Privacy Policy

1. Who operates Punchy

Punchy is operated by Ubada Hussain and Ali Raza Awan. Contact support.punchy@gmail.com for privacy questions, rights requests and correspondence details. This policy covers our website, app, loyalty features, merchant/staff services, subscriptions, referrals and withdrawals.

Pakistan is our initial operating market. Additional countries are supported only as operations and applicable requirements permit. The service name does not represent company incorporation or a registered-office address.

2. Account and verification information

Depending on account type and feature, we process name, email, phone number, selected city and country, public account identifier, role, verification records and account status. Required and optional fields are indicated in the relevant flow.

Authentication uses protected password hashes, verification records and session credentials. Passwords are not provided to merchants. If an enabled social sign-in method is used, we may receive authorized identity information from its provider. We do not represent that every account has undergone government-identity or age verification.

3. Loyalty, business and support information

We process joined cards, punches and timestamps, relevant merchants/branches, completed rewards, redemption history and related activity. This supports wallet progress, eligibility checks, reporting, fraud prevention and disputes.

Business records may include name, category, logo, description, contacts, address, coordinates, branches, staff permissions and public links. Relevant information submitted for a public listing is displayed to users.

Support records include your message, account reference and evidence you choose to supply. Do not send unnecessary sensitive information, passwords, bank PINs, CVVs or bank/wallet one-time codes.

4. Merchant subscription payments

We process subscription plans, amounts, currencies, transaction references, verification decisions, relevant payment-method information and payment history. Authorized administrators review manual payments. A reference is not a bank password or authority to debit an account.

Evidence provided for reconciliation or refunds forms part of the relevant support/financial record. Payment institutions separately handle transfers under their own terms and privacy practices.

5. Referral Program, Earnings and Withdrawal Information

Punchy operates a referral program through which eligible customers may refer businesses to the platform and earn commissions when qualifying business subscription payments are verified.

To operate this program, we may process the following information:

• Customer referral codes and referred-business relationships.
• Referral registration, verification and eligibility statuses.
• Applicable referral commission rates and earning periods.
• Confirmed commission amounts and earnings history.
• Available and pending withdrawal balances.
• Customer withdrawal requests and their statuses.
• Payment account holder names and JazzCash, Easypaisa or bank account details, where provided.
• Payment transaction references, payout confirmations and relevant financial audit records.

Payout account details are protected using appropriate security measures, including encryption where implemented.

Authorized Punchy administrators may access the information necessary to review withdrawal requests, verify payment details, process manual transfers, investigate disputes and maintain financial records.

Punchy does not automatically transfer referral earnings merely because a commission becomes eligible. Customers submit withdrawal requests, and approved payments are processed manually through the supported payment methods.

Certain financial, accounting, fraud-prevention and transaction records may be retained after an account is closed where necessary to meet applicable legal obligations, resolve disputes or maintain an accurate financial audit trail.

Requests to delete an account do not necessarily result in the immediate deletion of every financial record. Any continued retention will be limited to relevant purposes and applicable requirements.

6. Location and nearby discovery

With device permission, the app can send current coordinates to our server to request nearby businesses. In the current discovery flow, they are request parameters used for distance filtering, not a GPS history written to your customer profile. Your selected city/country are stored separately for discovery without GPS.

Selected business/branch map coordinates are stored as listing information. Map selection and address search can send relevant coordinates or addresses to mapping/geocoding providers.

Access logs can contain request URLs, including coordinate query parameters. We therefore do not claim location is never stored anywhere. The current discovery feature does not continuously track location in the background. Manage location permission in device settings; relevant nearby features may become limited.

7. Camera, selected photos, NFC and motion sensors

Camera access supports QR/barcode scanning. The decoded code is processed for the requested loyalty action. The current scanning implementation does not save or upload raw camera frames or recorded scanning video to Punchy.

A photo you choose for a supported upload, such as a business logo, is processed and stored for that feature. Camera permission does not authorize uploading an entire photo library. NFC interactions process relevant tag/identifier information for enabled features.

