Privacy Policy

What we collect

Your email address: the one your Google or Apple sign-in shares with us, or the one you register with a password (stored only as a one-way hash, never readable). Plus the stamps and rewards on your cards and the stand IDs you tap. That is the whole account. Your IP address is used briefly to limit repeated sign-in and reward attempts; it is not stored with your account.

What we never collect

No payment data, no contacts, no background location, no advertising identifiers. Location is read only while the app is open, to sort cafes by distance.

Why we process it

To keep your stamp balance accurate across devices, to prevent duplicate stamping, and to tell you when a reward is ready.

Who sees it

Partner cafes see that a reward was claimed at their own stand — never your email address or your cards at other cafes. Our web pages load nothing from third parties, except the Google and Apple sign-in buttons on the account-deletion page.

How long we keep it

Until you delete your account. Deleting signs you out everywhere and removes your email address, name, devices and notifications at once. Your stamp and reward history, no longer linked to any contact details, is kept for 30 days so a dispute can still be answered, then permanently deleted; backups rotate out within the same 30 days.

Your rights

Export or delete your data from Account at any time, or write to privacy@wkapi.app. Deletion can also be requested at wkapi.app/delete-account without installing the app.