Rewaly ("we," "us," or "our") is a mobile application developed by Awaz Solutions that helps you organise, track, and manage your loyalty programs, gift cards, and coupons. This Privacy Policy explains how we collect, use, store, and protect your information when you use the Rewaly app and related services (collectively, the "Service").
By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the Service.
1. Information We Collect
1.1 Account Information
When you create an account, we collect the email address you provide for authentication purposes. We use a passwordless email OTP (one-time password) flow, so we never store or handle plaintext passwords.
1.2 Loyalty, Reward, and Membership Data
You may store the following types of information in the Service:
- Loyalty program names, categories, and descriptions
- Gift card numbers and balances
- Coupon codes and usage status
- Transaction records (amounts, dates, descriptions)
- Notes attached to cards or transactions
- Expiry dates and reward status
- Membership details including member numbers, provider and program names, membership tiers, duration type (fixed, recurring, or lifetime), start and end dates, billing cycles, and renewal information
- Membership card images you choose to upload
1.3 Device Information
We collect limited device information for security and push notification delivery, including:
- Device identifier (for per-device data isolation and session management)
- Push notification token for delivering notifications to your device
- Device platform (iOS or Android), operating system version, and app version
- Device name (the name assigned to your device, e.g. in its system settings) — shown to you when managing notifications across multiple devices
1.4 Usage Data
We collect minimal usage analytics such as app activity logs (e.g., when loyalty cards or rewards are created, updated, or deleted). These records are associated with your account and used solely to power the activity timeline feature within the app.
1.5 Workspace Invitation Data
When you invite another user to your workspace, we collect and process their email address in order to send them a workspace invitation email. The recipient's email address is used solely for the purpose of delivering the invitation and is not used for marketing or shared with third parties.
1.6 Gift Card Recipient Data
When another Rewaly user sends you a gift card through the Service, we collect the email address you provide on the gift card claim page to verify your identity and deliver the gift card to you. This email is used only for:
- Sending a one-time password (OTP) to authenticate the claim
- Confirming successful delivery of the gift card
If you do not have a Rewaly account, we will create one for you using the email address you provide so the gift card can be added to your wallet. No other personal information is collected during the claim flow. You are not required to maintain an account after claiming your gift card.
1.7 Purchase and Payment Data
If you use the in-app Shop to purchase gift cards, we collect order-related information including the products ordered, amounts, currency, and order status. Payment processing is handled by Razorpay, a third-party payment processor. We do not store your payment card number, CVV, or other payment credentials — those are transmitted directly to and held by Razorpay in accordance with their privacy policy and PCI DSS compliance. We retain order records (order ID, amount, status, and fulfilment details) to support your purchase history and in case of disputes.
Upon successful payment, the purchased gift card is automatically created and added to your Rewaly gift card wallet. We will send a confirmation email to your registered email address notifying you that the gift card has been added. This email contains no gift card details — card value and redemption information are accessible only within the Rewaly app. The gift card details are stored in your account as part of your regular loyalty and reward data and are subject to the same encryption and security measures described in Section 4.
When you purchase a gift card as a gift to send to another person, we collect the recipient's email address solely to deliver the gift card claim link. This email address is not used for any marketing or analytics purpose and is deleted once the gift card has been successfully claimed or the claim link has expired.
1.8 Order Help and Support Requests
If you submit a help request for an order (via the "Get Help" feature), we collect the title, description, and up to three photos you choose to attach. This information — together with your account email address and the relevant order and workspace identifiers — is shared with our third-party customer support platform, Zoho Desk (operated by Zoho Corporation), so that a support ticket can be created and our team can respond to you.
Rewaly does not ask you to upload identification documents, payment card details, passwords, or any other personal or sensitive information as part of a help request. You must not attach any screenshot or photo containing personal or sensitive information about yourself or any other person (including but not limited to ID documents, card numbers, or passwords) — attach only photos relevant to the issue you are reporting, such as a screenshot of the relevant app screen or order detail.
1.9 Region and Timezone Detection
Rewaly does notaccess your device's GPS or network-based location. To set sensible defaults (such as currency and date formatting), we read your device's language/region locale setting once per workspace and derive an approximate country code and timezone from it (for example, a device set to "English (United States)" resolves to country code "US"). This is a one-time, locale-based inference — not precise or coarse GPS location — and is stored as a workspace preference.
1.10 On-Device Cache
To support offline access, the app may cache certain data locally on your device using an encrypted SQLite database. This local cache stores a copy of your membership and loyalty data so that the app remains usable without an active internet connection. This data resides solely on your device and is cleared when you sign out or uninstall the app.
2. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the Service
- Authenticate your identity and secure your account
- Store and sync your loyalty data across sessions
- Send push notifications (e.g., expiry reminders) when you opt in
- Display your activity history within the app
- Send workspace invitation emails to users you invite
- Deliver gift cards to recipients via the gift card claim flow
- Respond to support requests, including order help requests you submit
- Set sensible currency and date-formatting defaults based on your device's locale
- Improve the Service and fix issues
We do not use your data for advertising, profiling, or selling to third parties.