Motion readings are processed locally for the shake interaction. That feature does not save or upload a motion history to Punchy or create a health/activity profile. Device permissions and provider software may have their own operating requirements.

8. Notifications and technical logs

Push delivery uses device notification tokens, relevant Firebase installation identifiers, preferences and message payloads. Service messages can include account, reward, support or payment information. Device settings affect presentation, including lock-screen visibility.

Web access logs contain technical information including IP addresses and request URLs. Backend logs include errors, request timing and notification dispatch information; message titles, bodies or identifiers can appear in logs and activity records. Relevant authentication and audit events support operation and security.

9. Why information is used

• Create, verify, secure and recover accounts.
• Provide wallets, discovery, loyalty progress and reward redemption.
• Operate business listings, branch/staff permissions, subscriptions and payment reconciliation.
• Operate referrals, commission reviews, withdrawal requests and manual payouts.
• Send service communications and respond to support/privacy requests.
• Prevent abuse, investigate disputes, maintain financial audit trails and meet applicable legal requirements.
• Understand relevant service usage and improve reliability and usability.

10. Processing grounds and choices

Where applicable law requires a processing ground, we rely on what is necessary to provide the requested service, meet legal obligations, pursue appropriately balanced operational/security interests or obtain consent for the relevant purpose.

Acceptance of Terms or acknowledgment of this policy is not blanket consent to optional permissions, promotional messages or unrelated uses. Required consent must be specific to the stated purpose and can be withdrawn through relevant controls or a request. Withdrawal may affect a dependent feature and does not undo earlier lawful processing.

11. What participating merchants can see

When you join or use a merchant’s loyalty program, its authorized business/branch users can see relevant identity and loyalty information. Current customer-list and activity features expose email addresses, names where available, progress, joining/visit timestamps and redemption activity. The current merchant customer list and dashboard do not include customer phone numbers in those customer records.

Access is connected to the relevant business and permitted role, not general access to all activity with unrelated merchants. Merchants must use received information for relevant loyalty administration, fulfillment and support or another separately established lawful purpose; access does not authorize sale or unsolicited marketing.

Merchants may independently hold purchase/customer records outside Punchy and have their own responsibilities. Contact the merchant about independently controlled information and us about Punchy-held information.

12. Providers and other disclosures

Oracle Cloud hosts our production website/backend. The primary MongoDB database is self-hosted on that VPS. Uploaded business images are served through production upload storage; this does not imply use of MongoDB Atlas or a separate image-hosting provider.

Resend currently handles transactional email. Brevo is also configured as an alternative path, depending on active configuration. Email providers receive the recipient and message contents needed for delivery. Firebase Cloud Messaging handles enabled push delivery, relevant installation identifiers and notification payloads.

OpenStreetMap tiles and Nominatim geocoding support map/address features. Direct map requests can disclose your IP and requested area to the provider; server geocoding sends relevant lookup information. Google Analytics is included on the website. Enabled social sign-in and externally hosted resources may involve their providers when used.

Providers may use subprocessors under their applicable terms. Sharing is limited to relevant purposes with appropriate safeguards. Necessary information may also be disclosed for valid legal obligations, rights protection or fraud investigations. Business transfers may involve relevant information with required notice/protections, not blanket permission for unrelated sale.

13. Website analytics, cookies and local storage

The website includes Google Analytics to understand usage. Analytics may use cookies and process identifiers, page activity and technical device/request information. The current website does not use only essential storage. Analytics settings, browser restrictions and Google’s practices affect collection/retention.

The admin site stores authentication token and user-session information in browser local storage. The app uses relevant device storage for authentication/preferences and may temporarily cache service responses. Signing out and browser/device controls affect these records.

Manage cookies/site data through browser settings; blocking necessary storage may affect login/preferences. The current website has no separate analytics-consent preference panel. Additional controls required for a supported market must be addressed before operation there; this policy alone is not a consent mechanism.

14. Marketing and sale of information

We do not sell personal customer information. Operational sharing and merchant visibility do not authorize recipients to sell customer data.

Optional promotional messages require separate opt-in where used. Signup or Terms acceptance is not that opt-in. Promotional permission can be withdrawn through the available unsubscribe/support route. Necessary verification, security and transaction notices are service communications handled separately.

