Privacy Policy

UTIL APPS ("we," "us," or "our") operates the Util Points mobile application and website (the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect your information when you use our Service. By using Util Points you agree to the practices described here.

1. Information We Collect

1.1 Account Information

When you sign in with Google or Apple, the respective identity provider shares with us:

• Your display name and email address
• Your profile photo (if permitted by your provider settings)
• A unique identifier from that provider, used to recognize your account

We do not see or store your social-account password.

1.2 Business Owner Information

If you register a business on Util Points, we additionally collect:

• Business name, description, category, and contact information
• Business address and geographic coordinates (latitude / longitude) for map-based discovery
• Business logo and banner images
• Branch (office) locations and operating details

1.3 Loyalty Program Data

As part of providing the core service, we record:

• Check-in history — timestamp, business visited, and purchase amount (if entered by staff)
• Stamps earned, points accumulated, and rewards issued or redeemed
• QR codes linked to your account for check-in scanning
• Transaction references entered by business staff at the time of check-in

1.4 Device and Usage Data

• Push notification token — a device identifier provided by Firebase Cloud Messaging (FCM) so we can send you reward and promotional alerts. You can revoke this at any time in your device settings.
• Analytics events — usage patterns collected via Firebase Analytics, associated with a user identifier, to help us understand feature adoption and improve the app.
• Advertising identifier — on iOS, the IDFA (Identifier for Advertisers); on Android, the Advertising ID; along with device identifiers (IDFV). These are collected only with your consent — on iOS via the App Tracking Transparency prompt. They are used to measure and attribute the effectiveness of our advertising campaigns (see Section 3.5).
• Conversion and purchase events — key funnel events (sign-up, business creation, checkout, and subscription) that may be shared with advertising platforms to measure and optimize our campaigns (see Section 3.2).
• Crash reports — stack traces and device state captured by Firebase Crashlytics when the app crashes, used solely for debugging.
• IP address and general region — logged automatically by our servers for security and fraud prevention.

1.5 Images You Upload

Profile photos and business images you upload are stored in Microsoft Azure Blob Storage in a private container accessible only through signed URLs generated by our API.

1.6 Referral Data

If you use or share a referral code, we record the referral relationship to attribute rewards to the referring user once the referred user completes qualifying check-ins.

2. How We Use Your Information

• Deliver the loyalty program — record check-ins, issue stamps and points, track reward milestones, and enable redemption by authorized business staff.
• Send notifications — alert you about earned rewards, promotions from businesses you follow, and important account updates. You may opt out at any time in your device notification settings.
• Business discovery — display nearby businesses and their loyalty campaigns on the explore map using your device location (only if you grant location permission).
• Business analytics — provide business owners with aggregated statistics about visits, retention, and reward redemption. Individual customer data is never sold, nor shared with businesses for their own marketing purposes.
• Advertising measurement and attribution — understand which campaigns (on Meta, Instagram, TikTok, Google, and the app stores) drive installs and sign-ups, so we can optimize our marketing spend. See Section 3.5.
• Customer support — respond to inquiries, resolve disputes, and troubleshoot issues.
• Fraud and abuse prevention — detect and block unauthorized use of check-in codes or reward redemptions.
• Legal compliance — meet applicable legal and regulatory obligations.

We do not sell your personal information and we do not show third-party ads inside the app. We do share a limited set of identifiers and events with advertising platforms (Meta, TikTok, Google) and with RevenueCat to measure and optimize our own acquisition campaigns — always subject to your tracking consent on iOS (App Tracking Transparency). See Section 3.5.

3. Information We Share

3.1 With Business Owners

When you check in at a business, the business owner and authorized staff can see your display name and your check-in history at their business only. They cannot see your activity at other businesses.

3.2 Service Providers (Sub-processors)

3.3 Third-Party Privacy Policies

• Google / Firebase: policies.google.com/privacy
• Microsoft Azure: privacy.microsoft.com
• Apple: apple.com/legal/privacy
• Google Maps Platform: cloud.google.com/maps-platform/terms
• Meta: facebook.com/privacy/policy
• TikTok: tiktok.com/legal/privacy-policy
• RevenueCat: revenuecat.com/privacy

3.4 Legal Disclosure

We may disclose personal information if required by law, subpoena, court order, or other governmental authority, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

3.5 Advertising and Campaign Attribution

We promote Util Points through campaigns on Meta (Facebook and Instagram), TikTok, Google, and the app stores (App Store and Google Play). To understand which campaigns work, we share a limited set of data with those platforms: the device advertising identifier (IDFA on iOS / Advertising ID on Android), a user identifier, your email in hashed form (not in clear text), and conversion events (sign-up, business creation, checkout, and subscription).

