Last updated: November 1, 2026 · Effective November 1, 2026
Pnchy is built for your neighborhood, so we believe you have a right to know exactly how your information is handled. This policy covers the Pnchy website, Pnchy Lite (the pay pages, the shopper account, and the Pnchy Lite app for businesses), and is written to be read, not buried.
We never sell your data and we do not share it for advertising.
Stripe handles your card. Pnchy and the business never see or store your full card number, security code, or PIN.
Businesses see "Customer #12", not your email address. A receipt is not a marketing sign-up.
You can delete your account inside the app at any time.
Subscriptions are handled by Apple or Google. Pnchy never sees your card number or your Apple or Google account details, only the status of a plan and an anonymous purchase ID tied to your business.
Pnchy is a community loyalty and payments platform that connects local businesses with the neighborhoods they serve. Pnchy Lite is operated by Pnchy, LLC ("Pnchy", "we", "us"), mailing address 485 Foley Street, Unit 621, Somerville, MA 02145, USA, registered office 131 Continental Dr, Suite 305, Newark, Delaware 19713. If you have any questions about this Privacy Policy or would like to exercise your rights, contact us at hello@pnchy.app. We will respond within 30 days.
For payments and loyalty, Pnchy decides why and how your information is used, and we are responsible for it under this policy. The business you pay is separately responsible for how it uses what you tell its staff.
We collect only what we need to operate Pnchy. The table below describes each category, why we collect it, and where it comes from.
| Category | Purpose | Source |
|---|---|---|
| Email address and name | Receipts, your shopper account, loyalty, and (only if you opt in) marketing and early access updates | Submitted by you or entered by staff at checkout |
| Purchase details | The business, amount, discount, tip, payment method and status, and receipt destination, used to process payments, send receipts, and handle refunds and disputes | Created when you pay |
| Payment identifiers | References, and a card or bank fingerprint (a one-way code, not the card number), used to prevent fraud and to decide whether you are a returning customer at a business | Stripe |
| Loyalty activity | Pnches earned, reward requests, and reward confirmations at each business | Created when you pay or claim |
| Device token | A random identifier stored in your browser's local storage to recognize a returning device at a business, apply the welcome discount correctly, and limit abuse | Your device |
| Marketing choices | Records of whether you confirmed and later unsubscribed from a business's emails or the Pnchy list | Submitted by you |
| Business account details | For business owners: sign-in email and password (stored hashed by our authentication provider), business name, emoji, reward text, reply-to email, time zone, settings, Stripe account reference, and push notification token | Submitted by you |
| Subscription and purchase details | For business owners who buy Pnchy Pro: the plan (monthly or annual), its status, renewal and end dates, whether it is set to renew, whether a purchase is a store test, the store's transaction identifier, and an anonymous identifier that links the purchase to your business. Used to start, keep, or end Pro, to stop one plan being used by several businesses, and to handle refunds and disputes with the stores. We do not receive your card number, Apple ID, or Google account details | Apple or Google, and the business app |
| Receipt branding | For Pro businesses: the logo, banner text, colors, font, and background chosen for receipt and campaign emails. Logos are checked, resized, and re-encoded by us, and stored where email programs can load them | Submitted by you |
| Sending domain | For Pro businesses that send from their own domain: the domain name, the sender name you choose, and the DNS records and verification status needed to send email from it | Submitted by you, and Resend |
| Dispute and amount-owed records | For business owners: disputes raised on your sales (amount, reason, dates, and outcome), the evidence you submit, the Stripe dispute fee, amounts owed and recovered, and your consent to account debits (its version and time). Used to respond to disputes, recover amounts you owe, and meet accounting and legal obligations | Stripe, and the business app |
| Content you submit | Business names, reward text, email campaign text, messages to us, and feedback, used to provide the service and keep it safe (see our Terms of Use) | Submitted by you |
| Device location and Bluetooth | For the Pnchy Lite app for businesses only: location for payment security and fraud prevention, and Bluetooth to connect a card reader, when you allow it | Your device |
| Usage and technical data | Product events (such as screens and steps completed), error details, IP address, and device type, used to run, secure, and improve the service. Pnchy Pro screens record events such as plan viewed, purchase started, and purchase completed, with the plan type and where you came from, never payment details. Autocapture and session replay are off, and nothing you type on the pay page is recorded | Your device and PostHog |
| Website analytics | Anonymized visit data about the marketing website (consent required) | Google Analytics 4 |
| Message content | To respond to your inquiry or feedback | Submitted by you via email or form |
We do not collect government-issued identification or sensitive personal data as defined under applicable law, and we do not ask for your full card number, security code, or PIN. Do not include sensitive information in any content you submit.
Providing the service: Processing payments, sending receipts, calculating discounts, tracking Pnches and rewards, and supporting refunds and disputes.
