Privacy policy
Stampy (stampy.ae) gives cafés and food shops digital loyalty cards. We built it to collect as little personal data as possible. This policy explains what we store, why, and what you can ask us to do with it.
If you are a customer with a loyalty card
We never ask for your name, phone number or email address. Your card is a set of random codes.
| What we store | Why |
|---|---|
| Random codes for your card: one inside your QR, one that lets this phone open your card, and your recovery code. We keep only scrambled (hashed) versions of them. | To recognise your card at the counter and let you restore it on a new phone. |
| For each shop you join: a member code for that shop, your stamps or points, and the date, amount and number of items of each visit, as entered by the shop's staff. | To track your progress toward rewards and stop the same card being used unfairly. |
| Your card codes, saved in your phone's browser. | So your card opens when you visit the site. You can delete them by clearing the site's data in your browser. |
Each shop sees only its own activity. A shop sees your visits there under a member code that is different at every shop. Shops cannot see which other shops you visit, and we never give them a way to identify you.
If you are a shop owner or staff member
- Owners: email address and password (stored only in a protected, hashed form), shop name, logo, colour, card messages, branches and reward rules.
- Staff: a name chosen by the owner and a 6-digit PIN (stored only in a protected form), plus a record of the visits and rewards each person recorded.
Cookies and technical data
- Owners and staff get one sign-in cookie, which is needed to stay signed in. We use no advertising or tracking cookies.
- We use IP addresses briefly to block abuse, such as repeated wrong PINs. These records are deleted automatically, usually within a day.
- Our hosting provider, Cloudflare, processes requests to run the site. Pages load fonts from Google Fonts, and the counter's camera scanner may load a code library from jsDelivr. These providers receive your IP address when that happens.
What we never do
- We don't sell data or share it with advertisers.
- We don't show ads or build profiles of customers.
- We don't let one shop see another shop's data.
How long we keep data
We keep card and visit records while the shop uses Stampy. If a shop closes its account, its data is deleted. Expired sign-ins and one-time links are removed automatically every day.
Your choices
You can ask us to delete your card and its history at any time. Because we don't know who you are, include your recovery code so we can find the card. Owners can ask for a copy of their shop's data or for their account to be deleted. We aim to handle personal data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).
Changes to this policy
If we change how we handle data, we'll update this page and the date at the top. For important changes we'll tell shop owners by email first.
Contact
Questions or requests: support@stampy.ae