Effective Date: November 8, 2026 · Version v2026.11.08-1
This Privacy Policy explains how Coam Tracker, LLC ("Coam Tracker," "we," "us," or "our") collects, uses, and shares information in connection with the Coam Tracker™ application and website (the "Service"). By using the Service, you agree to the collection and use of information as described here.
Account information: when you or your business creates an account, we collect your email address, a chosen username, your store name, and a password, and — depending on how you sign up — your name, your store's address, and a phone number where we can reach you. If you enter your COAM location license number, we keep it with your account; at signup, the Service may use the Georgia Lottery Corporation's public list of location licensees to fill in your store's name and address from that number, and you can correct anything it fills in. If you sign up as a Master licensee, we collect the Master license number (looked up on the Georgia Lottery Corporation's public list of Master licensees to fill in your company name and address), your name, phone number and email, and the number of locations in your plan; see Section 5A. If you add staff members, we collect the names you enter for them. All PINs (yours and staff members') are stored only as one-way cryptographic hashes — we do not store or have access to any actual PIN.
Transaction and business data: information you enter while using the Service, including redemption amounts and categories (such as lottery, gift card, and replay redemptions), gift card codes and balances — covering both gift cards issued as part of a redemption and ordinary retail gift cards a store sells, which the Service records separately — and daily Total In / Total Out reconciliation figures. The Service also runs simple checks on your own gift card records to point out unusual activity to the store owner; those checks use only your store's records and are shown only to your store. This data belongs to you; see Section 5.
Product inquiries and demo requests: if you fill out the sign-up form on our website, the short form shown before opening a product demo, or the "Questions / Upgrade" form inside a product demo, we collect the name, phone number, email address, store name, and store address you provide, along with any message you send. We use this information to respond to you, and we may keep simple internal notes about our conversations with you, including which channel (for example, a messaging app or search engine) brought you to our website. Personalized demo links contain a random, non-guessable token rather than your personal details.
Events: at trade shows, we may ask for your name, phone number and email on our check-in or prize-drawing page, to enter you in the drawing and follow up with you about the Service.
Public business records: we use public business records, such as the Georgia Lottery Corporation's published lists of licensed locations and Master licensees, to fill in sign-up forms, to show the Market page in the Master Portal, and to plan visits and reach out to businesses that may want the Service. These lists contain business names and addresses.
Customer gift card wallet: store customers may choose to keep gift cards on their phone using the Service's wallet page. A wallet is identified only by a random secret token stored on the customer's own device — we do not collect a wallet customer's name, phone number, email address, or any account information. The wallet shows only the gift cards a store has assigned to that token and their history. When a store redeems a wallet card, the customer receives an approval request on their device showing the amount before the redemption can complete.
Payment information: when you subscribe, payment is handled directly by our payment processor, Stripe. We do not receive or store your full card number. We retain a record that a payment was made, the plan selected, and billing history.
Device and usage information: basic technical information such as browser type, device type, and general usage of the Service, collected automatically to operate and improve the Service. This includes simple account-activity records, such as the time an account was last signed in or active ("last seen"), the app version in use, and small account preferences such as whether you have already seen an in-app notice, which we use to support you and troubleshoot problems. We also count visits to our public website: daily totals of page views and visitors, which page was viewed, whether the visit came from a search engine, a social or messaging app, or a link we shared (based on the referring site or a tag in the link), and whether a phone or a computer was used. These counts contain no names, no personal details, and no tracking across other websites. The store app, the customer wallet and our website do not collect precise location. The Field Tech app saves a phone's location only at the moment a technician scans (Section 5A).
Error reports: if the Service encounters a technical error on your device, we automatically collect a limited report (the error message, the app version, your store name, the screen involved, and browser type) so we can find and fix problems. These reports are kept in our system for about 60 days and are not used for any other purpose; short summaries of them (for example, "2 open errors at one store") may stay longer in our private work notes.
Phone alerts: if you turn on phone alerts, your browser gives us a delivery address for that device, plus the browser type. We use it only to send the alerts you chose — for example, a gift card sold by an employee, a cashier asking the owner to open the Inspector Report, or a new job for a technician. Your browser maker's push service (such as Google, Apple, Microsoft or Mozilla) delivers them. You can turn alerts off in Settings or in your phone's settings. In the store app, signing out removes alerts for that phone; in the Master Portal and the Field Tech app, turn alerts off in Settings.
Ticket photos: when a cashier scans a winning ticket, the Service keeps the picture with that redemption record. It may show the machine number, date, time, and amount printed on the ticket. The picture is stored in private storage that only that store's account can access. Ticket photos are business records of the store, are kept like the store's other records, and are never used by Coam Tracker for any other purpose.
