Privacy Policy

When you grant the location permission, we collect your device's precise location (GPS coordinates) directly from your device.

We use your location to show nearby businesses and deals on the Near Me screen, to calculate the distance between you and each business, and to send proximity alerts when you are close to a participating business.

Today we collect location ONLY while the app is in use (in the foreground). We do not collect location in the background and we do not track your movements while the app is closed. If we ever add background location, we will update this section and ask for your permission again before doing so.

Your coordinates are processed in the moment to compute nearby results and are not stored persistently against your account. The only exception is proximity alerts: we keep a short-lived record of which business triggered an alert (business ID and timestamp, without coordinates) so we do not notify you repeatedly for the same place. Those records are deleted automatically after 30 days.

Coordinates are shared with Google Maps Platform to render maps and resolve addresses (geocoding). See Google's Privacy Policy: https://policies.google.com/privacy

You can turn location off at any time in your device settings (Android: Settings › Apps › MySpotRewards › Permissions › Location; iOS: Settings › MySpotRewards › Location), or in the app under Profile › Preferences, where you can disable proximity alerts and location-based results. The app remains usable without location; you can search by city or ZIP code instead.

The app can send push notifications and local notifications for proximity alerts, new deals and offers, and platform announcements such as account or membership notices.

To deliver push notifications we store a device push token (an anonymous identifier issued by Google Firebase Cloud Messaging on Android or Apple Push Notification service on iOS) linked to your account, together with the platform and the date it was registered. We do not store the content of notifications on your device.

You can disable notifications at any time in your device settings (Android: Settings › Apps › MySpotRewards › Notifications; iOS: Settings › Notifications › MySpotRewards) or in the app under Profile › Preferences. Turning them off deletes the push token from your account.

We record interaction events on business pages: page views, QR code scans, taps on the call button, and taps on the directions button.

These events are aggregated and shared with the corresponding business so the owner can see how their listing is performing. Businesses see counts and trends only — never your name, email, or account.

We do not store IP addresses in clear text. Each event is de-duplicated using a salted cryptographic hash of the IP address and session, which cannot be reversed to identify you personally. We do not use third-party advertising or tracking SDKs.

If you create a business account or claim an existing listing, we collect the contact name, email address, phone number, the street address of the establishment, business category and description, images you upload, and billing details needed to process your membership.

Public business information — business name, category, description, address, phone, website, social links, hours, logo and photos — is displayed in the public directory and may appear in search engines. Private fields such as the owner's account email, billing records, and internal notes are never shown publicly.

Payment card details are entered directly with our payment processor and are never stored on our servers.

We work with the following third-party providers, which process data only as needed to run the service:

• Supabase — database, authentication and file storage: https://supabase.com/privacy
• Google Maps Platform — maps and geocoding: https://policies.google.com/privacy
• Stripe — payment processing: https://stripe.com/privacy
• Twilio — SMS messaging: https://www.twilio.com/legal/privacy
• Cloudflare — hosting, CDN and Turnstile anti-abuse: https://www.cloudflare.com/privacypolicy/
• Google OAuth — sign in with Google: https://policies.google.com/privacy

You can request access to, correction of, or deletion of your personal data at any time by writing to admin@myspotrewards.com, or by using the in-app account deletion page linked below.

Deleting your account removes your profile, saved preferences, coupons, push tokens and location preferences. Business listings you own are unpublished and transferred back to an unclaimed state.

After a deletion request, personal data is removed from our active systems within 30 days. Encrypted backups may retain a copy for up to 90 days, after which they expire automatically. Records required for legal, tax, accounting or fraud-prevention purposes, email opt-out preferences, and limited proof that deletion was completed are retained only for the applicable required period.