Security and fraud prevention: Detecting stolen cards, repeated or abusive requests, and misuse of charge codes, and enforcing limits.
Marketing, only with your confirmation: Emails from a business or from Pnchy are sent only after a separate confirmation (double opt-in). You can unsubscribe at any time, without penalty.
Improving Pnchy: Understanding how the product and website are used so we can fix problems and build better features. Website analytics run only after you consent.
Legal compliance: Satisfying tax, accounting, payment-network, and other legal obligations, and responding to lawful requests.
A business can see the payments it took, the amounts, tips, discounts, and refunds, and its customers' loyalty activity. It sees each customer only as an anonymous label such as "Customer #12", including on disputes about its payments. We do not give a business your email address, and a business cannot look up your history at other businesses. A business may have its own information from dealing with you in person, and it is responsible for how it uses that.
Providing your email for a receipt, paying, or earning Pnches does not enroll you in marketing. If you do opt in to a business's emails, the email is sent by Pnchy on the business's behalf, and the business does not receive your address.
Content that business owners submit, such as a business name, reward text, and email campaign text, is stored by us, shown to customers on pay pages, receipts, and emails, and may be checked automatically or reviewed by us to enforce our Terms of Use, including the rules against objectionable content. If you report content, we use the report and the information in it to investigate and respond. We may keep removed content and related records for as long as needed to enforce our terms, resolve disputes, or meet legal obligations.
Pnchy Pro is an optional paid plan for business owners. Here is how it affects your information.
Subscriptions. Pnchy Pro is sold only through the Apple App Store and Google Play. The store charges you and keeps your payment details. We receive signed purchase and renewal messages from the store so we can start, keep, or end Pro, and we link a plan to one business with an anonymous identifier, not your name or email. We use these records to provide Pro, prevent misuse, handle refunds and disputes with the stores, and meet tax and accounting obligations.
Branding. The logo, banner text, and colors you add are used in emails to your customers, and we may check or review them to enforce our Terms of Use. A logo is stored where anyone with its link can open it, because email programs must be able to load it, so do not upload anything private. We remove image metadata when we re-encode a logo.
Your own sending domain. If you send from your own domain, we register it with Resend and keep its name, your chosen sender name, and the DNS records and status Resend gives us. Email goes out from your domain only after every record is verified. A domain that is not verified within 72 hours is released. If your plan ends, email returns to Pnchy's address straight away, and we remove the domain from Resend 30 days later.
Pnchy news. If you join the Pnchy list and confirm it, we may send you Pnchy news and rewards. We record which business you joined through and use that business's plan to decide the sender: Pnchy's own address, or the business's name "via Pnchy" if that business is not on Pro. They are never sent from a business's own domain. Every email has an unsubscribe link, and businesses do not receive your email address.
When a Pro plan ends, we keep your saved branding so it comes back if you resubscribe, except that a sending domain is removed after 30 days. If a business deletes its account, its branding, logo, and sending domain are deleted too, and we keep only a subscription record, as described under data retention below.
We use Google Analytics 4 on the Pnchy marketing website to understand which pages are visited, how long visitors spend on them, and their approximate geographic region. It collects only anonymized and aggregated data and is not used to collect names, email addresses, or payment information. Pnchy Lite pay pages and apps do not use Google Analytics.
Analytics are activated only after you provide explicit consent through our cookie banner. If you decline, Google Analytics operates in cookieless mode and no tracking cookies are placed on your device. You may withdraw consent at any time by clearing the pnchy_cookie_consent value from your browser's local storage.
We do not sell, rent, or trade your personal information, and we do not share it for cross-context advertising. We share it only with the following:
Stripe: Processes card, wallet, and bank payments and verifies businesses, under its own privacy policy (stripe.com/privacy). If a customer disputes a payment, Stripe also receives evidence we or the business submit: purchase details such as the date, amount, receipt delivery, and refund history, but not the customer's email address or name, plus anything the business adds.
Supabase: Hosts our database, authentication, file storage (for example, receipt logos), and server functions.
Resend: Delivers receipts, confirmations, campaign emails, and Pnchy news, and registers and verifies a business's own sending domain when it uses Pnchy Pro.
PostHog: Receives product usage events. Business owners are identified only by an internal account ID, and shoppers are never identified.
Expo, Apple, and Google: Expo delivers push notifications to the business app. Apple and Google distribute the app, bill and manage Pnchy Pro subscriptions, and tell us the status of a subscription. Apple Pay and Google Pay involve the wallet provider you choose.
Hosting and analytics providers: Our websites are hosted by Vercel (Pnchy Lite) and GitHub Pages (this site), and, if you consent, Google processes anonymized website analytics.
Legal or regulatory bodies and business transfers: We may disclose information where required by law, court order, or to protect the rights, property, or safety of Pnchy or our users, and as part of a merger, acquisition, or sale of assets, with notice to you.
