Privacy policy
Last updated: 16 October 2026
Who we are
OneLoyal is run by [Company name] Ltd, a company registered in [England and Wales] (company number [company number]), registered office [registered office address]. In this policy, "we" and "us" means that company.
We are the "controller" of the personal information described here, which means we decide how it's used. We are registered with the Information Commissioner's Office (ICO), registration number [ICO number].
Questions about privacy? Email support@oneloyal.app.
The short version
- You can use OneLoyal without giving us any personal details.
- Your OneLoyal code is random and contains nothing about you.
- Shops only see your first name (if you give one) and your stamps with them. They never see your email address or your cards at other shops.
- Your location never leaves your phone.
- We don't sell your information, and we don't show adverts.
What we collect from customers
| Information | Why we need it |
|---|---|
| Your OneLoyal code and a random account number, created when you first open the app (even as a guest) | So shops can scan you and your stamps are saved on our servers. |
| Your cards and stamps: which shops have stamped you, when, and any rewards redeemed or stamps removed | To show your cards, work out rewards and expiry, and help prevent fraud. |
| Your email address, if you create an account with email or Sign in with Apple | To log you in (we email you a one-time code) and restore your stamps on a new phone. If you choose Apple's "Hide my email", we only get a private Apple relay address. |
| Your first name, if you choose to give it | So shops can greet you and recognise your reservations. |
| Offer reservations: what you reserved, how many, and when it was collected or cancelled | So the shop can have your order ready. |
| Which offers you've seen (stored on your phone) | To show "NEW" labels and the badge on the Offers tab. |
| A notification token, if you allow notifications | So we can tell you when you get a stamp or a reward is ready. You can turn this off at any time. |
Your location
If you allow it, the Explore map uses your phone's location to show nearby shops and distances. This happens on your phone only. Your location is never sent to us or to shops.
Camera
The camera is only used in the shop part of the app, to scan customers' codes. We don't store any pictures.
What we collect from shops
- The shop owner's login email address.
- Shop details: name, logo, address, map location, opening hours, stamp rules and offers. These are shown publicly to everyone using the app.
- Your owner PIN, stored scrambled so that nobody (including us) can read it.
- A record of stamps, rewards, removals and undos at your shop, for your dashboard and to help prevent fraud.
What shops can see about customers
When a shop scans your code, it sees your first name (if you've given one), your stamps at that shop and how many stamps you've ever had there. For reservations, it sees your first name and what you reserved. A shop can see how many customers an offer reaches, but not who. Shops can never see your email address, your OneLoyal account details, or your cards at other shops.
Our legal reasons for using your information
- To provide the service you asked for (contract): your code, cards, stamps, account, reservations and sign-in emails.
- Legitimate interests: keeping the service secure, preventing fraud and fixing problems.
- Your consent: notifications and location. You can withdraw these at any time in the app or in your iPhone's Settings.
Companies that help us run OneLoyal
We use a small number of trusted service providers. They only handle your information on our instructions.
| Provider | What they do |
|---|---|
| Supabase | Hosts our database, logins and shop logos. Data is stored in [Supabase region, e.g. London (eu-west-2)]. |
| Apple | Sign in with Apple, Apple Maps (the map and finding shop addresses) and delivering notifications. |
| Expo | Sends notifications to your phone through Apple. |
| Resend | Sends the one-time login codes by email. |
| Cloudflare | Hosts this website. |
Some of these providers are based in, or use servers in, the United States. Where your information is sent outside the UK, we make sure it's protected by approved safeguards, such as the UK's data adequacy rules or standard contract terms.
How long we keep information
- Guest accounts that have never been stamped at a shop are deleted automatically at the end of the month once they're more than 30 days old.
- Your account, cards and stamps are kept until you delete your account.
- When you delete your account, we permanently delete your account, OneLoyal code, cards, stamps and reservations straight away.
- Shop accounts are kept while the shop uses OneLoyal. Contact us to close your shop.
Your rights
Under UK data protection law, you have the right to:
- get a copy of the information we hold about you
- have it corrected if it's wrong (you can change your first name in the app at any time)
- have it deleted (use Delete account on the Account tab, or email us)
- object to, or ask us to limit, how we use it
- take your information to another service
To use any of these rights, email support@oneloyal.app. We'll reply within one month.
If you're not happy with how we've handled your information, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Children
OneLoyal is not aimed at children under 13, and we don't knowingly collect their information.
Security
Each person can only see their own information, and every stamp, reward and reservation is checked on our servers. Connections to OneLoyal are encrypted. We review our security regularly.
This website
This website doesn't use cookies or tracking, and it doesn't ask you for any information. Cloudflare, which hosts it, keeps basic technical logs (such as IP addresses) for security.
Changes to this policy
If we make important changes, we'll update the date at the top and let you know in the app.