Privacy Policy

Draft — not yet reviewed by counsel.

Last updated: 6 October 2026 · Version 2026-10-05

This version number is the one recorded against your agreement when you signed up. It is stored on your account beside the date, so we can always say which wording you actually saw.

Bobao is run by Bobao LLC, a California limited liability company. If you want to reach a person about anything here, write to hello@getbobao.com, or use Settings → Help & feedback, which reaches the same inbox with a reference number attached. The person accountable for how Bobao handles personal information is the Privacy Officer, reachable at hello@getbobao.com.

The short version

We hold what we need to keep your stamp cards working, and almost nothing else. A shop never learns more about you than a first name, an initial, how many times you have been, and when.

We may use advertising and measurement tools that share limited data with advertising and measurement partners, which can count as a "sale" or "sharing" under US state privacy laws. They run only after you say yes on the cookie notice — wherever you are, not only in the UK and EU. You can opt out at any time in Your privacy choices (Settings → Privacy & your data → Privacy controls), and your browser's Global Privacy Control signal counts as an opt-out. A shop never gets your name or your visits.

These tools may run anywhere Bobao does — our website at getbobao.com, including the landing page and public pages, the apps, the shop-owner and staff tools, and our emails — and may apply to visitors who do not have an account.

You can see everything we hold and download it as a file, at any time, from Settings → Privacy & your data. You can delete your account from the same place.

What we collect, and why

To sign you in

Your email address, and your password if you have set one. Six-digit codes when you ask for one. Which devices are currently signed in, so you can see them and end one you do not recognize.

Kept while the account exists.

To keep your cards

Every verified check-in: which shop, the date and time, and how it was confirmed. Your points ledger. The companions you have met. Reviews and photos you chose to post.

Kept while the account exists.

To sort shops and confirm you are at the counter

Your device's location, read while the app is open. The first time you open Shops, the app asks for it once; if you say no, it does not ask again on its own, and “Use my location” asks only when you tap it.

Never stored. There is no column for a coordinate anywhere in our database. It is read, used to answer "are you within about twenty meters of this counter", and discarded. If you would rather not share it at all, every other method works without it, and location is offered only at a shop that accepts it.

If you subscribe to Bobao Supporter

A Stripe customer identifier, the plan, and the renewal dates. Card numbers never reach us — Stripe takes the payment and we never see the card.

Kept by Stripe for as long as tax and accounting law requires.

If you opt in — usage counts

Which screens get used, recorded as a short word for what happened and the route pattern it happened on.

There is no field for who you are. Not blank, not hashed — the column does not exist, which is why we can say these can never be joined back to you, sold, or shared. It also means we cannot include them in your data download, because there is no way to find yours.

Kept for ninety days, then deleted automatically.

Off unless you say otherwise. Settings → Privacy & your data → Privacy controls.

When the app breaks — error reports

If something in the app fails, it sends us the error message, a shortened technical trace, the route pattern it happened on, the app's build and the time, so we can fix it. It goes to our own database, not to an outside service.

There is no field for who you are — no account, email or device. Email addresses, ids and long numbers are masked out of the message before it is sent.

Kept for thirty days, then deleted automatically.

If you opt in — two optional questions

An age band and, in your own words, your gender.

Both are optional, both are skippable, and skipping is not itself recorded as an answer. They are stored apart from the rest of your profile, and nobody at Bobao can see an individual's answer — we see counts, and a group of fewer than five people is not shown at all.

Kept until you delete them, which you can do on the same screen you gave them.

Bobao updates and service email

Bobao sends updates, announcements and service email about the app to everyone who signs up, on the waitlist or with an account.

When you join the waitlist, two optional boxes ask whether you are a customer, own a shop, or both. Neither is ticked for you or required; we keep the answer with your waitlist sign-up and use it only to count who is waiting.