• iOS: the advertising identifier (IDFA) is used only if you allow it in the App Tracking Transparency prompt. If you decline, measurement is performed in aggregate via Apple's SKAdNetwork, without identifying you. Apple Search Ads attribution uses Apple's AdServices framework.
• Android: the Advertising ID is used according to your device's ad settings, which you can reset or disable at any time.

Purchases and subscriptions are reported to these platforms through RevenueCat (server-to-server) to measure advertising return on investment. We do not share your information so that third parties can show you ads inside Util Points (there are no ads in the app); the sole purpose is to measure and optimize our own campaigns. You can disable tracking as described in Section 7.6.

4. Children's Privacy

Util Points is intended for users 13 years of age and older. Users between 13 and 17 must obtain parental or guardian consent before creating an account. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe your child under 13 has provided us personal information without your consent, please contact us at info@utilpoints.app and we will delete it promptly.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service.

• Account deletion — your personal profile is permanently removed within 30 days of requesting deletion.
• Check-in records — may be kept in anonymized, aggregated form for up to 12 months for analytics and fraud-prevention purposes.
• Business data — retained for 90 days after account deletion to support dispute resolution.
• Backup copies — may persist for up to 30 additional days in encrypted backups before being purged.

6. Security

We implement industry-standard safeguards, including:

• HTTPS / TLS encryption for all data in transit
• Firebase Authentication with signed JWTs validated server-side on every request
• Role-based access controls — business staff can only access data for their own business
• Encrypted storage for secrets and API credentials (never committed to source control)
• Soft-delete design — records are deactivated rather than immediately destroyed, enabling recovery and audit trails

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security but will notify you of a breach as required by applicable law.

7. Your Rights and Choices

7.1 Access and Correction

You can view and update your name and profile photo directly in the app at any time.

7.2 Account Deletion

You can delete your account from Settings → Delete account inside the app. Upon deletion, personal data is removed as described in Section 5.

For detailed step-by-step instructions and additional options, please consult our dedicated Data Deletion Instructions page.

7.3 Push Notifications

You can opt out of push notifications at any time in your device's notification settings (iOS: Settings → Notifications → Util Points; Android: Settings → Apps → Util Points → Notifications).

7.4 Location

Location access is optional and requested only for the business-discovery map feature. You can deny or revoke this permission in your device settings without affecting the rest of the app.

7.5 Data Portability

To request a copy of the personal data we hold about you, email info@utilpoints.app with the subject line "Data Export Request."

7.6 Ad Tracking (App Tracking Transparency)

On iOS, the app asks for permission via App Tracking Transparency before using your advertising identifier. You can change your choice at any time in Settings → Privacy & Security → Tracking. On Android, you can reset or delete your Advertising ID in Settings → Privacy → Ads. If you disable tracking, you can keep using Util Points normally; only the accuracy of advertising measurement is reduced.

8. Cookies and Similar Technologies

Our mobile app does not use cookies. Our website uses essential session cookies for language-preference storage. In addition, on our advertising campaign pages we use the Meta (Facebook) Pixel, which sets advertising-measurement cookies (such as _fbp and _fbc) to record visits and download-button interactions so we can measure the effectiveness of our ads. The rest of the website does not use advertising, tracking, or analytics cookies.

9. International Data Transfers

Util Points is operated from the United States. If you are located outside the U.S., your information may be transferred to and processed in the United States. By using the Service you consent to this transfer. We use service providers that participate in recognized data transfer frameworks to ensure appropriate safeguards are in place.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will:

• Display an in-app notice at the next login
• Update the "Last updated" date at the top of this page

Your continued use of the Service after the effective date constitutes your acceptance of the updated policy. If you do not agree, please stop using the Service and delete your account.

11. Contact Us

For privacy-related questions, requests, or complaints please contact us: