Privacy Policy

The short version

• Your cards, codes, balances and notes are encrypted on your device. We can't read them — not on your phone and not on our servers.
• No ads, no ad trackers, no advertising ID. We don't sell your data or build a profile on you.
• The vault works offline with no account. Sync, notifications and wallet passes are all optional, and each is described below.

On your device

Your vault is stored on your device and encrypted with a key held in the device's secure key storage (the iOS Keychain or the Android Keystore). That key never leaves the device.

The camera is used only to scan barcodes and card text, and scanning and reading cards happen on the device — photos are never uploaded. Face ID, Touch ID and fingerprint unlock are handled by your phone's operating system — we never receive biometric data.

Encrypted sync (optional)

If you turn on sync, we create an account using your email address — from Sign in with Apple on iPhone or Sign in with Google on Android. Sync is end-to-end encrypted with a zero-knowledge design: your cards are encrypted on your device with keys protected by a passphrase only you know, before anything is uploaded.

For a sync account our server stores:

• Your email address.
• Authentication verifiers and encrypted key material derived from your passphrase and Recovery Kit — never the passphrase or the Recovery Kit itself.
• Your cards, balances and history as encrypted records we cannot decrypt, with their approximate size and timestamps.
• The devices signed in to your account: a device name, and when each was created and last seen.
• If you use a family to share cards: which accounts belong to it, and its cards encrypted so that only members can read them.

Anonymous usage analytics

The apps send anonymous usage events — for example, that a card was added — so we can see which features are used. Events carry no account, email, device or advertising identifier, no card contents and no exact amounts. Our server keeps only daily totals. You can turn this off in Settings at any time.

Notifications

Expiry reminders are scheduled on your device and need no server.

If you opt in to announcements, we store a push token issued by Apple (APNs) or Google (Firebase Cloud Messaging), your platform and your language. It is not linked to your account or email. Turning announcements off, or turning off notification permission, deletes the token from our server.

Wallet passes

Apple Wallet: to sign a pass, our server receives only a list of fingerprints (hashes) of the pass's files. Your card code never reaches us.

Google Wallet: Google's format requires our server to sign the pass itself, so its contents, including the card code, pass through our server in memory and are then sent to Google. We don't store them. Once a pass is in Google Wallet, Google's privacy policy applies to it.

Connecting gift-card sites

If you connect a gift-card provider's website to read your cards and balances, you sign in to that site inside the app. Your login and session stay on your device and go only to that site. We supply signed instructions for reading the site, but we never receive your login or what is read from it.

Purchases

Couponé Premium is bought through the App Store or Google Play. Payment is handled entirely by Apple or Google; we never receive your payment details.

This website

On this website, the only personal information we collect is the email address you submit to the early-access waitlist, used to tell you when Couponé launches and for occasional updates. We won't share or sell it, and won't send you marketing spam.

Server logs and security

Like any online service, our servers see your IP address when the app or website connects. We use it to limit abuse (for example, rate-limiting sign-in attempts) and to keep the service running. It is not stored with your account or your sync data.

Service providers

We use a small number of providers, each only for the purpose described: a hosting provider for our servers; Cloudflare for this website and network protection; Apple and Google for app distribution, purchases, sign-in, push notifications and wallet passes. We don't sell or share your personal information for advertising.

Retention and deletion

• Sync account data is kept until you delete your account. Delete it in the app (Settings → Danger Zone → Delete account) or as described on our account-deletion page — everything we store for the account is erased immediately.
• Push tokens are deleted when you turn announcements off.
• Analytics are kept only as daily totals that can't be tied to you.
• Waitlist emails are kept until you ask us to remove them.
• Cards stored only on your device are removed with "Delete wallet" or by uninstalling the app.

Delete your account

Your rights

You can ask us to access, correct or delete the personal information we hold about you — in practice, your email address and account records. Email us and we'll take care of it. Because your vault is end-to-end encrypted, we can't read or recover its contents for you; that data is always under your control in the app.

Children

Couponé is not directed at children, and we don't knowingly collect personal information from anyone under 16.

Changes to this policy

If we make material changes, we'll update this page and the date above. Continuing to use the service after a change means you accept the updated policy.

Contact

Questions about privacy? Email us at support@coupone.app.