Privacy Policy

PawPoints is a mobile application operated from Auckland, New Zealand, that lets dog walkers earn rewards at participating local shops and cafés. This policy explains what personal information we collect, how we use it, and your rights under the New Zealand Privacy Act 2020 and, where applicable, the Australian Privacy Act 1988, the European Union General Data Protection Regulation (GDPR), and the UK GDPR.

Contact for any privacy enquiry: support@pawpoints.co.nz.

When you use PawPoints we collect:

• Account data: email address, name, your city (chosen from a list at sign-up — not your GPS location), an optional suburb (shown in friend search so dogs with the same name are easy to tell apart), and your profile photo if you upload one.
• Dog information: dog name, breed, and age — used to set breed-appropriate walk targets.
• Merchant applications: if you apply to join as a business (in the app or on this website), your business name, your name, email, city and a phone number. We use the phone number for a verification call and to set up your store. It is shown to walkers only if you choose to display your contact details on your business listing (you set this at application and can change it any time by contacting us); it is never used for marketing, and is deleted if your application isn't approved.
• Merchant reward content: if you run a business on PawPoints, the rewards you create — their name, description, terms and any photo you upload — are published publicly in the app to walkers in your area. Reward photos are stored in a public bucket and are not private; only upload images you are happy to publish and have the right to use.
• Walk data: GPS location, distance, duration, and a verification photo taken at the end of each walk.
• Nearby cafés (on your device only): the Rewards screen uses your device's current location to sort cafés and partner businesses by distance. This matching happens entirely on your device — your location is never sent to our servers, stored, or shared for this feature.
• Device data: a push notification token tied to your device, used to deliver in-app notifications.
• Crash and diagnostic data: if the app crashes or hits an error, we collect a crash report (including device model, operating system version, and a technical stack trace) through our crash-reporting provider, Sentry, so we can fix the problem.
• Redemption history: which rewards you redeemed at which partner business, and when.
• Social activity: friend connections within the app and any comments you post on shared walks.

• To run the core service — track walks, award points, generate redemption codes, and confirm them at partner businesses.
• To match your dog's walks to a breed-appropriate target (using the breed and age you provide).
• To send push notifications about your own activity — friend requests, accepted friendships, comments and shared walk photos. We never use push notifications for advertising or marketing. You can disable notifications in your device settings at any time.
• To show cafés and partner businesses near you, sorted by distance — computed on your device; your location does not leave your phone for this.
• To show offers and promotions from partner businesses in your country. Your city is the one you choose from a list — we never use GPS for this.
• To detect and prevent fraudulent redemptions.
• To improve the app (aggregated and de-identified usage data only).
• Walk photos you keep can also be saved to your phone's own gallery (you can turn this off in Settings → Walk Photos). This happens on your device only. We never browse your photo library — the only photos that reach us are the ones you pick yourself (a profile picture, or a reward photo if you run a business on PawPoints).

We do not sell your personal information to third parties.

We use Supabase as our backend provider. Your data is stored on Supabase's infrastructure (currently in their default region, which may be outside New Zealand). Supabase is a third-party processor bound by their own privacy commitments — supabase.com/privacy.

Push notifications are delivered via Expo's push service. Walk photos are stored in Supabase Storage. Crash and diagnostic reports are processed by Sentry (sentry.io/privacy). These providers may store data outside New Zealand and Australia.

• You: can see all of your own data inside the app at any time.
• Friends (within PawPoints): can see your name, dog name, and any walks/photos you share with them.
• Partner businesses: see only your redemption code and the reward being claimed — not your account, walk history, or any other personal information.
• PawPoints administrators: can access account and redemption records for fraud review and customer support.

Our mascots, Hugo & Daisy, are the founder's own fur babies — playing as the faces of PawPoints to celebrate happy, healthy walks for dogs and their humans. With the founder's consent, their walk photos are featured publicly on our website.

This applies only to accounts we specifically designate as mascots. Your photos are never made public — your walk photos stay private to you and the friends you share them with, as described above.

Under the New Zealand Privacy Act 2020 you can:

• Request a copy of the personal information we hold about you.
• Ask us to correct anything that's wrong.
• Ask us to delete your account and personal data.
• Withdraw consent at any time by uninstalling the app and emailing us to confirm deletion.

To exercise any of these rights, email support@pawpoints.co.nz. We'll respond within 20 working days.

If you use PawPoints in Australia, the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs) also apply to how we handle your personal information. You have rights equivalent to those described above, including the right to access and correct your information and to make a complaint.

If we cannot resolve a privacy complaint to your satisfaction, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

If you use PawPoints in the European Union or the United Kingdom, the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to how we handle your personal information.

We rely on the following legal bases: performance of a contract for the core service (tracking walks, awarding points, processing redemptions), consent for optional features such as uploading photos and enabling notifications (which you can withdraw at any time), and legitimate interests for fraud prevention and app diagnostics.

In addition to the rights described above, you have the right to:

• Receive a copy of your data in a portable format.
• Restrict or object to certain processing of your data.
• Not be subject to automated decision-making with legal effects — PawPoints does none.

Our services are hosted outside the EU and UK (see "Where your data is stored"). Where your data is transferred internationally, our processors rely on recognised safeguards such as standard contractual clauses.

If we cannot resolve a privacy complaint to your satisfaction, you may contact your local supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl; in the United Kingdom, the Information Commissioner's Office at ico.org.uk.

We keep your account data for as long as your account is active. If you request deletion, we remove your personal data within 30 days, except where we are legally required to retain certain records (such as financial transactions linked to partner business redemptions).

PawPoints is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided information to us, please contact us immediately so we can delete it.

We may update this policy from time to time. Material changes will be announced in the app and via email. The "Last updated" date at the top reflects the most recent version.

If you're not satisfied with how we handle a privacy concern, you can complain to New Zealand's Office of the Privacy Commissioner at privacy.org.nz.