15. International processing

The primary production VPS and self-hosted database are in Oracle Cloud’s Mumbai, India region. Information is not stored exclusively in Pakistan. Resend states that stored data is held in the United States regardless of a domain’s sending region. Firebase and other Google services may use global infrastructure.

Mapping, analytics, delivery, payment institutions and other providers may process information in additional countries under their operations and applicable terms. We do not promise every provider record stays in one country. International operations/transfers must be assessed against applicable requirements and appropriate safeguards.

16. Retention, journals and backups

Information is kept for relevant service, support, security, financial and legal purposes, considering record type, account status, disputes and applicable obligations. There is currently no uniform fixed automatic deletion period across all database records, support tickets, server logs and backups.

The notification worker targets delivered notification rows older than 10 days. Pending/scheduled deliveries and separate activity/audit records are excluded, so this is not a promise that every copy of message information disappears after 10 days.

Current access/backend logs use the system journal without a configured fixed day-based retention period. Storage limits, system operation and rotation affect availability. We do not promise a 90-day log period.

Operational/deployment backups exist without a currently configured fixed automatic expiry. Deleting a live account does not immediately remove all backup copies. Copies remain restricted and are removed through operational maintenance and applicable retention review; no 90-day automatic purge is promised.

Necessary payment, referral, withdrawal and fraud/dispute records can outlast closure for the limited purposes described here. This does not authorize indefinite retention of unrelated information. Contact us about a particular record or retention concern.

17. Account closure and deletion

Request deletion through the app or public instructions at https://trypunchy.site/delete-account. If you cannot access the app, email support.punchy@gmail.com. Reasonable identity checks, such as registered-email verification, may protect your account.

Deletion can permanently remove wallet access, progress, unredeemed rewards and relevant records. Recreating an account does not automatically restore them. Business closure can affect listings, staff and customer programs; outstanding rewards and financial matters should be addressed.

Financial-history protections can require support-assisted business closure. Current payout-account details may be removed while necessary historical withdrawal, payment, referral or audit records remain. Continued retention is assessed against stated purposes and applicable requirements.

Uninstalling, disabling notifications, cancelling a subscription and deleting an account differ. We cannot guarantee deletion of records independently controlled by merchants, banks, wallet operators or other recipients. Provider identifiers and backups may follow provider-specific deletion processes.

18. Privacy rights and requests

You can update available profile fields, manage permissions/notification choices and request deletion. Applicable law may also provide access, copy, correction, erasure, portability, restriction, objection or consent-withdrawal rights.

Email support.punchy@gmail.com with enough information to identify the account/request. We may verify identity proportionately. Our acknowledgment target is two working days, not a guaranteed resolution time or replacement for statutory deadlines. Reasons for a limitation or refusal will be explained where required.

You may approach an appropriate privacy/consumer authority where applicable. Contacting support does not remove that right or suspend legal deadlines.

19. Security

We use appropriate measures including protected authentication, access controls, HTTPS and encryption of payout-account details in the current referral implementation. Authorized administrative access is for relevant duties. This does not mean every field/backup is encrypted identically or that any system is completely secure.

Security incidents will be assessed and addressed with notifications required by applicable law. Keep credentials confidential and report suspected misuse promptly.

20. Children and minimum age

Customer loyalty accounts, referral earnings and withdrawals are initially limited to people aged 18 or older. Merchant and authorized staff accounts are also for adults. We are not currently offering an under-18 guardian-consent account service.

Report suspected ineligible child accounts to support.punchy@gmail.com. We will review, restrict inappropriate access and arrange deletion or other handling appropriate to the circumstances and law. Future minor accounts would require separate eligibility, guardian and privacy arrangements before launch.

21. Changes and contact

We may update this policy as practices or requirements change. Effective date, last-updated date and version appear on this page. Material changes receive appropriate notice and new permission is requested where required. A policy update does not itself authorize an undisclosed new use.

Contact Ubada Hussain and Ali Raza Awan through support.punchy@gmail.com for privacy questions, correspondence details or rights requests.