Privacy Policy

Account information. Your name (optional), email address, phone number, and a hashed password when you create an account.

Loyalty activity. The stores you join, stamps you earn, rewards you redeem, and store-credit balances and transfers — needed to operate the loyalty wallet.

Location. With your permission, your device location to show nearby stores and to send proximity reminders. You can revoke this anytime in your device settings; the app still works without it.

Camera & NFC. The camera is used only to scan store QR codes; NFC is used only to read registered store tags. We do not record photos or video.

Device & push tokens. A push notification token and basic device/platform info so we can deliver notifications you opt into.

Support content. Messages and any screenshots you attach when contacting support.

To create and operate your account and loyalty wallet; to process stamps, rewards, and store-credit transfers; to show nearby stores; to send notifications and important account, security, and transaction emails you've enabled; to provide customer support; to detect and prevent fraud and abuse; and to comply with legal obligations.

We do not sell your personal data.

We share data only with service providers that help us run PassPunch, under contract and only as needed:

• Stripe - payment processing for business plans, ad placements, and notification credits. We do not store card details.
• Google Analytics / Firebase Analytics - aggregate website and Android app usage analytics. We do not send names, emails, phone numbers, QR tokens, member IDs, or store-credit balances to analytics.
• Supabase — managed database hosting (your account and loyalty data).
• Cloudflare R2 — storage for support attachments.
• Expo / Apple / Google — push notification delivery.
• Resend — transactional email delivery (verification and account/transaction notices).

We also share the limited loyalty information a store needs to recognize you as their member (e.g. your member code and stamp balance at that store). We may disclose information if required by law.

We keep your information for as long as your account is active. When you delete your account, we remove or anonymize your personal data within 30 days, except where we must retain limited records to meet legal, accounting, or fraud-prevention obligations.

You can access and update your profile in the app, control location and notification permissions in your device settings, and delete your account at any time from Account → Delete account in the app, which permanently removes your profile and associated personal data. You may also email us to exercise any data rights available to you under applicable law.

Data is encrypted in transit (HTTPS/TLS). Passwords are stored hashed. Access to production systems is restricted. No method of transmission or storage is 100% secure, but we work to protect your information.

PassPunch is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their data.

We may update this policy from time to time. We'll revise the “Last updated” date above and, for material changes, notify you in the app or by email.

Questions about privacy? Email privacy@passpunch.com or legal@passpunch.com.

Ecomplicity Labs FZC
Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates