Privacy policy

Cardholders: anyone who gets a loyalty card for a shop that uses Streak.

Businesses: the owners, managers and staff of shops that use Streak.

When you get a card, you are joining that shop's loyalty programme. Streak runs it for them, so the shop can see the information below about its own cardholders, and we look after it on their behalf.

• Your name and mobile number, which you type when you get a card. Your number is how we recognise you if you sign up again, so you do not end up with two cards.
• Your email address and date of birth, only if the shop's sign-up form asks for them.
• Your card activity: each stamp or reward, when it happened, at which location, and which staff member gave it.
• Whether you agreed to receive offers, if the shop asks.

We do not collect your location, contacts, payment details or anything else from your phone.

• The shop's name, logo, colours, locations and reward settings.
• Names of staff members, and their PINs, which we store only in scrambled (hashed) form.
• When a PIN is entered wrongly, the internet address (IP address) it came from, so we can block repeated guessing.

• To create your card and keep its stamp count up to date.
• To let the shop's staff find your card if your phone will not scan.
• To let the shop send messages to your card, such as offers or announcements. These appear in your phone's wallet app.
• To show the shop how its loyalty programme is doing.
• To prevent misuse, such as fake sign-ups or PIN guessing.

We do not sell your information, use it for our own advertising, or share it with other businesses. We do not use advertising or tracking cookies.

Your card lives in Google Wallet or Apple Wallet. When you add it, the card's contents (your name, the shop's details, your stamp count and a barcode) are sent to Google or Apple to display it. Your phone number is not on the card. Google and Apple handle that information under their own privacy policies.

• The shop you joined. Its owner and managers can see your details and card activity. Its staff can see your name and stamps at the counter, so they can stamp you when your phone will not scan.
• Our service providers, who store and run Streak for us: Supabase (database) and Vercel (website hosting). Their servers may be outside Pakistan.
• Authorities, only where the law requires it.

The card sign-up page does not set cookies. Staff, owners and our own team are kept signed in with a cookie on their device, which is used only for that.

We keep your information for as long as the shop uses Streak and you hold its card. If a shop stops using Streak, we delete or anonymise its cardholders' personal details within 90 days, unless the law requires us to keep them longer.

• Remove the card from your wallet app at any time. You can also turn off its notifications in your wallet settings.
• Ask us for a copy of the information we hold about you, or ask us to correct it.
• Ask us to delete your details. We will remove your name and contact details within 30 days. A record that stamps and rewards were given stays, without anything that identifies you, so the shop's records still add up.

To do any of these, email contact@streak.pk and tell us which shop's card it is.

Everything is sent over an encrypted connection. Staff and owner PINs are stored only in scrambled form. Each shop can see only its own cardholders.

Streak is not meant for children under 13, and we do not knowingly collect their information. If you think a child has signed up, email us and we will remove it.

If we change what we collect or how we use it, we will update this page and the date at the top before the change takes effect.

Questions about privacy, or any of the requests above: contact@streak.pk.