These providers act on our instructions and may use your information only to provide their services to us, except Stripe, which also uses payment information as an independent controller as described in its policy.
Pnchy is based in the United States and our providers may process information in the United States and other countries. Where required, we rely on appropriate safeguards for transfers, such as standard contractual clauses.
Depending on your jurisdiction, you may have some or all of the following rights with respect to your personal data:
| Right | Description |
|---|---|
| Access | You may request a copy of the personal data we hold about you. |
| Correction | You may request that we correct any inaccurate or incomplete information. |
| Deletion | You may request that we delete your personal data, subject to any legal retention obligations. You can also delete your account in the app. |
| Data portability | You may request your data in a structured, commonly used, machine-readable format. |
| Withdraw consent | You may revoke consent to analytics by clearing your cookie preference, and to location or Bluetooth in your device settings. |
| Opt out of marketing | You may unsubscribe from marketing communications at any time using the link in any email. |
| Object or restrict | You may object to or request a limitation on certain types of processing. |
| Do not sell or share | We do not sell or share personal data, so there is nothing to opt out of. |
| Non-discrimination | Exercising your rights will not result in a reduced level of service (CCPA requirement). |
To exercise any of these rights, contact hello@pnchy.app. We may need to verify your identity, and you may use an authorized agent. We will respond within 30 days. If you are located in the EU or UK and believe your rights have not been respected, you have the right to lodge a complaint with your local supervisory authority. Residents of some U.S. states may appeal a refusal by replying to our response.
Pnchy is designed to respect applicable privacy laws across multiple jurisdictions. Below is a summary of how each framework applies to us.
GDPR
European Union. All data subject rights apply. We rely on consent for analytics and marketing, and on contract and legitimate interests for payments and fraud prevention.
UK GDPR
United Kingdom. The same framework as the EU GDPR applies following the UK's exit from the European Union.
CCPA / CPRA
California. We do not sell or share your personal data. You have the right to know, correct, delete, and limit.
LGPD
Brazil. Processing is based on consent, contract, and legitimate interest. You have the right to access, correct, and delete your data.
US State Laws
Virginia, Colorado, Connecticut, Texas, Oregon, and others. Opt-out and access rights are honored for all residents.
PIPEDA
Canada. We collect data only with your knowledge and consent. You may access and correct your data upon request.
POPIA
South Africa. We adhere to the principles of lawful processing and data minimization as required by the Act.
Under GDPR and UK GDPR our legal bases are: consent (Article 6(1)(a)) for analytics and marketing; performance of a contract (Article 6(1)(b)) for payments, receipts, accounts, and loyalty; legitimate interests (Article 6(1)(f)) for security and fraud prevention; and legal obligation (Article 6(1)(c)) for tax and accounting records.
We keep personal data only as long as needed for the purposes in this policy. Payment, receipt, and loyalty records are kept as long as needed for accounting, tax, refunds, disputes, and payment-network rules, and may be kept in anonymised form after that. Marketing preferences are kept so we can honor unsubscribes. Early access registrations and form submissions are kept for up to two years. Analytics data on the website follows Google's retention settings, which default to 14 months.
Pnchy Pro subscription records (the plan, its dates, and the store's transaction identifier) are kept for 7 years after the plan ends, including after a business deletes its account. When an account is deleted, the business's name, contact details, branding, and logo are removed, but the store's transaction identifier stays so that refunds and disputes can be matched with Apple or Google. Branding and logo files are deleted when a business deletes its account. A sending domain is removed from our records and from Resend 30 days after a plan ends, or sooner when the account is deleted. Dispute, amount-owed, and account-debit consent records are kept for 7 years after the matter is closed, including after a business deletes its account.
When you delete your account, a business is deactivated and anonymised, and a shopper's personal details are anonymised. Some transaction records and a one-way record that a device or card has paid at a business remain so that the ledger stays accurate, refunds and disputes can be handled, and the welcome discount cannot be reset by deleting an account.
Pnchy is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has given us information, contact hello@pnchy.app and we will delete it.
We use industry-standard technical and organizational measures: encryption in transit, access controls that restrict who can read data, rate limits against abuse, and payment handling by Stripe, which is PCI DSS Level 1 certified. No system is entirely immune to risk. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.
Please contact us first at hello@pnchy.app; most concerns can be resolved quickly. Any remaining dispute about this policy is governed by the dispute and arbitration terms in our Terms of Use, including individual arbitration, the class action waiver, and the right to opt out within 30 days, except where the law gives you rights that cannot be waived, such as the right to complain to a data protection authority.
We may update this Privacy Policy as Pnchy evolves. When we do, the "Last updated" date at the top of this page will be revised. For material changes, we will notify you in the app or by email if we hold your address. Your continued use of Pnchy after a change means you accept the revised policy.