Privacy, in plain English.
Side Street is a Pittsburgh local-offers service. This page explains what the current version uses.
Last updated: October 31, 2026. This notice covers the Side Street website and Side Street pages displayed inside the mobile app.
The short version
We measure visits and listing activity to learn which parts of Side Street are useful. We also process the information needed for features you choose, such as accounts, saved places, business submissions, and the newsletter. Browsing does not require an account or device-location permission. Analytics is not the same as collecting no personal data: cookie identifiers, account records, and information processed by service providers are described below.
Questions or requests go to Joe DiGioia, Side Street’s operator, at joe@sidestreetpgh.com. You can request access, correction, or deletion of information associated with you. We may need to verify the request; please do not email your password, a payment-card number, or an identity document unless a secure verification method has been agreed.
What Google Analytics measures
Google Analytics 4 helps us understand visits, referral and campaign sources, engagement, device/browser characteristics, and interactions with listings. Google receives connection information, including an IP address, when its tag makes a request; this can be used to derive an approximate city or region. Denying device-location permission does not prevent IP-based approximate location. This is different from the coordinates used by the optional nearby feature.
Our custom listing events contain a public listing ID, whether it is a place or offer, and the map/list surface. The event names are listing_impression, listing_open, website_click, directions_click, and save_listing. Those custom event payloads do not include your Firebase account ID, email address, password, search text, or device coordinates. Saved places associated with your account are a separate feature, not anonymous account data.
Our tag removes query strings and fragments from the page address and referrer it configures, while passing supported campaign labels separately. Google signals and advertising-personalization signals are disabled in the tag configuration. These safeguards do not mean Google receives no data, and a pseudonymous cookie identifier is not a guarantee of anonymity. Read how Google uses data from partner sites and apps.
Cookies, local storage, and retention
Google Analytics may set first-party cookies such as _ga and _ga_X5GQKML02L to distinguish browsers and sessions. Google’s default analytics-cookie lifetime is two years and can refresh on visits; settings and browser restrictions can change the actual lifetime. Cookie lifetime is separate from retention of reports on Google’s servers. See Google’s cookie explanation and analytics data retention.
Side Street also uses browser storage for sign-in state, guest saves, display preferences, and short-lived feature state. Its separate local-activity counter uses a random session identifier and protected event hashes. Hashes older than 35 days are removed during subsequent analytics processing; the aggregate daily totals are kept for trend reporting and are not subject to that 35-day cleanup. Clearing cookies does not delete an account, server-side analytics already collected, or a newsletter subscription.
Your privacy choices
You can browse without registering, decline or revoke device-location permission, remove saved items and recommendation votes, and unsubscribe using the link in a newsletter. In your account, open Password & account settings and choose Delete Side Street account to begin deletion. Account deletion and newsletter unsubscribe are separate actions. Contact us if deletion fails or you need help with a data request.
Where your browser supplies the signal, our Google Analytics tag respects Do Not Track and Global Privacy Control. The separate local-activity and advertising counters exclude Do Not Track; Global Privacy Control is not an all-services opt-out. You can use browser or content-blocking controls to block Google Analytics; Google also offers an opt-out add-on for supported desktop browsers. Browser extensions may not control the mobile app’s embedded browser. The current version does not offer an in-app analytics consent switch. Clearing cookies alone does not prevent new cookies on a later visit.
Who helps operate Side Street?
Google Firebase handles authentication; Google Analytics provides usage reporting; Sender handles the optional newsletter; Stripe handles advertiser checkout; and Cloudflare provides hosting and database services. Map tiles come from OpenStreetMap, and pages can request fonts from Google Fonts. Requests to these providers transmit technical information needed to deliver the service, such as a network address and requested resource. Provider security or delivery processing is separate from the limited fields in Side Street’s analytics tables. Providers may process data in the countries where they operate.
Following a business website, directions, reservation, delivery, or other external link takes you to another service with its own privacy practices. Newsletter open/click measurements are also separate from Google Analytics and may be associated with a subscriber. More detail about each Side Street feature follows.
Business submissions
When you submit a business through /expand, we store the business details, public links, your name, email, relationship to the business, review status, and a protected IP-derived value for abuse prevention. Your contact name and email are private to the owner review team. Only reviewed business details may be published. Submission is not newsletter signup and does not guarantee a listing or an area launch. Contact joe@sidestreetpgh.com to request a correction or removal.
Offers submitted by businesses
When a business submits an offer, Side Street stores the business name, area, optional address, offer details, dates, recurring schedule, optional website link, contact email, and a privacy-protected abuse-prevention token. The operator may also record a business contact name, phone number, and verification notes from a call or official source. Contact information, internal notes, and abuse-prevention tokens are not shown on public listings. Submissions stay pending until reviewed; only approved, current offers appear on the public feed.
Browsing and saved offers
Search filters are used to find published offers. You can browse without an account. Guest saves stay in your browser. If you register, Google Firebase Authentication manages your email/password credentials and sends verification and password-reset emails. Side Street stores your Firebase user identifier, verified email, display name, and the places and offers you save in its existing database. Account saves are private to your account and sync across devices. Location is optional and is never included in account saves.
