Privacy notice (draft) · Till & Stack

1. The short version

You can use the card wallet without an account. Your cards stay on your phone.
If you create an account to back up or sync, your cards are encrypted on your phone before they are sent to us. We can’t read your card numbers.
We never log in to your retailer accounts, and we don’t look at or analyse what you buy.
We don’t sell your personal information and we don’t show ads.
You can delete your account in the app, or ask us by email.

2. Who we are

The responsible party is Bit Primitive (Pty) Ltd (“we”, “us”), registration number [CIPC registration no. — to confirm], physical address [physical address — to confirm].

Information Officer: [Name of Information Officer — to confirm], registered with the Information Regulator under [registration reference — to confirm].
Privacy questions and requests: privacy@tillandstack.com
PAIA manual: Our manual under the Promotion of Access to Information Act will be published at [PAIA manual link — to be published].

3. What stays on your phone

When you use the wallet without an account, this information is stored only on your phone, in an encrypted database. It is not sent to us:

your cards: the card name, the barcode number and format, the member name, notes, colour and category you choose;
points balances, expiry dates and reminders you set;
savings amounts you note down;
your app settings.

Camera and photos. The camera is used on your phone to read barcodes. If you import a card from a photo, the photo is read on your phone. We don’t collect or upload camera images or photos.

Backup files. If you export a backup file, it is encrypted and saved where you choose. We don’t receive a copy.

Pharmacy and health cards. Some loyalty cards are from pharmacies. We don’t try to work out anything about your health from the cards you keep, and we don’t analyse purchases.

4. If you create an account

An account is optional. You need one only for backup and sync across devices, Plus, and (later) Stack. When you have an account we process:

Sign-in details: Your email address (stored encrypted), and the account identifier from Sign in with Google or Sign in with Apple if you use them (stored as a keyed hash, not in plain form). If you sign in by email, we send you a one-time code. [Email delivery provider — to confirm (OPEN_QUESTION Q12)]
Devices: A device identifier, the platform (Android or iOS), when the device was last seen, and a push-notification token (stored encrypted) so we can send notifications you have allowed.
Synced cards: Your cards and points are encrypted on your phone with a key that only your devices and your recovery phrase can unlock (end-to-end encryption). We store the encrypted data and basic information about it, such as its size and when it changed. We can’t read the contents. If you lose your recovery phrase and all your signed-in devices, we can’t recover your synced cards for you.
Session and security records: Sign-in sessions and limited security logs, used to keep your account safe. Our logs never contain card numbers, email addresses or sign-in tokens.

5. Subscriptions

If you buy a Plus subscription, you pay through Google Play or the App Store. We don’t see your card or bank details. Our subscription provider, RevenueCat, tells us whether your subscription is active and until when, so we can unlock Plus features.

6. Stack (not available yet)

Stack is an optional rewards feature that is not live yet. If it launches and you choose to use it, we will also process:

which partner offers you tap on, and when;
purchase confirmations from affiliate networks (order value, commission and status, linked to your account by a reference, not your name);
your rewards history, kept in rand;
your payout choice: encrypted bank details for rand payouts, or an encrypted reference to your account at a licensed crypto partner. The partner does its own identity checks under its own privacy notice. We never hold crypto or wallet keys.

We will update this notice, and show the partner’s name and licence details, before Stack goes live.

7. Crash reports and app statistics

Crash reports are sent to Sentry so we can fix bugs. Before a report leaves your phone, we strip out anything that looks like a card number.
Usage statistics (for example, how long the app takes to open) are counted with our own tools on Cloudflare, without personal information. We don’t use third-party advertising or tracking tools.

8. This website

This website has no cookies, no analytics and no ads. It is hosted by Cloudflare, which processes your IP address and browser details to deliver the pages and protect them from attacks. The fonts are loaded from Google Fonts, so your browser connects to Google’s servers, which receive your IP address.

If you email us, we use your message and email address to reply.

9. Why we may use your information

To provide the service you asked for (contract): Your account, sign-in, backup and sync, subscriptions and, later, Stack cashback and payouts.
With your consent: Marketing emails and promotional notifications. You can withdraw consent at any time.
Our legitimate interest: Preventing fraud and abuse (for example, fake cashback claims), keeping our systems secure, and fixing crashes. [Lawful basis for crash reports — to confirm during legal review]
Legal duties: Keeping financial records that tax and anti-money-laundering laws require, and responding to lawful requests.

10. Marketing messages

We follow section 69 of POPIA. If you are not a customer, we will only send you marketing by email, SMS or notification if you opted in first. If you are a customer, every marketing message will include a simple way to opt out. Messages about your account, such as security alerts or a confirmed payout, are not marketing.

11. Service providers and other countries

We don’t sell your personal information. We share it only with service providers who process it for us, under written agreements, or when the law requires it. Some of them process information outside South Africa. Under section 72 of POPIA, we rely on contracts with these providers (including data processing agreements) that require protection comparable to POPIA.

Cloudflare: Hosts our servers, database, encrypted sync storage and this website. Cloudflare runs a global network, so data may be processed outside South Africa.
RevenueCat: Manages subscription status for Google Play and App Store purchases. Processes data outside South Africa.
Expo: Delivers app updates and push notifications. Processes data outside South Africa.
Sentry: Receives crash reports, with card numbers removed. Processes data outside South Africa.
Google and Apple: If you use Sign in with Google or Sign in with Apple, or buy through their stores, they handle that under their own privacy policies.
Stack partners (later): Affiliate networks and licensed payout partners, named in the app before you use Stack.

[Country and safeguard details for each provider — to confirm during legal review]

12. How long we keep it

Cards on your phone: until you delete them or uninstall the app.
Account and synced data: until you delete your account.
Stack rewards and payout records: when you delete your account, these are anonymised (your account link is removed) and kept for [period required by tax and FICA law — to confirm (OPEN_QUESTION Q11)].
Raw affiliate network files: 24 months, then deleted.
Crash reports and security logs: [retention period — to confirm].

13. Deleting your account

You can delete your account in the app, or by email if you no longer have the app. See how to delete your account for the steps and exactly what is deleted.

14. Security

We protect your information with reasonable technical and organisational measures (POPIA section 19), including: an encrypted database on your phone, end-to-end encryption for synced cards, encryption of sensitive fields on our servers, an optional app lock, and strict access controls for our staff. No system is perfectly secure. If a security breach affects your personal information, we will tell the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires.

Found a security problem? Email security@tillandstack.com.

15. Age limits

The card wallet is for people aged 13 and older.
Stack will only be available to people aged 18 and older, because our partners must verify adult customers.

If you believe a child under 13 has created an account, contact us and we will delete it.

16. Your rights

Under POPIA you have the right to:

ask whether we hold personal information about you, and ask for a copy;
ask us to correct or delete it;
object to us processing it, including for direct marketing;
withdraw consent you gave us;
complain to the Information Regulator of South Africa (inforeg.org.za).

To use these rights, email privacy@tillandstack.com. We may need to confirm your identity first. Because synced cards are end-to-end encrypted, we can only give you a copy of them in encrypted form; you can export them in readable form from the app.

17. Changes and contact

If we change this notice in a way that matters, we will tell you in the app or by email before the change takes effect. Questions: privacy@tillandstack.com.