Privacy

Your mobile number and first name

While you hold a card. Erased after 24 months with no stamp.

Removed by: Automatic purge, or you delete your card

Your cards and stamp history

Same as your number and name.

Removed by: Goes with your number

Device sign-in (a hashed token)

Until 13 months without use.

Removed by: Automatic purge

One-time codes (hashed)

Deleted a day after they expire or are used.

Removed by: Automatic purge

Tap and rate-limit counters

90 days and 1 day. No personal details.

Removed by: Automatic purge

Shop owner sign-in links and sessions

Deleted 7 days after they expire.

Removed by: Automatic purge

A scrambled record of a blocked number

If a shop blocks you, we keep a one-way scramble of your number so the block holds after you delete your card. It does not show your name, cards or stamps. A determined person with access to our database could still work the number out from it.

Removed by: Ask the shop to unblock you

Daily shop totals

Kept. Counts only, nobody can be identified.

Shop owners’ account records (name, email, mobile number and a hashed password) and billing records are kept for the contract plus seven years (tax law), and removed on request after that. Your stamps are linked to your card, so deleting your card deletes them too. Details sent from the Start page (name, email, mobile number and business name) are used only to get back to you, and deleted on request.

To give you stamps, show your balance, and let staff confirm a reward. We use your mobile number only to text you recovery codes and one reminder each time you are a stamp from a reward. Agreeing to that is part of joining. You can switch the reminders off on your cards page. We do not sell your details or use them for advertising.

Our database is Neon, on Amazon Web Services in Sydney (ap-southeast-2). The app runs on Vercel in Sydney (syd1), behind Vercel’s global network, so requests may pass through servers outside Australia. Shop owners’ sign-in links are sent by Resend, a US email company. Texts go out through Mobile Message or Twilio, which may process your number outside Australia. Shop owners’ subscription payments are handled by Stripe, which keeps the card details; we do not.

We set four cookies, and the service needs all of them. One keeps your card on your phone (it lasts up to 13 months). One holds the result of your last tap for up to 10 minutes, so the page can show it. The third keeps a shop owner signed in (30 days). A fourth keeps a shop’s enquiry open for 30 days so the owner can come back and finish their card. We use no advertising or tracking cookies, and no analytics.

On your cards page, “Delete my cards and number” erases your number, name, cards and history at once. Download your data gives you a copy as a file. To correct a detail, or if you have lost your phone, email hello@theusualcard.com.

Contact us first and we will try to fix it. If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.