The short version
Nook Wallet is a digital loyalty card service. We collect the minimum needed to keep your stamps working: who you are, which shops you joined, and when you visited. We do not sell your data, we do not run ads, and we do not share your information with anyone except the shop whose card you signed up for and the vendors that run our service.
Who we are
Nook Wallet is operated by Woosang Shin (New Jersey, USA). Questions about this policy? Email
[email protected].
What we collect
Customers (people collecting stamps)- Your nickname or display name, and your card number (e.g. NOO12345).
- Your email and name, if you sign in with Google or create an account with a password. Passwords are stored only as a one-way hash — we never see them.
- Your birth month and day, only if you choose to give it, so a shop can send you a birthday reward. We do not ask for your birth year.
- Your stamp, point and coupon history for each shop you joined, including visit timestamps.
- Your approximate location, only while the wallet screen is open and only if you allow it in your browser. It is used on your device to sort nearby shops to the top and is never stored on our servers.
- Basic technical data such as your browser type and IP address, kept in server logs for security and troubleshooting.
Business owners
- Business name, owner email, phone and store address (address is used to place your shop on the map for nearby customers).
- Your loyalty card settings, coupons, and aggregate stats about your own customers.
What we never collect
- Payment card numbers, bank details, or any financial account information from customers.
- Social security numbers or government IDs.
- Your contacts, photos, messages, or files.
- Background or continuous location tracking.
How we use it
- To show your stamp balance and rewards, and to add a stamp when you tap an NFC stamp or a staff member enters your card number.
- To send notifications you asked for — a stamp was added, a reward is ready, a coupon arrived, or a birthday gift from a shop.
- To let you sign in and keep you signed in, so the right card gets the stamp.
- To give each shop stats about its own customers (visit counts, how many rewards were redeemed).
- To keep the service secure — for example a short cooldown between taps so one card can’t be scanned repeatedly by mistake.
Google sign-in
If you sign in with Google, we receive only your name, email address and profile picture from Google. We use it to create your Nook account and to recognize you when you come back on a different phone. That is the only thing we use Google for — your cards themselves live in Nook Wallet, not in any Google product.
Legacy note: a small number of early users added a pass to Google Wallet before we moved to Nook Wallet. For those existing passes only, we still send Google the shop name, card number and stamp balance so the pass doesn’t go stale. No new passes are created.Limited Use: Nook Wallet’s use and transfer of information received from Google APIs adheres to the
Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, and we do not sell it or transfer it to third parties except as needed to provide this service.
Who else sees your data
We share only what each party needs to do its job:
- The shop you joined — sees your display name, card number, stamp history and birthday month/day (if given). A shop can only see its own customers, never another shop’s.
- Supabase — database hosting.
- Railway — application hosting.
- Google — sign-in only (if you choose to sign in with Google).
- Resend — sending emails such as password resets and coupons.
We do not sell your personal information, and we do not share it for advertising or cross-context behavioral advertising.
How long we keep it
We keep your card and stamp history for as long as your account exists, so your progress isn’t lost. Delete your account and it all goes — permanently, within 30 days, including backups. Server logs are kept for up to 90 days.
Your choices
- See your data — open your wallet at nook-wallet.com/wallet.
- Remove one card — tap the card in your wallet and remove it.
- Delete everything — delete your account from your wallet screen, or email us and we’ll do it within 7 days.
- Stop notifications — turn them off in your browser or phone settings at any time.
- Turn off location — deny the browser permission; nearby sorting simply stops.
- Ask a shop to remove you — any shop can delete a customer from its own dashboard.
Children
Nook Wallet is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has signed up, email us and we will delete the account.
Security
All traffic is encrypted over HTTPS. Passwords are hashed with bcrypt. NFC stamps use one-time cryptographic counters so a tap cannot be copied and replayed. No system is perfect, so please use a password you don’t reuse elsewhere.
Changes
If we make a meaningful change to this policy, we will update the date at the top and, for significant changes, notify you in the app or by email.