Privacy Policy

Effective 12 August 2026 · applies to the LootLocal iOS, Android, and web apps.

LootLocal is a local loyalty network: you hold shops' loyalty cards in one wallet, earn points for verified visits, and spend them on discounts. This policy explains what we collect to make that work, and nothing here is sold to anyone.

What we collect

  • Account: your email address, display name, and — if you add one — a profile photo.
  • Loyalty activity: the cards you join, steps you complete, points earned and spent, rewards won, and store orders (including a shipping address when you buy a physical item).
  • Approximate location (optional): only when you allow it, to sort nearby shops by distance. It is used on-device and never stored on our servers.
  • Camera (optional): to scan a shop's check-in QR code. Images are processed on-device; nothing is uploaded from the scanner.
  • Device push tokens: if you enable notifications, so we can tell you when you win a reward.
  • Merchant business data: for shop owners — business registration documents, VAT details, and shop photos, reviewed by our team to approve the shop.
  • Diagnostics: crash reports, so we can fix bugs.

Who processes it

Data is stored with Supabase (database, authentication, file storage). Payments are processed by Stripe — card details never touch our servers. Crash reports go to Sentry. When you tap a partner shop, you leave our app for the partner's site under their own privacy policy; we pass an anonymous reference (never your email or identity) so your purchase can earn points.

What we never do

  • Sell or rent your personal data.
  • Show third-party advertising or share data with ad networks.
  • Track your location in the background.

Your rights

You can edit your profile in the app, and delete your account (and all associated data) from Settings → Delete account — this is immediate and irreversible. Depending on where you live (e.g. GDPR), you may also request a copy of your data or corrections by contacting us.

Retention

Account and loyalty data are kept while your account exists and deleted with it. Payment records are retained as required by tax and accounting law. Merchant application documents are kept while the shop is on the platform.

Children

LootLocal is not directed at children under 13 (or the higher minimum in your country) and we do not knowingly collect their data.

Contact

Questions or requests: privacy@lootlocal.app

Changes to this policy will be posted at this address with a new effective date.