In short
- What we keep
- Your email, your name, and the stamps, points and rewards you collect at shops. A photo only if you add one.
- What shops see
- Your name when they scan your code, and your visits at their shop. Never your email, and never your visits at other shops.
- Reporting and hiding
- You can report a post or hide a shop’s posts. Reports go to the OneLoyal team only: a shop never learns who reported it. The shops you hide stay private to you.
- What we never do
- We do not sell your data, show ads, or track you across other apps and websites. The apps contain no analytics or advertising tools.
- Leaving
- You can delete your account in the app, or ask us by email. How to delete your account.
Who we are
OneLoyal is a product of Cygntek (“we”, “us”). This policy covers two apps: OneLoyal, for customers, and OneLoyal Business, for shops. Cygntek decides how the data in these apps is used and is responsible for it.
For any question about your data, write to support@cygntek.com.
What the OneLoyal app collects
| Data | Why we need it |
|---|---|
| Email address and password | To create your account and sign you in. We send you an email to confirm the address, and one to reset your password when you ask. Your password goes to our sign-in service (Firebase Authentication); we never see it. |
| Your name | So a shop can greet you and check it scanned the right person, and so we can hand over a OneLoyal reward you claim. |
| Profile photo (optional) | Shown to you in the app. You choose it from your photo library; the app makes it smaller before upload. |
| Language choice (optional) | To show the app in your language. |
| Your customer code | The random code in your QR. Shops scan it to give you stamps and points. It is not your account number. |
| Your visits | Each time a shop scans your code, we record which shop, the purchase amount the shop typed in, the stamps and OneLoyal Points you got, and the time. This is your stamp card, your points balance and your history. |
| Rewards you redeem or claim | A one-time code (valid for five minutes) when you redeem a shop’s reward. When you claim a OneLoyal reward, the claim holds your name and email so our team can contact you to hand it over. |
| Promo searches | The words you type into search are sent, with the current public promos, to a service that ranks the promos by how well they match (see Automatic checks). We do not store your search words or send your account details with them. |
| Reports you send | If you report a post, we store the post’s words as you saw them, the shop it came from, your reason, an optional note you may write, and the time. Reports go to the OneLoyal team only, and only they can see who sent one; a shop never learns who reported it. |
| Shops whose posts you hide | The list of shops you asked not to see posts from. It changes what your feed shows and nothing else: your stamps, OneLoyal Points and rewards at those shops stay as they are. |
What OneLoyal Business collects
| Data | Why we need it |
|---|---|
| Email address and password | To create the shop’s account and sign in, as for customers. |
| Shop details | Name, category, description, address and map position, so customers can find the shop. We check every new shop before it can give stamps. |
| Your location (optional) | Only to place the shop’s pin on the map. You can move the pin or place it by hand. The pin becomes the shop’s public map position. |
| Shop photo and post images (optional) | Chosen from your photo library and shown to customers. |
| Posts | The title, text and dates of the promos you publish to the customer feed. |
| Visits you record | The customer’s code, the purchase amount and the stamps, so the customer gets their stamps and points. |
| Monthly statements | The OneLoyal Points your customers earned at your shop each month, and the fee for them. |
The camera scans customer and reward codes. The phone reads the code from the camera image; no image is stored or sent to us.
What stays on your phone
- Your location in the OneLoyal app. If you allow it, the app uses your location to centre the map and show shops near you. It stays on your phone; the app does not send it to us.
- Your code, for use offline. The app keeps a copy of your customer code and name on your phone, so your code shows at the counter without a connection. Signing out removes it.
- A reward claim in progress. While you claim a OneLoyal reward, the app keeps a note of it, so a lost connection never uses your points twice.
Maps are drawn from OpenStreetMap. To show a map, your phone asks OpenStreetMap’s servers for the area on screen, so those servers see your IP address and that area. OpenStreetMap’s privacy policy applies to those requests.
Who sees your data
Shops
A shop sees your name when it scans your code, and the stamps, purchase amounts and points of your visits at that shop. The business app does not show it your email, your photo, your OneLoyal Points balance, or your visits at other shops.
Other people using OneLoyal
Nothing about customers is shown to other customers. A shop’s name, category, description, address, map position, photo and posts are public to everyone signed in to OneLoyal once the shop is approved.
The OneLoyal team
People at Cygntek who run OneLoyal can see account records to answer support requests, review new shops and posts held or reported for review, hand over OneLoyal rewards and prepare shop statements. When you report a post, the team can see that you reported it; the shop never can.
No one else
We share data only with the services below, which process it for us, and when the law requires it. We do not sell personal data.
Services we use
| Service | What it does with the data |
|---|---|
| Google Firebase | Sign-in, our database, image storage and the server functions that change balances. All account and loyalty data is stored here. Firebase sign-in also receives your IP address to prevent abuse. Firebase privacy information. |
| TypeSafe | Answers the automatic checks described below. It receives only the text named there, never an email address or account ID. |
| OpenStreetMap | Map images, as described in What stays on your phone. |
| Google ML Kit (OneLoyal Business on Android) | Reads codes from the camera on the phone. Google’s ML Kit sends Google technical data about the scanner, such as the device model, system version and performance. Google’s ML Kit disclosure. |
Automatic checks
We use TypeSafe, an AI service, for four jobs. Its answers never change a stamp or points balance, and a person decides on every new shop.
- New shops. The shop’s name, description and address, to help us spot test entries and businesses that are not allowed. A person approves every shop.
- Posts. The shop’s name and the post’s title and text, to decide whether a post can go live or waits for a person to review it.
- Unusual days. Once a day, a summary of each shop’s visits: the shop’s name and category, the number of visits and customers, the average and largest amount, and the first and last hour. No customer is named. This helps us find typing mistakes and misuse of points.
- Search. The words you search for and the current public promos, to rank the promos.
How long we keep it
We keep your data while your account exists. OneLoyal Points expire 12 months after your last activity; your history stays.
When a customer deletes their account, we delete the account, the wallet and its OneLoyal Points, the stamps, the codes and the list of shops you hid. Purchase records stay, with the customer’s identity removed, because shops’ monthly statements are built from them. Reports you sent stay as our moderation record, with your name and account ID removed; an open report stays open for us to answer.
When a shop owner deletes their account, the shop closes and we delete its posts and images. Its statements stay as billing records.
Our servers write technical logs, for example when a request fails. These can contain an account ID and are kept by Google for a limited time.
Your choices
- Change your details in the app: your name, photo and language in the Me tab; a shop’s details in the Shop tab.
- Say no to permissions. Location, photos and camera are asked for only when a feature needs them. The apps work without location and photos. Without the camera, staff can type a customer’s code instead.
- Ask for a copy or a correction of your data by writing to support@cygntek.com from the email address of your account.
- Delete your account in the app or by email. See how.
How we protect it
The apps talk to our services over encrypted connections (HTTPS). Database rules let each customer read only their own records, and let a shop read only the visits at that shop. Stamps and points change only on our servers, never from a phone.
No system is perfectly secure. If you think your account was used by someone else, change your password and write to us.
Changes and contact
When this policy changes, we publish the new version on this page and change the date at the top.
Privacy questions and requests
support@cygntek.com