Privacy policy

Last updated November 8, 2026

This policy explains what UsualPass collects, why, and the choices you have. We collect as little as the service needs and we never sell personal information.

Customers of a business

When you join a business's card or book with them, we store your name, phone number, optional email, Instagram handle and birthday month, your stamps, rewards, visits and bookings. We store this on behalf of that business so they can recognize you, give you rewards and run their bookings. The business can see this information and download it. Your phone number is used to find your card and is not used for marketing by UsualPass.

Businesses and their team

We store account details (names, email addresses, a scrambled version of each password), business details and settings, and records of stamps, bookings and payments made through the service.

Payments

Card details are entered into forms run by Stripe and go straight to Stripe. We never see or store full card numbers. We keep a record of each payment, such as the amount, date and card brand.

The iPhone and iPad app

The UsualPass app is for businesses and their team. It uses the camera only to scan customer cards when you tap Scan, and nothing is recorded or stored from the camera. If you allow notifications, we store a device token so we can tell you about new bookings, cancellations and payments. The app does not track you across other apps or websites and contains no advertising.

Wallet cards

If you add a card to Apple Wallet or Google Wallet, Apple or Google keep a copy of the card on your device and send you updates when it changes. Their own privacy policies apply.

Cookies

We use a small number of cookies that the service needs to work: one keeps team members signed in, and one remembers your card on your phone. We do not use advertising or tracking cookies.

Where data is kept and how it is protected

Data is stored with Cloudflare and processed by service providers who help us run the service (Cloudflare for hosting, Stripe for payments, Apple and Google for wallet cards, and an email provider for password resets). Data is encrypted in transit and at rest. Passwords are stored only as salted hashes. Data may be processed outside your province or country.

How long we keep it

We keep data while the business's account is open. A business can delete customers or close its account; we then delete the data within 90 days, except records we must keep by law, such as payment records.

Your choices

You can ask the business you joined to update or delete your information, or contact us and we will help. You can delete your own card from its page at any time, and remove a wallet card from your phone. When you do, the business keeps a short note that the card was deleted: your first name, the last 4 digits of your number, how many stamps and visits you had and the reason if you gave one. Business owners and team members can delete their account from the Account page in the app or on the website.

Changes

If we change this policy in an important way, we will post the update here and tell account owners.

Contact

Send us a message from the Support page or email abouadmaa@gmail.com. We reply by email, usually within two business days.