Your data, in plain English
Version 1.1 · Last updated 1 October 2026
The short version of our Privacy Policy, for anyone who wants the gist in a minute. Everything here is true, but the full policy is the one that governs.
The four things worth knowing
- We do not track you. No analytics, no advertising pixels, no third-party trackers. That is also why you have not been shown a cookie banner.
- We do not sell your data. Not to anyone, not ever.
- You do not need an account. No email, no password, no app. Your first name is the only thing we ask for, and you can skip it.
- You can leave whenever you want, and we will delete what we hold.
What we know about you
Your first name (optional)
- Why
- So the café can greet you by name. You can leave it blank and still get a card.
Your stamp count and reward status
- Why
- It is the loyalty card. Without it there is nothing to show you.
A record of each stamp, with the date and which staff member gave it
- Why
- It is the till-side audit trail that makes stamps hard to fake, and it is how a mistaken stamp gets undone rather than deleted.
Your card's code (the number behind the QR)
- Why
- It is what the barista's scanner reads. Anyone holding it can see your card, so treat it like the card itself.
Which wallet you saved the card to, and a push token if you saved it
- Why
- So your card updates itself the instant you are stamped, instead of you refreshing a page.
Messages and offers a café has sent you, and whether you switched them off
- Why
- So we can show the message, stop sending when you say stop, and prove afterwards what your setting was.
| What | Why |
|---|---|
| Your first name (optional) | So the café can greet you by name. You can leave it blank and still get a card. |
| Your stamp count and reward status | It is the loyalty card. Without it there is nothing to show you. |
| A record of each stamp, with the date and which staff member gave it | It is the till-side audit trail that makes stamps hard to fake, and it is how a mistaken stamp gets undone rather than deleted. |
| Your card's code (the number behind the QR) | It is what the barista's scanner reads. Anyone holding it can see your card, so treat it like the card itself. |
| Which wallet you saved the card to, and a push token if you saved it | So your card updates itself the instant you are stamped, instead of you refreshing a page. |
| Messages and offers a café has sent you, and whether you switched them off | So we can show the message, stop sending when you say stop, and prove afterwards what your setting was. |
That is the whole list. We do not have your email address, your phone number, your location, or anything you bought other than the fact that a stamp was given.
Who else sees it
Supabase
- What reaches them
- Everything described above
- Where
- Sydney, Australia
Vercel
- What reaches them
- Every request to the site, including IP addresses and server logs
- Where
- Sydney, Australia
Resend
- What reaches them
- A café account holder's email address, for password resets only. No customer data is ever sent here.
- Where
- United States
Apple
- What reaches them
- Your device's push token. Apple is told a card changed, never what changed.
- Where
- Apple's global network
Google
- What reaches them
- Your first name, your stamp count, your card's code, and the café's details
- Where
- Google's global network
| Who | What reaches them | Where |
|---|---|---|
| Supabase | Everything described above | Sydney, Australia |
| Vercel | Every request to the site, including IP addresses and server logs | Sydney, Australia |
| Resend | A café account holder's email address, for password resets only. No customer data is ever sent here. | United States |
| Apple | Your device's push token. Apple is told a card changed, never what changed. | Apple's global network |
| Your first name, your stamp count, your card's code, and the café's details | Google's global network |
They run the service for us and cannot use your information for their own purposes. Your data is stored in Sydney, Australia — we are a New Zealand operation, but the servers are across the Tasman.
Messages, and switching them off
Your café can send you the occasional offer through your card, which can show on your lock screen if you saved the card to your wallet.
To stop it: open your card, tap Manage this card, and untick the offers box. Immediate, reversible, and it does not touch your stamps.
Getting your data, or getting rid of it
To delete your card, open it, tap Manage this card, then Delete this card — two taps, no email, removed from our database immediately. For a copy of what we hold, email rasouli9ali@gmail.com; we answer within 30 days, at no cost. Full instructions are on Delete or request your data.
Email rasouli9ali@gmail.com. We answer within 30 days, and usually much sooner. Ali Reza Rasooli, Auckland, New Zealand. We will give you our full postal address on request.