Who we are
IHG Points Finder ("IHG Points Finder", "we", "us") is an independent analytics tool that compares cash rates with IHG One Rewards redemption value. This policy explains what we store, why we store it, and the rights you have under the EU General Data Protection Regulation (GDPR) and the UK GDPR.
For privacy requests, contact [email protected]. We answer verified requests within one month.
What we store in your browser
IHG Points Finder is designed to work without an account. Most data stays in your own browser's local storage, and the server only receives what is needed to return prices and alerts.
Your anonymous user id
On first use we generate a random identifier and store it as ipf.userId in local storage. The application sends it on requests as the X-IPF-User-Id header. It is not your name, email address, or IHG account number. We use it to keep your watches, guardians, saved searches and entitlement lookups together. Clearing site data creates a new id.
Optional alert contacts
If you choose to receive alerts, we store the contact details you enter in your browser as ipf.notifyEmail and ipf.notifyWebhook. When you save a watch or guardian you can also attach a per-watch or guardian-specific alert email or webhook, and those values are stored with that watch or guardian so the alert worker knows where to send the notification. Email and webhook contacts are optional; you can leave them empty and use in-app notifications only. You can clear or change them at any time in the watch or guardian editor, or by clearing site data.
Other browser storage
We keep recent searches, display preferences and dismissed hints in your browser so the app remembers your choices. These values never leave your device unless a feature explicitly sends them with a request you make.
If account authentication is enabled on this deployment, a signed session cookie (vw_session) keeps you signed in. It is a strictly functional cookie, not an advertising or analytics cookie. Advertising cookies are set only if you accept them, as explained below.
Cookies, Google Ads and Google Analytics
We use Google Ads, provided by Google Ireland Limited, to measure whether our ads lead to visits, sign-ups and purchases. The Google tag loads on every page with all advertising and analytics storage denied by default, so Google Ads cookies are not set unless you click Accept in the cookie banner. We also use Google Analytics, from the same provider, to count visits and see which pages people use. It follows the same choice: Analytics cookies are set only after you click Accept. Before you choose, or if you reject, Google may still receive basic signals without cookies, such as that a page was viewed. If you arrive from a Google ad, the ad click id in the link (gclid, gbraid or wbraid) is saved in your browser and stored with your sign-up source. Your choice is saved in your browser as ipf.consent, and you can change it at any time with the Cookie settings link in the footer. See how Google uses advertising data.
Alert delivery data
When a watch or guardian fires, we generate a notification and, if you supplied a contact, queue an email or webhook delivery. Delivery records contain the destination you supplied, the notification content, timestamps, retry counts and delivery status so we can show history, prevent duplicate sends and stop future alerts when you unsubscribe. Webhook payloads are signed so you can verify they came from us.
Payments through Stripe
Paid plans are processed by Stripe. When you start a checkout, Stripe collects and processes your payment details, billing address, tax information and fraud signals under its own privacy policy. We receive a checkout session reference, customer identifier, plan and subscription status, and limited payment metadata such as the card brand and last four digits. We never receive or store your full card number or CVC. We keep entitlement records (which user id has which plan and until when) so the paid features work and so we can answer billing questions.
Stripe may process data in the United States and other countries. Those transfers rely on Stripe's own safeguards, including Standard Contractual Clauses where required. See Stripe's privacy policy for details.
Purposes, legal bases and retention
- Provide the service: resolving prices, saving your watches and guardians, and delivering the alerts you ask for. Legal basis: performance of a contract or steps taken at your request before entering one.
- Process payments and maintain entitlements: checkout, billing, fraud prevention and refunds. Legal basis: performance of a contract and our legitimate interests in preventing fraud.
- Operate and secure the service: request ids, rate limiting, error diagnostics and abuse prevention. Legal basis: our legitimate interests in keeping the service available and safe.
- Comply with law: tax, accounting and lawful requests. Legal basis: legal obligation.
Browser storage stays until you clear it. Server-side watches and guardians stay until you delete them or your deployment removes them. Delivery records are pruned after a limited operational window. Billing and tax records are kept for the period required by applicable law. Anonymous rate observations are stored without your user id and are used to compute market-level point values.
Sharing and processors
We do not sell personal data. We share only what is necessary with:
- Stripe for payment processing, subscriptions and billing support;
- our email and webhook delivery providers, for messages you explicitly request;
- Google, for ad measurement and site analytics as described in Cookies, Google Ads and Google Analytics;
- hosting and infrastructure providers that run the service; and
- authorities or courts when the law requires it, or when needed to protect our rights and users.
Processors act on our instructions under written terms. Where data leaves the EU/EEA or the UK, we use an approved transfer mechanism such as the EU Standard Contractual Clauses or the UK International Data Transfer Addendum.
Your data rights
Subject to applicable law, you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, and to receive it in a portable format. Where processing relies on consent, you can withdraw consent at any time without affecting processing already carried out.
These rights apply under the GDPR in the EU/EEA and the UK GDPR in the United Kingdom. To exercise them, contact [email protected]. We may ask for information needed to verify the request; because most data is keyed by a random browser id, clearing site data can make some records unreachable to us.
You also have the right to complain to a supervisory authority. In the EU/EEA this is your local data protection authority; in the UK it is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to resolve your concern first.
Security and children
We use transport encryption, signed webhooks and access-controlled storage. No online service can promise perfect security, so please do not send sensitive personal data through alert contacts. IHG Points Finder is not directed to children under 16, and we do not knowingly collect their personal data.
Trademarks and affiliate disclosure
IHG® and IHG One Rewards® are registered trademarks of InterContinental Hotels Group. IHG Points Finder is an independent analytics tool and is not affiliated with or endorsed by IHG.
Some outbound links may be affiliate links. When a link earns a commission, it never changes the price you pay or the ranking of a hotel in our analysis.
Changes to this policy
If we materially change how we handle personal data, we will update this page and revise the date at the top. Continued use after a change means you acknowledge the updated policy.
Contact
Privacy questions and data-rights requests: [email protected].