page.

You can report a review. We store which review was reported and the reason you give.

A saved hotel or a recently viewed hotel is the hotel name, city, photo, and nightly price. On the website that list is kept in the browser’s local storage. On the phone it is kept in secure storage. If you are signed in, the list is also copied to your account in our database.

Language, currency, and guest nationality are stored on the device the same way: local storage on the web, secure storage on the phone. They are not an account profile by themselves. Currency and guest nationality are sent with a hotel search so the rates match what you picked.

On the website, the price you are about to book is kept in session storage until checkout finishes. On the phone that quote stays in memory for the session and is not written to storage.

Help messages are sent to OpenAI to generate an answer. The same help feature can be pointed at Anthropic instead, and then the messages go there. Replies are labeled as AI-generated. Before your first help message, the app asks your permission to send your message and, if you are signed in, your name and PennyStay bookings to OpenAI. You can change this choice in Help. If you allow it, the request can include your name and stays on your account (hotel, room, dates, booking ID, price, and status) so the answer can talk about your own trip. If you do not allow it, Help sends only the message you type. The chat transcript is not saved in our database.

You can report an AI answer. We store the answer, the message you sent before it, and the account id if you are signed in. Deleting the account clears that account id. The reported answer stays so we can review it.

Talk to a person asks for your name, email, a booking ID if you have one, and a message. We store that as a support ticket. When email sending is turned on, the same message is emailed to support@pennystay.org through Resend. If the ticket cannot be stored and cannot be emailed, your device opens an email to that address instead.

We do not use advertising cookies, analytics cookies, or a third-party crash-reporting tool.

If the app hits an error, it sends that error’s message and stack, the platform, the build number, the screen, and the account id when you are signed in. It does not send your name, email, phone number, or text you typed. Those reports are stored on our servers and written to the host logs. They are not sent to an advertising or analytics service. Deleting the account clears the account id on an error report. The error text stays so we can fix the problem.

On the website we use the sign-in and short-lived cookies described above, local storage for language, currency, nationality, and saved hotels, and session storage for the checkout quote.

On the phone we use secure storage for preferences, saved hotels, and sign-in tokens. We do not use a separate analytics store.

The website is hosted on Vercel. The host’s logs can include the IP address and the browser or device information that arrive with a request.

Help also stores a short hash of the IP address, not the address itself, so one person cannot send too many help messages in an hour.

PennyStay is not directed to children under 13. We do not knowingly create an account for a child. A search can include a child’s age only so a hotel can price the room for the party.

We do not sell personal information. We share it with the booking, sign-in, email, text, help, and hosting services described on this page so PennyStay can run.

Each service we share information with may use it only to provide its service to PennyStay, and must protect it at least as well as this policy describes.

We keep account and booking information while the account is in use, and for as long as we need it to complete a booking and to meet legal or tax duties. Price alerts, reviews, saved hotels, and support tickets stay while they are needed for those same reasons.

The app does not run an automatic deletion timer.

Signed-in guests can delete the account from My Trips with the button labeled Delete my account. The same choice is on the website at https://pennystay.org/delete-account. That page names PennyStay and Grand Choice Spotlight LLC. It explains how to delete the account in the iOS app, the Android app, and on the website. Someone who cannot sign in can request deletion on that page, or email support@pennystay.org. A request from the page is stored as a support ticket. If the stay was booked without an account, include the booking ID and the checkout email.

Deleting the account removes the account record in Neon Postgres, including the name, email, and phone number. It also removes saved hotels, price alerts, price watches, push tokens, and in-app notices tied to the account. You are signed out. Deleting the account also deletes your PennyStay sign-in record with our sign-in provider, Supabase. Deleting the account clears the account id stored on error reports and on reports of an AI help answer.

Bookings are kept for legal, tax, and refund records. The name, email, and phone on those bookings are cleared, and the booking is no longer tied to the account. The hotel, dates, price, and booking ID stay.

A review stays on the hotel page. Reviews are public and do not show a name or email. Deletion removes the email stored with the review. The ratings and the review text stay.

Support tickets that used the account email have the name, email, and message removed. Signing out does not delete the account. You can still ask for a copy or a correction by emailing support@pennystay.org.

You can use PennyStay from outside the United States. The app and the website can be shown in English, Spanish, French, Arabic, Chinese, Hindi, Japanese, and Thai. This policy is provided in English.

The services that store or process information, including our database, sign-in, hotel supplier, email, and hosting, may handle it in the United States or in another country where that service operates.

If this policy changes, we will update this page and the date below.

Last updated: October 9, 2026.

Grand Choice Spotlight LLC

support@pennystay.org

Booking email: bookings@pennystay.org