3. Data Encryption and Security
Protecting your data is a core principle of Rewaly. We implement the following security measures:
- AES-256-GCM Encryption: Sensitive data such as gift card numbers and coupon codes are encrypted using AES-256-GCM before being stored. Encryption keys are derived per-workspace using HKDF (SHA-256) so that no two users share the same key material.
- TLS in Transit: All network communication between the app and our backend services is encrypted using TLS (HTTPS).
- Row Level Security (RLS): Our database enforces row-level security so that each user can only access their own data.
- Secure Token Storage:Authentication tokens are stored in your device's secure keychain (iOS Keychain / Android Keystore), not in plain storage.
- Passwordless Authentication: We use a custom auth flow with email OTP, eliminating password-related attack vectors.
4. Data Storage and Hosting
Your data is stored on secure cloud infrastructure that adheres to industry-standard security practices. We employ database-level encryption at rest and enforce strict access controls.
5. Tracking and Analytics
Rewaly does nottrack you across other companies' apps or websites. We do not participate in any cross-app or cross-site tracking, and we do not use advertising identifiers (such as Apple's IDFA or Google's Advertising ID). The only analytics we collect are internal activity logs within the app, as described in Section 1.4.
6. Third-Party Services
We use select third-party infrastructure providers to operate the Service. These providers process data only as necessary to provide their respective functionality, and we do not share your loyalty or membership data with any third party for marketing, advertising, or analytics purposes.
- Payment Processing (Razorpay):When you make a purchase through the in-app Shop, your payment is processed by Razorpay. Razorpay's collection and use of your payment information is governed by their own privacy policy. We recommend reviewing Razorpay's privacy policy before completing a purchase.
- Gift Card Fulfilment (Reloadly, YouGotAGift): Shop purchases may be fulfilled through third-party gift card aggregator partners such as Reloadly and YouGotAGift, who issue the actual gift card on the brand's behalf. These partners receive only the product identifier, order/workspace reference codes, and purchase amount required to fulfil the order — never your name, email address, or other personal information.
- Customer Support (Zoho Desk): If you submit an order help request, the details you provide (including any photos) are shared with Zoho Desk, our support ticketing provider, along with your account email address, so our support team can respond to you. See Section 1.8.
- Push Notification Delivery (Firebase Cloud Messaging): We use Firebase Cloud Messaging to deliver push notifications to your device. Firebase only receives your device's push token, not your loyalty or membership data.
- Authentication and Database Hosting: We use additional infrastructure providers for user authentication and database hosting, which process data solely to provide their respective functionality.
7. International Data Transfers
Your data may be processed and stored on servers located outside your country of residence. By using the Service, you consent to the transfer of your information to facilities outside your jurisdiction. We ensure that appropriate safeguards are in place, including encryption in transit and at rest, to protect your data regardless of where it is processed.
8. Data Sharing
We do not sell, rent, or share your personal information with third parties except in the following limited circumstances:
- Service Providers: As described above, we share limited data with infrastructure providers that are necessary to operate the Service.
- Legal Requirements: We may disclose your information if required to do so by law or in response to valid legal process (e.g., a court order or subpoena).
- Safety: We may share information if we believe it is necessary to prevent fraud, protect our rights, or ensure the safety of our users.
9. Data Retention
We retain your data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law.
10. Your Rights
Depending on your jurisdiction, you may have the following rights:
10.1 General Rights
- Access, correct, or delete your personal data
- Export your data in a portable format
- Withdraw consent for push notifications at any time via device settings
- Request restriction or objection to certain processing activities
10.2 Rights for European Economic Area (EEA) Residents (GDPR)
If you are located in the EEA, the UK, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):
- Legal Basis: We process your data based on (a) your consent when you create an account and use the Service, (b) contractual necessity to provide the Service, and (c) our legitimate interest in improving and securing the Service.
- Right to Erasure: You may request deletion of your personal data at any time.
- Right to Portability: You may request a copy of your data in a structured, machine-readable format.
- Right to Object: You may object to processing based on legitimate interest.
- Right to Lodge a Complaint: You may file a complaint with your local data protection authority.
10.3 Rights for California Residents (CCPA/CPRA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
- Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you.
- Right to Delete: You may request deletion of the personal information we have collected.
- Right to Opt-Out of Sale: We do not sell your personal information. As such, there is no need to opt out — but we honour this right regardless.
- Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.
10.4 Do Not Sell My Personal Information
Rewaly does not sell, rent, or trade your personal information to any third party for monetary or other valuable consideration. This applies to all users, regardless of jurisdiction.
To exercise any of these rights, contact us at support@rewaly.com. We will respond to verified requests within 30 days (or within the timeframe required by applicable law).
11. Account Deletion
You may delete your account directly from within the app via the account settings menu. You may also request account deletion by contacting us at support@rewaly.com. Upon deletion, all your personal data — including loyalty cards, rewards, transactions, and notes — will be permanently removed within 30 days, except where retention is required by law.
12. Children's Privacy
The Service is not directed to children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If we learn that we have collected data from a child without appropriate consent, we will delete it promptly.
13. Push Notifications
Rewaly may send you push notifications for expiry reminders and important account alerts. You can opt out of push notifications at any time through your device settings. Disabling push notifications will not affect the core functionality of the Service.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or by other appropriate means. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.
15. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us:
- Email: support@rewaly.com