1. Who we are
Loyalty Cards is a digital loyalty card platform for coffee shops. It is operated by Digital Loyalty Cards (referred to as "we", "us", or "our" in this policy). You can contact us by email.
2. What information we collect
We collect only the information needed to operate the loyalty card service.
Information you provide
- Name — entered when you register for a loyalty card at a coffee shop.
- Email address — used to issue your digital wallet pass and to send service-related messages (such as your wallet pass link or a free-drink confirmation). We do not send marketing emails.
Information generated automatically
- Stamp log — a timestamp is recorded each time a stamp is added to your card. This is used to maintain your stamp count.
- Device and push token — if you add your loyalty card to Apple Wallet or Google Wallet, an anonymous device identifier and push token are stored so that your card can be updated when a new stamp is added. No personal data is contained in these tokens.
- Session cookie — a short-lived session cookie is set when coffee shop staff or administrators log in with a PIN. This cookie does not track customers and expires when the browser session ends.
3. How we use your information
- To issue and maintain your digital loyalty card.
- To send your Apple Wallet or Google Wallet pass link by email at registration.
- To push stamp updates to your wallet pass in real time.
- To notify you by email when you have earned a free drink (transactional only).
- To allow the coffee shop you registered with to see your name, email, and stamp count in their dashboard so they can manage the loyalty programme.
We do not use your data for advertising, profiling, or any purpose beyond operating the loyalty card service.
4. Who we share your data with
We do not sell your personal data. We share it only with the service providers necessary to operate the platform:
- Railway (application and database hosting, United States) — runs the web server and the Postgres database that store your name, email, stamp records, and device tokens. Railway Privacy Policy.
- Apple— if you add your card to Apple Wallet, your push token is registered with Apple's Push Notification service (APNs) so your card can update. Apple Privacy Policy.
- Google — if you add your card to Google Wallet, your pass is managed via the Google Wallet API. Google Privacy Policy.
- The coffee shop you registered with— the shop's staff can see your name, email address, and stamp count in their management dashboard. They cannot see data from other shops.
5. Data retention
We retain your personal data for as long as your loyalty card is active. If a coffee shop deletes your card record, or you request deletion, your name, email, and stamp history are removed from our database. Push tokens associated with your device are deleted at the same time.
6. Your rights
You have the right to:
- Access — request a copy of the personal data we hold about you.
- Correction — ask us to correct inaccurate data.
- Deletion — ask us to delete your account and all associated data.
- Objection — object to us processing your data in a specific way.
To exercise any of these rights, email us. We will respond within 30 days.
7. Cookies
We use one strictly necessary cookie: a session cookie set when coffee shop staff or administrators authenticate with a PIN. This cookie holds no personal customer data, is not used for tracking, and expires when the browser is closed. We do not use advertising cookies or third-party analytics cookies.
8. Security
Data is stored in a managed Postgres database (Railway) with encrypted connections. Stamp URLs are individually signed with HMAC-SHA256 to prevent forgery. Staff stamp access requires a PIN. We apply reasonable technical measures to protect your data, though no internet transmission is 100% secure.
9. Children
This service is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has registered, please contact us and we will delete the data promptly.
10. Changes to this policy
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the service after a change constitutes acceptance of the updated policy.
11. Contact
Questions about this policy? Contact us.