Streaki Privacy Policy
Effective date: September 1, 2026 (replaces the version of August 28, 2026 — see Section 15 for what changed)
\nStreaki is operated by Risen Digital LLC, a Wyoming limited liability company (\"we,\" \"us\"). This policy explains what information Streaki collects, how we use it, who can see it, and the rights you have. We wrote it in plain language on purpose; the \"Key terms\" section at the end defines the words that carry legal weight.
\nThe short version: we collect what the app needs to work — your account, your points, your follows, your chats, and the visits a business records at its counter. Businesses see only their own relationship with you, and only your first name. We don't run ads, we don't sell personal information to anyone — and we never will. Any insights we publish beyond a single business are aggregated and de-identified, and we commit to never re-identifying them. You can delete your account in the app at any time.
\nThis policy covers both sides of Streaki: the customer app, and the counter app used by business owners and their staff. Section 5 is written for the people who work at a business on Streaki.
\n1. Information we collect
\nWe collect five kinds of information. Later sections refer back to these categories.
\na. Information you provide. Your email address and display name when you create an account. If you sign in with Google or Apple, we receive your name and email from them (Apple lets you hide your email; that works fine with Streaki). The messages you send. Quote and booking requests you send a business — the description you type, the times you say you prefer, and any photos you attach to them. Ratings and private feedback you choose to leave for a business.
\nb. Your activity. The neighborhood (zone) you select, the businesses you follow, your points balances and reward history, coupons and flash offers you claim, earn codes you enter, posts you open, your visit streak at a business and your neighborhood Pass streak, whether a referral tag was used when you claimed an offer, and your notification choices. We collect this to run your loyalty balances, show your inbox, and honor your rewards.
\nc. Information businesses record about you. When you scan your Streaki QR code at a participating business, that business's counter app creates a record of the visit through Streaki. That record contains:
\n- the business, the date and time, and the points awarded or redeemed;
- the amount of the purchase the staff member entered, which is how points are calculated;
- which staff member and which counter device handled it;
- for a charge that you confirm in the app later, the amount and whether it was confirmed or expired;
- the counter device's approximate location at the moment of the scan — we use this solely to detect fraudulent scanning (for example, awards issued far from the business), never to track you. It is a signal that flags a pattern for a human to look at; it never blocks your points, and we do not build a location history for you.
A business can also write private notes about you — up to 500 characters per note, written by a staff member, visible only to that business's owner, managers and staff, and never shown to other businesses. Notes cannot be edited after they are written, and every note about you is deleted when you delete your account. How a business handles its own records of your visits outside Streaki is up to that business — read its policies or ask it directly.
\nd. Device and technical information. A push-notification token (if you allow notifications), your device platform (iOS/Android), and basic app events. Events are stored against a separate internal identifier rather than your account id, and the properties we keep are limited to a fixed allowlist: business, post, category, screen, a duration, and a source. Free text is truncated and anything outside that list is dropped before it is stored. We do not build behavioral advertising profiles.
\ne. Counter-side information (business owners and staff). See Section 5.
\nWhat we do NOT collect: the customer app asks for no location permission at all — Explore and search work from the neighborhood you chose, not from your device's GPS. No contact lists, no browsing history outside the app, no advertising identifiers, and no artificial-intelligence profiling of you — there is no AI or machine-learning model anywhere in Streaki.
\n2. How we use information
\nWe use the categories above to:
\n- Operate the service: accounts, channels, points, rewards, streaks, chat, quote and booking requests, and notifications (categories a–e).
- Send you notifications you asked for or that concern your own account (Section 6).
- Prevent fraud and abuse: scan-location signals, scan and daily caps, and the nightly pattern review that protects both customers and businesses (b, c, d).
- Maintain and improve reliability: debugging and aggregate usage statistics (d).
- Comply with legal obligations.
We do not use your information for third-party advertising. We do not sell personal information — and we never will.
\n3. What businesses on Streaki can see
\nA business you interact with sees, for its own relationship with you only: your first name, your points balance and streak with them, your visits, purchase amounts and redemptions with them, your chats with them, quote or booking requests you sent them including any photos, ratings and private feedback you sent them, and any notes its staff wrote about you.
\nBusinesses never see your email address, your phone number, your activity at other businesses, your balances elsewhere, or any location history.
\nSome owner screens gather that same information into lists — for example the customers holding the most points, or the customers who referred the most people and how much those people have spent at that business. These lists carry first names only, and only for that business's own customers. Fraud alerts shown to an owner name the staff member and show the customer's first name; they never expose your account identifier.
\nWhen you send a business a message, that business can read it — its staff handle its chats, and a staff member can claim a conversation so a colleague knows it is being answered. A business can also switch on automated messages (\"welcome\" after a first visit, or a \"we miss you\" after a long gap). The owner writes the words, the message arrives in the thread you already have, and Streaki limits it to one automated message per business per customer every 30 days. A business may also set an automatic reply that answers outside its opening hours.
\nPrivate feedback you leave after a verified visit goes only to that business's owner and managers. It is never public and never appears in any insight or report product. An owner can reply to your feedback, and that reply reaches you — that is the only path back out of it.
\n4. Insights — the business's own numbers, and everyone else's
\nTwo different things share the word \"insights\", and they have different rules.
\nA business's own numbers. An owner can see results for their own shop: how many people came, how many came back, points given and spent, what redemption costs, offers claimed, how often the shop appeared in Explore, and what each staff member did on a given day. This is the business's own data about its own customers, and it is limited to what Section 3 already describes — first names, and only that business's relationship.
\nEveryone else's. Streaki may provide participating businesses and partners with aggregated, de-identified insights about neighborhood commerce — for example, \"coffee visits in ZIP 33024 rose 12% this quarter.\" These insights are statistical summaries. They never include names, individual purchase histories, or private feedback content; we do not report on groups small enough to single anyone out; and we commit to never attempting to re-identify individuals from aggregated or de-identified data, and we require the same of anyone we share it with.
\n5. If you work at a business on Streaki
\nIf you are an owner, a manager or counter staff, we also process information about you as a worker:
\n- your name on the business's roster, your role, and whether your account is active;
- a PIN, stored only as a salted, peppered digest — we never store the PIN itself and cannot recover it;
- your shift sign-ins, the counter device you used, and lockouts after failed PIN attempts;
- the work you did: every award, redemption, reversal, note, post and cancellation is attributed to you and is visible to the business's owner and managers, including a day-by-day recap of each person's activity, and fraud alerts that name you when a pattern involves your entries.
We process this for the business, on its instructions, so that the business can run its counter, its books and its own fraud review. The business decides who is on its roster and is responsible for telling its people what it sees — see Section 5 of the Terms of Service. Business records are the business's own; ask the business first, and contact us if it cannot help.
\n6. Notifications
\nTwo kinds of push notification exist, and they follow different rules.
\n- Content pushes — a business's posts. These are capped at two per follower per week, the cap cannot be bought or raised by any plan, and the owner chooses which posts spend one.
- Transactional pushes — messages about your own account: a chat message, a charge waiting for your confirmation (reminded at most once before it expires, plus at most one manual re-ask by the business), a points-expiry warning, a reward or referral bonus. These are not capped by the content rule, because they are about your own money and your own conversations.
You can turn notifications off at any time in your device settings. If you do, nothing else about your account changes.
\n7. When we share information
\nService providers. Streaki runs on infrastructure providers who process data on our behalf under confidentiality and security obligations: Supabase (database, authentication and file storage) and Google Firebase (push-notification delivery). Our marketing website is hosted by Wix, and the app-link files that make a scanned QR open the app are served as static files by Cloudflare — neither carries personal information about your account. If you sign in with Google or Apple, those providers process your sign-in under their own policies.
\nLegal reasons. We will share personal information outside Risen Digital only if we have a good-faith belief that disclosure is reasonably necessary to: (a) respond to valid legal process or an enforceable governmental request; (b) enforce our Terms of Service; (c) detect, prevent, or address fraud, security, or technical issues; or (d) protect against imminent harm to the rights, property, or safety of our users, Risen Digital, or the public as required or permitted by law.
\nIf our business changes hands. If Risen Digital LLC is involved in a merger, acquisition, or sale of assets, we will continue to ensure the confidentiality of your personal information, your information will remain subject to the protections of the then-current privacy policy, and we will notify you before your personal information is transferred or becomes subject to a different privacy policy.
\nNo one else. We do not sell or share your personal information with advertisers or data brokers.
\n8. Images you upload
\nPhotos you attach to a quote or booking request, and images a business publishes in a post, are stored as files with long, randomly generated addresses. Anyone who has the exact address can open the file, so treat an attached photo as something you have handed to that business rather than as a private document. Attachments are limited to 2 MB and to JPEG, PNG and WebP, and they are deleted when you delete your account. Do not attach identity documents, payment cards, or anything you would not want copied.
\n9. How long we keep information
\nRather than a fixed schedule for every data type, we retain information in four ways:
\n- Deleted when you act: your account and the personal data listed below — deleted when you use Settings → Delete account.
- Deleted on a rolling basis: operational and diagnostic data (such as push-delivery records, expired sign-in sessions and app events), kept only as long as needed to operate and secure the service.
- Kept while your account exists: your profile, follows, balances, streaks, chats, requests and reward history — the things the app needs to serve you.
- Kept longer only when required: records we must retain to satisfy legal obligations, resolve disputes, prevent fraud, or enforce our terms — kept only as long as those purposes require.
