Privacy Policy

Last updated October 11, 2026

The short version: your cards live on your device. Pointy Rewards has no accounts, no ads and no tracking. To see which features get used and to fix crashes, the app sends usage and crash reports, which carry a random install ID but never your name, contact details or cards. The app sends a card off your device only when you ask: to add it to Apple Wallet, where the server that makes the pass keeps none of your cards, or when you export your cards and choose where the file goes.

What the app stores, and where

For each card you add, Pointy Rewards keeps the store name, an optional category, the barcode type and its contents, the number shown on the card, the colors and pattern you picked, whether it's a favorite, pinned or archived, and when you added and last used it.

All of this is stored on your device only, in storage shared between the app and its home screen widgets so the widgets can show your cards. The app doesn't upload or sync it to us or to any other service, and it's removed when you delete the app. If you use iCloud Backup or back up your iPhone to a computer, Apple includes the app's data in that backup, as it does for other apps.

The app also remembers a few preferences on your device, such as your layout and sort order.

Camera

The app asks for the camera so it can scan the barcode on your loyalty cards. Scanning happens on your device. No photos or video are saved or sent anywhere. If you say no, you can still type a card in by hand.

Importing from screenshots

If you import cards from screenshots, you pick the pictures yourself with the system photo picker, so the app only sees the ones you choose and never your whole library. The barcodes and text are read on your device, and the screenshots aren't kept or sent anywhere.

Apple Wallet passes

A Wallet pass has to be signed by a server before your iPhone will accept it. When you tap Add to Apple Wallet, the app sends that card's name, number, barcode, category and colors, along with the pass pictures made from them, to our pass server over an encrypted connection.

  • The server signs the pass, sends it back, and keeps none of your cards. Its logs record only what happened to each request, such as that a pass was signed and how big it was, never your cards' names, numbers or barcodes, and they're deleted within a week.
  • To check that a request really comes from Pointy Rewards on an iPhone, the app uses Apple's App Attest. The first time, the server stores a public key that Apple confirmed belongs to the app on your device, with a counter it checks later requests against. The key isn't linked to your name, your Apple Account or your cards.
  • The server runs on Cloudflare. Like any website host, Cloudflare sees your IP address when the request arrives. We use it only to limit how many passes one address can make per minute, to stop abuse: Cloudflare keeps a count for each address for that minute, and we don't log it or keep it any longer.
  • Once a pass is in Wallet, Apple Wallet holds it, and Apple's privacy policy applies to it there. Removing the pass in the app or in Wallet removes it from Wallet.

Nothing is sent if you never add a card to Wallet.

Exporting your cards

Settings lets you export every card as a file. The file goes only where you send it from the share sheet.

Siri, Shortcuts and widgets

Shortcuts, Siri and widgets can open or show your cards. They read the same on-device storage as the app and don't send your cards to us.

Usage and crash reports

To learn which features people use and to fix problems, the app sends two kinds of reports. Both go to service providers that process them on our behalf.

  • Usage events, through PostHog. Which screens are opened and which features are used, such as adding a card or showing a barcode, with the app version, iOS version and device model.
  • Crash and error reports, through Sentry. When the app crashes or hits an error: what went wrong, the steps just before it, and the same app, iOS and device details.

Both reports carry a random ID that the app creates when it's installed, so reports from the same install can be grouped together. That ID isn't tied to your name, email, Apple Account or advertising identifier, and it changes if you delete and reinstall the app. The reports never include your cards' names, numbers or barcodes, and we don't store your IP address or work out your location from it.

We keep these reports only as long as we need them to improve the app and fix problems, and we don't combine them with data from other companies.

What we don't do

  • No accounts or sign-in.
  • No advertising, and no tracking across other companies' apps or websites.
  • No selling or sharing of your information.
  • No collecting of your location, contacts or anything else not described above.
  • No putting your cards in usage or crash reports.

If you have opted in to share diagnostics with Apple in your device settings, Apple may share crash reports with developers. Those reports don't contain your cards.

Because usage and crash reports aren't tied to you, we can't look up one person's reports. Deleting and reinstalling the app gives it a new random ID, so later reports can't be connected to earlier ones.

Children

Pointy Rewards isn't directed to children under 13. The random install ID in usage and crash reports is used only to keep the app working and to improve it. It's never used for advertising, to build a profile of anyone, or to contact anyone, and no other personal information is collected.

Changes

If the app starts handling your information differently, for example by syncing cards through your iCloud account, we'll update this page and the date at the top before that version ships.

Contact

Questions about privacy? Email support@westpointlabs.com.