Privacy Policy

Effective October 1, 2026

Confetti Labs LLC operates Reset Alerts. This policy explains how we handle information about you.

What we collect and why

Our hosting provider processes technical information, such as IP addresses and request logs, to serve and secure the website. If you contact us, we use your email address and correspondence to respond.

We process your phone number, messages, signup and consent records, subscription status, and delivery information to send requested reset alerts and paid sponsor announcements, provide support, and honor unsubscribe requests.

Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe or HELP for assistance.

Analytics

We use Vercel Web Analytics on the live website to understand visits and improve the service. It provides aggregate statistics about pages viewed, signup-button clicks, successful copies of the signup number, referrers, device and browser details, and approximate location. Vercel Web Analytics does not use third-party cookies. We remove query strings and fragments from page URLs before sending them to analytics.

When you follow a campaign link, we keep its campaign tags in session storage for the current tab, with an in-memory fallback if storage is unavailable. Browser session restoration may retain this information. New campaign arrivals replace the previous tags. We send only campaign and creative labels to Vercel, including for confirmed first signups. We remove query strings and fragments from analytics URLs and never send Vercel phone numbers, message contents, SMS consent records, or advertising identifiers.

X advertising measurement

Where browser advertising tracking is allowed, the X Pixel measures visits and signup-button clicks. X may receive technical information such as your IP address, page URL, browser details, cookies, and its click identifier. We disable the pixel’s automatic click collection, dwell tracking, automatic advanced matching, and data-layer tracking. Our explicit browser events do not include phone numbers, phone hashes, or message contents.

Server-side signup reporting is controlled separately and is currently off. When enabled and permitted under its separate eligibility rules, it can send confirmed signups and X click identifiers, plus a SHA-256 phone-number hash for matched SMS signups. A hash is a matching identifier, not anonymous data; X can match it to an account to measure and improve advertising. Raw phone numbers and message contents are not sent to X.

SMS and Telegram matching infer a connection between a recent button click and an incoming START message or observed channel join. These matches and their associated privacy choices can be wrong; they are not verified identity or verified advertising consent. Signup works without advertising tracking, and SMS subscription consent does not itself grant consent to advertising tracking.

Browser X tracking requires acceptance in the EU/EEA, UK, Australia, and Québec. In Canada it is automatic only when our hosting provider identifies a valid province or territory outside Québec from your IP address. Missing or unrecognized countries and Canadian provinces require acceptance. Other recognized countries use automatic tracking with a notice and an opt-out. You can accept browser tracking from any location, or turn it off through the notice or Ad privacy choices in the footer. We always honor Decline and Global Privacy Control, including when you previously accepted.

Browser permission does not extend server-side signup reporting. Its existing regional rules permit US visitors unless they opt out and EU/EEA/UK visitors only after acceptance; other or unknown locations remain ineligible. Declining or withdrawing stops future browser advertising events and suppresses queued signup reporting associated with your browser. It cannot recall data already sent or requests already handed to X. A choice on another browser or device cannot be linked automatically.

We keep a versioned privacy choice for six months and campaign identifiers and signup attribution associations for up to 30 days. Minimal records of button clicks help avoid attributing someone else’s signup to an ad, even when X tracking is off; those records omit X identifiers. We retain necessary signup deduplication and non-identifying diagnostic records afterward. We also retain a simple estimated acquisition source and category, such as Google / Organic search, with the original subscriber signup record. This summary excludes referrer URLs, campaign names and click identifiers and remains after the underlying 30-day attribution data expires. We do not record browsing sessions.

Who processes information

Providers process information on our behalf to host the website, deliver texts, provide support, and measure usage. These include Vercel for hosting and analytics, Neon for data storage, Twilio for SMS delivery, Telegram for channel alerts, and X for the advertising measurement described above. We limit their access to what they need for those tasks. Information may also be disclosed when legally required.

We do not sell or rent subscriber lists or share SMS opt-in consent records with sponsors or affiliates. Where allowed by your advertising privacy choices, we share the matching identifiers described above with X for advertising measurement; this may be considered sharing for targeted advertising under applicable US privacy laws. You can opt out using Ad privacy choices.

Retention and protection

We keep information only as needed to run the service, resolve requests, meet legal obligations, and retain necessary consent and unsubscribe records. Information may be processed outside Canada, including in the United States, where laws differ. We use reasonable safeguards, including encrypted connections and limited access. No system is perfectly secure.

Your choices and policy changes

Email us to request access, correction, or deletion, or to ask a privacy question. We may verify your identity and retain records required by law or needed to respect an unsubscribe request. Reply STOP to unsubscribe.

We will update this page and its effective date when our practices change. We will give notice of material changes through the website or a service message before they take effect, and seek fresh consent where required.