Your data, kept simple.
This policy explains what information the Pokkee app, the Pokkee Business app and getpokkee.com collect, why, and the choices you have.
Last updated: 24 September 2026
Who we are
Pokkee ("we", "us") runs a rewards platform that lets customers keep points from participating shops in one place, and lets shops run their own points program. This policy covers the Pokkee app (for customers), the Pokkee Business app (for shops) and this website. Questions? Email hello@getpokkee.com.
Information we collect
Account information
- Your name and mobile number. You sign in with your mobile number and a one-time code we send on WhatsApp.
- Older accounts may also have an email address and a password. We only store a secure one-way hash of a password, never the password itself.
- Optional details you choose to add, such as your birthday and a profile photo.
Rewards activity
- Points you earn and redeem, the shop involved, amounts, and when it happened.
- Which shops you have a balance with.
Shop information (Pokkee Business)
- Shop name, category, address, map location, opening details, photos and offers you publish. This information is public so customers can find your shop.
Location
- Pokkee: if you allow it, your device's approximate or precise location is used to show nearby shops. It is sent with the request for nearby shops and is not stored on our servers or linked to your profile. You can pick a city manually instead.
- Pokkee Business: location is used only to help you pin your shop on the map during setup.
Camera and photos
- Pokkee Business uses the camera to scan customer QR codes at the counter. Camera images are processed on the device and are not uploaded.
- Photos you pick (profile photo, shop photos, offer images) are uploaded so they can be shown in the app. We use the system photo picker, so the apps cannot see the rest of your gallery.
Notifications and device data
- If notifications are allowed, we store a push token for your device so we can tell you about points earned, redemptions and new offers. You can turn notifications off in the app's Settings at any time.
- Our servers keep standard technical logs (such as IP address, time and the request made) to protect against abuse, for example to limit repeated failed sign-ins.
We do not use advertising IDs, we do not show ads, and we do not sell your personal information.
How we use information
- To create and secure your account, including sending sign-in codes on WhatsApp.
- To record points and rewards between you and the shops you visit.
- To show nearby shops and their offers.
- To send notifications you have allowed.
- To prevent fraud and abuse and keep the service running reliably.
- To respond when you contact us.
What shops can see
When you earn or redeem at a shop, that shop can see your name, your profile photo if you added one, and your points balance and activity at their shop only. Shops cannot see your balances or activity at other shops, and they never see your password.
Service providers
We use a small number of trusted providers to run Pokkee. They process data only on our behalf:
| Provider | Purpose |
|---|---|
| Supabase | Database hosting for accounts, shops and rewards |
| Cloudflare R2 | Storage for uploaded photos |
| WaAPI (waapi.app) | Sending sign-in codes to your mobile number on WhatsApp |
| Resend | Sending account emails such as password reset codes |
| Google Firebase Cloud Messaging | Delivering push notifications |
| Google ML Kit | On-device QR code scanning (Pokkee Business) |
We may also share information if required by law, or to protect the rights and safety of our users and the service.
Security
All traffic between the apps and our servers is encrypted with HTTPS. Sign-in codes expire after 10 minutes and are stored only as a one-way hash, sign-in attempts and code requests are rate limited, and passwords on older accounts are hashed.
How long we keep data
We keep your information while your account is active. When you delete your account, you are signed out immediately and we keep your data for 7 days so you can ask us to restore it. After 7 days your name, phone number, birthday and photo are unlinked from that app’s records: shops keep their visit, points and staff activity records so their books stay correct, shown as “Deleted customer” or “Deleted staff” with nothing that identifies you. Your profile is deleted once you have nothing left in either app. A deleted shop is hidden immediately, its paid plan is cancelled, and it can be restored within 7 days. Copies in encrypted backups are overwritten within 30 days. Server logs are kept for a limited period for security purposes.
Your choices and rights
- Access and correct: view and edit your profile in the app at any time.
- Notifications: turn push notifications off in Settings or in your phone's settings.
- Location: deny or revoke location permission and choose a city instead.
- Delete: delete your account in the app (Profile → Edit profile → Delete account), or on the account deletion page.
- You can also email us to ask for a copy of your data or to raise any privacy concern. We respond within 30 days.
Children
Pokkee is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, contact us and we will delete it.
Changes to this policy
If we make meaningful changes, we will update the date above and, where appropriate, let you know in the app.
Contact
Email hello@getpokkee.com for any question about this policy or your data.