Privacy Policy

1. Information we collect

We only collect what we need to run your loyalty cards:

• Account: your name and email address, and the ID of the Google or Apple account you sign in with. We never receive or store your Google or Apple password, and we don’t use your profile photo.
• Profile choices: the city you pick, your avatar from Drox’s built-in set, your invitation code and who invited you.
• Loyalty activity: the cards you join, each stamp (when it was added and by which business account), rewards you redeem, gifts, points, streaks and medals.
• Device: a random ID created when you install the app (not your phone’s hardware ID), the device name, app version and language, and a notification token if you allow notifications. When you sign in on a new phone we record the change and its IP address to stop account sharing.

2. Location

Drox asks for your location only to show cards near you and to suggest your city. Your exact position stays on your phone: distances are worked out on the device, and only the city name you choose is saved to your account.

3. Camera and photos

The camera is used only by business staff, to scan a customer’s QR code. Photo access is used only when a business uploads its logo or pictures for its cards and offers.

4. For businesses

Business accounts also store the business name, logo, description, category and branch addresses with their map position. These are shown publicly in the app so customers can find you. We keep a log of the changes team members make (who, what, when, and the IP address and browser or app used) so owners can see who did what.

5. How we use your information

• To run your account and keep your stamps and rewards on your cards.
• To show businesses and cards near you.
• To send the notifications you allowed — new stamps, rewards and offers. You can turn them off in the app or in your phone’s settings.
• To keep Drox fair and secure: your QR code is signed and changes about every 30 seconds so it can’t be copied, and signing in on a new phone is limited.

6. Sharing

We don’t sell your data, show ads, or use analytics or advertising trackers. A business can see your progress on its own loyalty cards. We rely on a few services to run the app:

• Google and Apple — to sign you in.
• Firebase Cloud Messaging (Google) — to deliver notifications.
• CARTO and OpenStreetMap — to draw the map.
• WorldTimeAPI — to keep discount countdowns accurate.

7. Storage and security

Data travels over encrypted HTTPS. Your sign-in token is kept in your phone’s secure storage, and signing in again ends your older sessions.

8. Your choices and deleting your account

You can change your name and city, turn notifications off, and choose whether your stats are shown to others. On iPhone you can delete your account from Settings: this signs you out and deactivates the account. If you want your data permanently erased — or you use Android or a business account — contact us and we’ll remove it.

9. Changes to this policy

If we change how Drox uses your data, we’ll update this page and the date at the top.

10. Contact us

Questions about your data, or a deletion request? Message us through our social accounts @drox.cards on Instagram, Facebook or TikTok.