Privacy policy

Corner (“corner rewards”) is a digital wallet for loyalty cards at small local shops. We collect as little as we can, use it only to run your cards and the shops' programs, and never sell it. Corner is operated by Alec Concejero, Metro Manila, Philippines, who is the personal information controller for this service.

Questions or requests: alecconcejero@gmail.com. For a plain explanation of how guest cards work, see How your cards work.

Customers: what we collect

• Without an account (guest): a random ID kept in your browser, the cards you add, and your stamps, points, visits and rewards. No name, email or phone number.
• Card key (optional): if you make one, we store only a scrambled version (a hash) so we can match it when you move your cards. We can't read the key itself.
• If you sign in: your email address, and your name if your Google sign-in provides it.
• Optional profile details: a display name and a mobile number, only if you add them.
• Activity: when you earn, redeem or add a shop, and at which branch. This is what makes stamps and points work.
• Preferences: pinned and muted shops, and your theme.
• Location: only when you tap “Show cafés near me”. It is used for that one search and not stored.
• Basic usage events: for example, that a card was added or a reminder was dismissed, tied to your random ID.

We don't collect your contacts, payment cards, government IDs or location history.

What shops can see

A shop sees only its own members: a member number, your visits, stamps, points and rewards at that shop. Shops never see your cards at other shops.

While you wait at the counter for a stamp or a reward, staff see your first name (from your account or the name you set in Profile) or, if you have none, a guest code like “Guest · 3F9A”. Your screen shows the same, so they can approve the right person.

Your name, email and mobile number are shared with a shop only if you turn on “Share my name and contact” for that shop. It's off by default, including after you sign in, it's chosen one shop at a time, and you can turn it off anytime on the shop's page. Shops that receive your details must use them only to serve you, under the Data Privacy Act.

Shop owners: what we collect

• Your account email and name, and the shop's main point of contact (name, email and mobile number), used for approval, billing and urgent issues.
• Shop details you enter: name, address and map pin, logo, card design, stamp image, rewards, promos and announcements. Most of these are shown publicly on your shop page and cards.
• Address search sends what you type, and your device location if you tap “Use my location”, to OpenStreetMap services to find the address.

Why we use it

• To run your cards: add stamps and points, unlock and redeem rewards, and keep them across devices if you sign in or use a card key.
• To send what you ask for: sign-in codes, reward reminders and announcements from shops you added (you can mute any shop).
• To review and support shops, prevent abuse (such as repeated scans), and fix problems.
• To understand, in aggregate, how Corner is used so we can improve it.

Our legal bases are your consent (for sharing with shops and optional details) and what's needed to provide the service you asked for.

Who processes it for us

• Supabase (database and sign-in), servers in Singapore.
• Vercel (website hosting).
• Brevo (sending email).
• Google (only if you use Google sign-in or add a card to Google Wallet) and Apple (only if you add a card to Apple Wallet).
• OpenStreetMap services (map tiles and address lookups in the shop dashboard).

These providers process data only to run Corner. Some are outside the Philippines; we use providers with appropriate safeguards.

How long we keep it

• Your cards and history stay while you use Corner. Guest wallets with no activity for 24 months may be deleted.
• When you delete your account (Profile › Delete account), your cards, history and contact details are removed within 30 days, except records we must keep by law.
• Encrypted backups are kept for up to 90 days, then deleted.

Your rights

Under the Data Privacy Act you can ask to be informed, access, correct, delete or object to the processing of your data, ask for a copy in a portable format, and complain to the National Privacy Commission (privacy.gov.ph). Email us and we'll respond within 15 days. Many controls are built in: muting shops, turning off contact sharing, and deleting your account.

Security

Data is encrypted in transit, access is limited by database rules, card keys are stored only as hashes, and staff approve every stamp at the counter. No system is perfectly secure; if a breach affects you, we'll tell you and the National Privacy Commission as the law requires.

Children

Corner isn't meant for children under 13. If a child under 13 created an account, contact us and we'll delete it.

Changes

If we change this policy in a meaningful way, we'll update the date above and tell you in the app before it takes effect.