1. Who we are
Midnight Snax ("we", "us", "our") operates the Midnight Snax mobile application and website at midnightsnax.org. We provide a digital loyalty stamp card platform for independent businesses and their customers.
2. What data we collect
We collect only the data necessary to provide the loyalty stamp service:
- Account information: your email address and password when you register
- Profile information: your first and last name, and date of birth (used to personalise your experience)
- Location data: your approximate location when using the app, to show nearby stores on the map. This is only collected while the app is in use and is never stored on our servers
- Stamp activity: records of stamps collected and rewards redeemed at participating stores
- NFC data: when you tap an NFC tag to collect a stamp, we read only the unique tag identifier. No other data is read from the tag
- Business information: if you register as a business owner, we collect your business name, address, and subscription details
- Payment information: payments are processed by Stripe. We do not store your card details — Stripe handles all payment data in accordance with PCI-DSS standards
3. How we use your data
- To operate and maintain your loyalty stamp account
- To show you nearby participating stores on the map
- To record stamps and reward redemptions
- To send transactional emails (e.g. subscription confirmations, receipts)
- To provide business owners with aggregated, anonymised analytics about their customers
- To comply with legal obligations
4. Data sharing
We do not sell your personal data. We share data only with:
- Supabase: our database and authentication provider, hosted in the EU
- Stripe: our payment processor, for handling subscription and add-on payments
- Resend: our transactional email provider, for sending confirmation emails
- Business owners: when you collect a stamp at their store, they can see that a stamp was issued. They do not see your name or email address — only anonymised activity data
5. Data retention
We retain your account data for as long as your account is active. If you delete your account, your personal data is deleted within 30 days. Anonymised, aggregated analytics data may be retained indefinitely.
6. Your rights (GDPR)
If you are based in the EU or EEA, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data ("right to be forgotten")
- Object to or restrict processing of your data
- Request a copy of your data in a portable format
To exercise any of these rights, contact us at hello@midnightsnax.org.
7. Cookies
Our website uses only essential cookies required for authentication (keeping you logged in to the business dashboard). We do not use tracking or advertising cookies.
8. Children's privacy
Midnight Snax is not directed at children under 13. We do not knowingly collect personal data from children under 13.
9. Changes to this policy
We may update this privacy policy from time to time. We will notify you of significant changes by email or via an in-app notice.
10. Contact
For any privacy-related questions, contact us at hello@midnightsnax.org.