StampKit Privacy Policy

When you join a shop's rewards program, we collect only what the program needs to run:

• Your name and email address.
• Your birthday month and day, but only if the shop offers a birthday reward and you choose to provide it.
• Your visit and stamp history: the stamps you earn, rewards you redeem, and orders you place at each shop.
• Device push tokens, if you install a StampKit app and turn on notifications, so we can send the messages you opted into.
• Apple Wallet pass registrations, so the card in your Wallet updates when you earn a stamp.

We do not ask for card numbers, government IDs, or precise location. If you join with Sign in with Apple and choose Apple's private relay email, we work with the relay address and never see your real email unless you give it to us.

You have a single StampKit account that can hold memberships at many different shops. Each shop only ever sees its own slice of your account: your membership, stamps, visits, and orders at that shop. A shop cannot see that you belong to any other shop, cannot see your activity elsewhere, and cannot see your full account. We enforce this separation in the database itself, not just in the interface.

We use your information to:

• Run your stamp cards and reward balances at each shop you join.
• Issue and update your Apple Wallet cards.
• Send you the shop messages you consented to (new items, offers, reminders that you are close to a reward).
• Keep the service secure and prevent fraud, such as duplicate or forged stamps.

A shop can email its members only if you gave consent, which we capture at the moment you join with a clear checkbox. Every marketing email includes a one-click unsubscribe link that works from your inbox, per the RFC 8058 standard, and unsubscribing from one shop does not affect your membership at any other shop. Service messages tied to your account (for example, a receipt or a reward you just earned) are not marketing and are sent regardless of marketing consent.

Shop subscriptions and any orders you pay for are processed by Stripe. Payment card details go directly to Stripe and are handled under their security standards. StampKit never stores or sees your full card number.

We do not sell your personal data, and we never have. We share data only with the service providers that make StampKit work, and only for that purpose:

• Supabase, which hosts our database and files.
• Resend, which delivers our email.
• Stripe, which processes payments.
• Apple, for Apple Wallet passes and push notifications delivered through Apple's services.

We share data with the individual shops you join, limited to your membership at that shop as described above. We may also disclose information if the law requires it, or to protect the safety and rights of our users.

You can delete your account at any time, in the app or by emailing us, and we will remove your personal data. If a shop leaves StampKit, we keep that shop's data for 90 days (in case the shop returns or needs an export), then hard delete it, and the shop's Apple Wallet cards are voided. Some records may be retained longer where the law requires it, in a limited form.

StampKit is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us information, contact us and we will delete it.

Questions about your privacy, or requests to access or delete your data, can go to support@stampskit.com. You can also read our Terms of Service.