What deleting your account does, exactly. Your sign-in and email address are deleted. Your name and phone number are erased from your profile, which is left as an empty tombstone so a business's books do not break. We delete your follows, your registered devices and push tokens, your security keys, your unused reward claims, and every note any business ever wrote about you.
\nEverything you wrote is removed: the text of every message you sent is replaced with \"[deleted]\", the description you typed into a quote or booking request is replaced the same way, the photos you attached are deleted, the times you offered are cleared, and the comment you left on any rating is erased.
\nWhat is kept is the record a business needs for accurate books and an honest audit trail: points ledger entries, redeemed rewards, the rating you gave as a number, the shell of a request (its type, status, quote and dates — a charge can be attached to it), and the business's own messages and replies. None of it carries your name, email or phone number after deletion — it is linked only to an internal identifier with no identity attached. The points ledger and each business's audit log are append-only by design, which is what makes points and reversals provable; they are never rewritten. Residual copies in our encrypted backups expire on a rolling basis and are purged within 30 days.
\n10. Your rights and choices
\nWe extend the same core privacy rights to all Streaki users, regardless of which state you live in — not just where a specific law requires it:
\n- Know and access — ask what we hold about you and receive a copy. That includes the notes businesses have written about you.
- Correct — fix inaccurate information.
- Delete — in the app: Settings → Delete account, no request needed; or email us.
- Portability — receive your information in a usable format.
- Opt out of targeted advertising — not applicable: we do not do targeted advertising, sell personal information, or profile you for ads in the first place.
- Automated decisions — Streaki's fraud rules only raise a flag for a person to review. No automated system decides your points, refuses a scan, or closes your account on its own.
- Non-discrimination — exercising your rights never costs you features, points, or service quality.
To exercise any right, use the in-app controls or email support@streaki.app. We will verify the request comes from you and respond within the time your state's law requires (and promptly regardless). Where you live may give you additional rights; contact us and we will honor applicable law. California residents: we do not \"sell\" or \"share\" personal information as the CCPA/CPRA defines those terms.
\nYou can sign out anytime, and turn notifications off in your device settings anytime.
\n11. Security
\nData is encrypted in transit. We restrict access to personal information to those who need it to operate the service, under strict confidentiality obligations, and our systems enforce least-privilege access controls at the database itself: a business's staff can reach only that business's data, a customer only their own, and several tables (sign-in sessions, security keys, the raw event store) are readable by no client at all. Staff PINs are stored only as salted, peppered digests. Counter devices are named and listed, a new one raises an alert to the owner, and an owner can cut a lost device off remotely. No system is perfectly secure — if a breach affecting your personal data occurs, we will notify you as required by law.
\n12. Where your data lives
\nStreaki stores and processes data in the United States. If that ever changes, we will update this policy first.
\n13. Children
\nStreaki is not directed at children under 13 — or the equivalent minimum age specified by law in your jurisdiction — and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
\n14. Changes to this policy
\nWe will notify you in the app before material changes take effect, and you will have the opportunity to review the revised policy before choosing to continue using Streaki. We will not reduce your rights under this policy without your explicit consent.
\n15. What changed on September 1, 2026
\nStreaki gained a large number of features since the previous version, and this policy was rewritten to describe them rather than to change any commitment. New or newly explicit: purchase amounts recorded at the counter and charges you confirm in the app (1c); private notes a business can write about you, and their deletion with your account (1c, 9); quote and booking requests, including attached photos and how they are stored (1a, 8); streaks and the neighborhood Pass (1b); referrals and the advocate lists an owner sees (1b, 3); automated and out-of-hours business messages, and their 30-day limit (3); replies to your private feedback (3); the split between a business's own numbers and aggregated insights (4); a new section for owners and staff about the data the business sees about their work (5); the two notification classes and their caps (6); Wix and Cloudflare named as providers (7); and an exact description of what deleting your account erases — including the request text, request photos and rating comments a previous version of the app kept — and what it keeps (9). We also state plainly that the customer app requests no location permission and that Streaki contains no AI profiling (1).
\n16. Key terms
\n- Personal information — information that identifies you or is reasonably linkable to you, such as your name, email, or account activity tied to your account.
- Aggregated data — statistical summaries combined across many people (for example, visit counts for a neighborhood) that do not identify any individual. We never report on groups small enough to single anyone out.
- De-identified data — information from which identifying details have been removed so it can no longer reasonably be linked to you. We commit to never attempting to re-identify it and require the same of anyone we share it with.
- Transactional notification — a notification about your own account activity, as opposed to a business's published content.
17. Contact
\nRisen Digital LLC Email: support@streaki.app · Legal: legal@streaki.app Website: https://streaki.app
\n