Privacy
Last updated 14 October 2026
Pointss is a small, non-commercial experiment with digital loyalty cards at two or three restaurants. It is run by one person, not a registered company. Nobody pays for it, and we never handle your money. This page explains what we keep about you and why, in plain words.
What we collect
If you collect stamps:
- Your mobile number, to verify it’s you and to keep your card.
- Your stamps and rewards: which restaurant, and on which days you collected.
- Whether you chose to get WhatsApp messages, and when.
- For keeping you signed in: the type of browser you use and a scrambled (hashed) form of your internet address, so we can spot misuse. We don’t keep your actual IP address.
If you run a restaurant on Pointss: your name, email address and profile photo from Google sign-in, and the details of your loyalty programme.
We don’t collect your location, contacts, payment details or anything from your phone beyond what you type in. There are no ads or tracking tools on Pointss.
How we use it
- To send you a sign-in code and keep your loyalty card.
- To count your stamps and give you your reward.
- If you switched it on: to send you a WhatsApp message after each stamp and when a reward is ready.
- To stop abuse, such as someone collecting stamps with numbers that aren’t theirs.
We never sell your information or use it for advertising.
Who can see it
- The restaurant sees the visits and rewards at its own place. It sees only the last digits of your number, never the full number.
- The person running Pointss can see the data to run and fix the service.
- Services that run Pointss for us, which only process data to provide their service:
- Google Firebase sends the SMS code and keeps a record of your verified number.
- Google Cloud (Mumbai, India) runs the Pointss server.
- MongoDB Atlas (Mumbai, India) stores the data.
- Vercel serves this website; its servers may be outside India.
- Meta (WhatsApp), only if you chose WhatsApp messages.
- Google sign-in, for restaurant owners.
Cookies
We use two cookies, only to keep you signed in. Customers stay signed in for up to 180 days unless they sign out. No other cookies, and no tracking.
How long we keep it
- Your card, stamps and rewards: while the experiment runs.
- Records of WhatsApp messages: deleted automatically after 180 days.
- Sign-in codes: deleted within an hour.
- When the experiment ends, we delete everything within 30 days.
Your choices
- Stop WhatsApp messages at any time: tap “Stop updates” or reply STOP in WhatsApp, or switch off “WhatsApp updates” in your account menu.
- See, correct or delete your data: email business@knowyourtrips.com from any address and tell us your mobile number. We’ll reply within 7 days and delete everything, including the Firebase record, within 30 days.
- Complaints: write to the same address. Under India’s Digital Personal Data Protection Act you can also approach the Data Protection Board of India.
Children
Pointss is for people aged 18 and over. Please don’t sign up if you are younger.
Changes
If we change this page, we’ll update the date at the top.