Ticket scanner: the ticket is read on your own device. The picture is then saved as described above.
Receipt photos (optional): when a gift card is redeemed, a store can attach a photo of the sales receipt. It is stored with that redemption in private storage that only that store's account can open, and it is kept like the store's other records.
Store documents (optional): a store's Admin can keep a photo of the store's COAM location license, a photo of the master's license, and a photo or PDF of the store's agreement with its master, along with the agreement's signed date, end date, and the master's name. These files may contain names, signatures, or other details that appear on the documents. They are stored in private storage that only that store's account can open; nothing in our administrative tools shows them, and we do not open them except to fix a problem you ask us to fix, to look into misuse or a security problem, or when the law requires. If the Admin turns on reminders, we send email reminders to the store's own address before the agreement's end date (on the dates the Admin picks — for example, two years, one year, six months, three months, one month, or fifteen days before), and the Monday weekly summary email may also show how many days remain. If the Admin turns on the quarterly report reminder, we also email the store before each Georgia Lottery quarterly sales report is due. Reminders can be turned off at any time in Settings. Store documents are deleted when the account is deleted.
We use the information we collect to provide, operate, and maintain the Service, including your account, reports, and gift card features; to process payments and manage your subscription; to respond to product inquiries and demo requests; to send you service-related emails such as account confirmations, password reset links, and billing notices; to send report emails and reminders (the daily report email is turned on when you sign up and goes to your sign-up email; you can turn it, and the weekly and monthly report emails, contract reminders and quarterly report reminders, on or off and change where they go in Settings); to let the store owner know when the app has not reached us for 24 hours or more, or when a cashier asks the owner to open the Inspector Report; to send phone alerts you turn on; to tell you from time to time about new features or offers (you can ask us to stop at any time; see Section 6); to detect, prevent, and address technical issues, fraud, or misuse of the Service; and to communicate with you about the Service, including updates to these policies.
We do not sell your personal information, and we do not use your business or transaction data to market to your customers.
What we look at. To run, secure, bill, and support the Service, our administrative tools show us account-level information about each store: plan and renewal status, when the account was last used, how many redemptions and gift cards it has recorded, and the total number and combined balance of gift cards still outstanding. Those tools do not list your customers, your individual gift cards, or your individual transactions. We access the underlying records only when needed to provide or support the Service at your request, to find and fix a problem in the Service, to investigate misuse or a security incident, to meet a legal obligation, or to honor outstanding gift cards during a wind-down.
We rely on a small number of providers to operate the Service: Stripe (payment processing for store and Master plans — they receive your payment details directly; we never receive or store your full card number); Supabase (database hosting, sign-in and private file storage); Resend (delivery of account, billing, report, reminder and statement emails); Cloudflare (website hosting and delivery); GitHub (keeps our locked, encrypted nightly backup copies and runs automated checks of the Service; the error summaries those checks produce may include a store name); Google Maps Platform (address suggestions and maps: the address text you type, and the area shown on a map in the Master Portal, are sent to Google, and Google's own privacy policy applies); Google Fonts (some of our pages load typefaces from Google, which receives your device's IP address and browser type when they load); Zippopotam.us (when you type a ZIP code, it is sent to this service to fill in the city and state); your browser maker's push service (delivers phone alerts you turn on); and Anthropic (AI tools that help us build, maintain and support the Service, and may process information needed for that work).
We send each provider only what it needs for its job, and we choose providers whose terms or policies limit how they use the information they receive.
Your redemption and gift card records are your records; we store them for you. We do not send them to the Georgia Lottery Corporation, any regulator, or law enforcement on our own, and we do not share store-level data between stores. If we receive a subpoena, court order, or other lawful request from a regulator or law enforcement for records relating to your store, we will comply only to the extent the law requires, will limit what we produce to what is requested, and will notify you before or promptly after producing records unless the law or the request prohibits notice. You may produce your own records to a regulator at any time using the export and report features in the Service; we recommend you do so yourself when asked, rather than directing the regulator to us.
If Coam Tracker is sold, merged, or reorganized, your information stays protected by the commitments in this Policy, and we will tell you before it does.
We use reasonable administrative and technical safeguards to protect your information, including encrypted connections (HTTPS), password hashing, PIN hashing, and database-level access controls that restrict each account to its own data. The Service uses a multi-tenant design: customer data is stored in a single shared database, and row-level security rules enforced at the database layer are designed so that each store's account can see only its own data. Our nightly backup copies are locked with encryption before they leave the database. Gift card codes are masked throughout the Service's lists and reports after issuance, and personalized demo links and customer wallets use random, non-guessable tokens. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident that compromises your personal information, we will investigate promptly and notify affected customers without undue delay and in accordance with applicable law.
You own the business and transaction data you enter into the Service, including data entered during a free trial. You may export your data at any time using the Service's built-in backup and export features. If you use a free trial and then subscribe, the Service offers you a one-time choice to keep your trial-period records or begin with a clean ledger; if you choose a clean ledger, the trial-period records are moved into a sealed archive that only Coam Tracker can access, are retained there for as long as applicable record-keeping laws require, are used for no other purpose, and are then deleted.
Voided transactions are retained, rather than permanently deleted, for audit-trail purposes consistent with recordkeeping practices for regulated activity such as lottery and gift card redemptions; voided records are excluded from your reports and totals but remain visible to you in the Service's Voided Records view.
For store accounts: if you cancel, your account enters a limited free mode in which your records remain available to you read-only and previously issued gift cards can still be redeemed. We retain your data so long as your account exists, subject to standard backup retention cycles and any legal obligation to retain records longer. Because redemption records may be subject to state record-keeping requirements for regulated activity, transaction records are kept in an immutable form for as long as applicable record-keeping laws require: they can be voided with an audit trail but cannot be edited or erased through the Service.
A store may permanently delete its account itself, at any time, from Settings inside the app (Master accounts: see Section 5A). You do not need to contact us and no approval is required. Before anything is deleted, the app offers you a download of your records and directs you to cancel billing; deletion then requires your password and a typed confirmation. When a deletion completes, the account's login and all of its business data — transactions, gift cards and their history, machine report entries, daily reconciliation records, staff records, store documents, and the backup snapshots you made in the app — are permanently erased from our active systems within 30 days. Backup copies made before the deletion age out and are deleted within 90 days. The exception is COAM ticket redemption records: Georgia rules require a store to keep them for at least five years from the transaction date, so we keep a detached copy for that period (the duty to keep them stays the store's) — detached from your closed account and used for no other purpose — and then deleted. Billing records we need for taxes are also kept for as long as tax law requires. Deletion cannot be undone by you or by us. We may decline or defer deletion of records we reasonably believe you or we are legally required to retain, and we will tell you if that is the case. If you cannot sign in — for example, you have lost your password — you can instead ask us to delete the account by emailing [email protected] or calling (404) 992-8675, and we will verify who you are before acting.
If gift cards are still outstanding when you delete. Gift cards your store has issued or sold are a promise to the person holding them, and deleting your account does not cancel that promise. If any card still carries an unredeemed balance when you delete, your account does not close right away: it enters a wind-down in which redeeming those existing cards is the only function that still works, and we keep the account's records for exactly that purpose and no other. Those cards do not expire, and we do not delete them on a timer. When the last balance reaches zero the account and its data are deleted automatically. We keep this data because it is the minimum needed to honor an obligation your store owes to its customers; we do not use it for anything else.
Selling your business. Accounts are not transferable, and you should never share your login with a buyer — doing so would give them your full transaction history, your gift card records, and the names of the staff members you entered. A buyer opens their own account. We treat whoever holds your account credentials as authorized on the account, which is why keeping them to yourself matters.
Other records we keep: error reports, about 60 days; phone-alert registrations, until the alert is turned off (in the store app, also when that phone signs out); website, event and demo inquiries, until you ask us to delete them; website visit counts, as daily totals only, with no personal details.
If you use the Master Portal or the Field Tech app (for Master licensees and the people who work for them), here is what we collect and who sees it:
You can access, update, or export most of your account and business data directly within the Service, and you can permanently delete your account yourself from Settings inside the app, as described in Section 5 (or ask us to do it if you cannot sign in). You can turn report emails, reminders and phone alerts off in Settings (or turn alerts off in your phone's settings). To stop emails about news and offers, reply "stop" to one of them or email [email protected], and we will stop. You will still receive messages needed to run your account, such as receipts, billing notices and changes to these policies.
The Service uses browser local storage and similar technologies to keep you signed in, remember your preferences (such as theme), and support offline functionality. The customer wallet page stores its secret wallet token in the customer's own browser storage, and our website stores a small "already counted today" marker so a visitor is not counted twice in one day, plus a marker for the current browsing session that remembers where the visit came from so we do not count the same visit as arriving from two places. We do not use third-party advertising cookies.
The Service is intended for business use by adults operating a retail store and is not directed to children under 18. We do not knowingly collect personal information from children.
We may update this Privacy Policy from time to time. We will post the new version at coamtracker.com/privacy with a new effective date, and we may also tell you in the app or by email. The "Effective Date" above reflects the latest revision.
Questions about this Privacy Policy may be directed to: [email protected].
© 2026 Coam Tracker, LLC. All rights reserved. "Coam Tracker"™ and the Coam Tracker logo are trademarks of Coam Tracker, LLC.