Community recommendations
Members with a verified email can recommend or not recommend a place based on their own experience. We store one vote per member and place, plus creation and update dates. Your individual vote and account identity are not shown publicly. After at least five member votes, Side Street displays the percentage recommending the place and the total vote count. You can change or remove your vote from the place details. Deleting your account also deletes your votes. These recommendations come from Side Street members and are separate from ratings on other services.
The Daily Rundown newsletter
Newsletter signup is optional and separate from your Side Street account. Sender processes your email address, signup and confirmation details, delivery status, and unsubscribe preferences to operate the Daily Rundown. You join by submitting the signup form and confirming your email. Every edition includes an unsubscribe link. Newsletter opens and link clicks may be measured by Sender; these measurements are separate from the site analytics described below. Creating a Side Street account does not subscribe you to the newsletter.
Local activity analytics
Side Street records aggregate business and deal card views, detail opens, website and directions clicks, and successful save actions to understand which listings are useful. A random session identifier in session storage prevents repeat counts; it is not linked to your Firebase account. The server stores protected event hashes that are deleted after 35 days during subsequent analytics activity and daily totals without session identifiers. A short-lived protected network token limits abuse; raw network addresses, search text, precise location, and email addresses are not stored in these analytics tables. The owner dashboard also shows aggregate counts of current account saves, without identifying who saved them. Signed-in admin browsing and browsers with Do Not Track enabled are excluded. Google Analytics is described separately below.
Google Analytics
Side Street uses Google Analytics 4 to measure visits, traffic sources, engagement, and listing interactions such as views, detail opens, website clicks, directions clicks, and saves. Google may use first-party analytics cookies and browser/device information to estimate visitors and sessions. Our custom listing events send the public listing identifier, listing type, and map or list surface; they do not include your account identifier, email, search text, or precise location. The page address and referrer configured by our tag exclude query strings and fragments; supported campaign labels are passed separately. Advertising personalization and Google signals are disabled in our tag configuration. We exclude signed-in administrator sessions, account and admin pages, previews, and browsers indicating Do Not Track or Global Privacy Control. You can also block analytics through browser controls or the Google Analytics opt-out add-on. See how Google uses information from partner sites.
Advertising and payments
Advertisers use a verified account to create campaigns. Side Street stores business and contact details, creative images, campaign dates, approval records, payment references and aggregate campaign views and clicks. Stripe processes payments and provides billing and receipts; Side Street does not receive or store card numbers. Payment and campaign records may be retained for accounting, refunds and dispute handling after account deletion. Account deletion pauses your campaigns. Advertising analytics use short-lived protected network and browser hashes to limit duplicate counts; raw network addresses are not stored in the advertising tables. These hashes expire after one day and are removed during subsequent event processing. The welcome advertisement uses a browser timestamp to limit how often it appears. Do Not Track and signed-in administrator browsing are excluded from advertising analytics.
Account security and recovery
The Firebase SDK keeps your sign-in state in browser storage and refreshes short-lived identity tokens. Side Street verifies those tokens on its server and checks the Firebase account’s current status before granting account access. Verify your email before activating saved-deal syncing. Firebase handles password changes and recovery; previous Side Street recovery keys no longer work. Legacy account records and saved deals are retained for migration. After you verify the same email, the existing saved deals are linked to your Firebase identity and the old password hash and recovery key are removed. You can delete your Firebase sign-in, local account, and saved places and offers from account settings. Guest saves can be cleared in your browser. Firebase is used for authentication only. The separate Google Analytics website tag is described above.
Map view and optional location
The map uses Leaflet and map tiles from OpenStreetMap. The tile provider receives your network address and requests for the map areas you view. Device location is requested only when you select “Use my location”. Coordinates stay in this browser tab’s session storage for up to 30 minutes so Map and List can use the same nearby ordering. They are cleared when the tab session ends or you clear nearby location, and are not sent to Side Street’s servers. Moving the map to your location requests tiles for that area, which can reveal an approximate viewing location to the tile provider. You can browse the map without granting location access. Business pins are approximate address locations, stored once per business.
How information is used
Submission information is used to review an offer, contact the submitting business, prevent spam, and operate the service. Side Street does not sell submission contact information. Please do not include sensitive personal information in an offer.
Place and offer corrections
If you report an outdated offer or suggest a place correction, we store the place or offer reference, your report, any supporting source you provide, its date, and a protected abuse-prevention token. Reports are visible only to the administrator. Please do not include sensitive or personal information.
Requests and changes
Use the form below to request a correction or removal. The request and associated offer details are visible only to the Side Street operator. Offers may be taken down if they expire, are inaccurate, or can no longer be verified.
Privacy request
To correct or remove a business submission, tell us which business and use the same email address used for the offer.
We update this notice when our practices change. For questions or requests about personal information, contact joe@sidestreetpgh.com. The form above is for listing corrections or removal, not account deletion.