If you opt in — newsletters and promotions by email

Occasional newsletters and promotions from Bobao. Never sold or shared with anyone for their own use. It is a separate, optional box when you create an account — never ticked for you, never required, and never part of agreeing to these terms — and the "Newsletters and promotions" switch in Settings → Notifications & location. The same optional, unticked box sits under the "Notify me" form on our home page; leaving it empty does not sign you up for newsletters and promotions. A yes on the waitlist is not carried into an account — if you later create an account, we ask again. We note when you turned it on, where, and which version of this policy was in force.

Stop any time with that switch, or with the unsubscribe link in any email we send. Either turns it off.

If you turn on push notifications

The address your browser gives us for delivering notifications to that device, the two keys that come with it, your time zone (so the one-a-day limit and any quiet hours you set follow your own clock), and when you turned it on. One entry per device. It does not include the device’s name or model.

Kept until you turn notifications off on that device, until the browser tells us the address no longer works, or until you delete your account.

If you turn on check-in by phone number

The US mobile number you give in Settings → Phone number at the counter, and when you gave it. Staff at a Bobao shop who type that whole number see its last four digits and your card at their shop, and turn the screen to you to confirm the four digits are yours, so they can stamp it when you cannot open the app. They never see the full number, your name, your email or your other cards. We do not text the number or use it for anything else, and it is never shared with advertising partners. Each time a member of staff looks a number up, we record who, at which shop, whom it found and when, and delete that record after a day.

Off unless you turn it on. Turning it off deletes the number at once; so does deleting your account.

If you opt in — the Supporter thank-you wall

If you are a Bobao Supporter and turn on "Show me on the thank-you wall", your first name and the initial of your last name are listed on the Supporter page. Anyone can see the wall, including people who are not signed in. Nothing else about you is shown.

Off unless you turn it on. It comes off the wall when you turn the switch off or your support ends.

If you invite a friend

Your invite code, and, when someone joins with it, a record that they joined through you and when the bonus for it was paid. You can see how many friends joined with your code; a friend can see that their code took.

Kept while both accounts exist.

What you send us

Support messages, and the page you were on when you wrote. Reviews, photos, and shop requests.

If you answer the satisfaction survey (in the app, or from its one email), your score from 1 to 5, any words you add, and when; read only by Bobao staff, never by a shop, and deleted with your account. The email carries no tracking pixel.

A record of your choices

Each time you accept these terms, answer the cookie notice while signed in, or change a choice in Your privacy choices, we write down what you chose, when, where you chose it, and which version of this policy was in force. The record cannot be edited, by you or by us — a new answer is a new line. It exists so we can show that we asked, and that we did what you said.

Kept after the rest of your account is deleted, holding your account number and nothing else about you — no name and no email — so we can still show what you agreed to if a claim or a regulator asks. It is kept for at least five years after the last choice recorded on it.

What we never collect

There is nowhere in Bobao to put any of these, which is a stronger statement than a promise not to use them:

• Your date of birth. We ask whether you are 13 or older; we never ask when you were born.
• Your ethnicity, income, household, religion, health or sexuality.
• Your contacts, or any history of where you have been.
• Any device fingerprint.

Advertising and measurement tools, where used, are described under “Selling and sharing for advertising” below, with how to opt out.

What a shop can see about you

This is the part people most want to know, so it is stated exactly.

A shop sees: a first name and one initial — "Sarah W." — the count on the card you hold with them, the time of a check-in, and how it was verified. Reviews you post carry the same first name and initial, and your verified-visit count at that shop, by your choice when you post. If you turned on check-in by phone number, staff who type your whole number also see its last four digits.

A shop never sees: your email address, your other cards, your level, your companions, your location, your age band, your gender, or anything you have written to us.

Shops with Bobao Partner Plus see aggregate counts about their own shop — how many regulars, how many cards finished, how many first visits. Never a list of people, and never an individual's history.

Shops may not use what they see to identify, contact or profile you, or combine it with data from anywhere else. That is in their agreement with us.

Who else touches your data

• Supabase — our database, authentication and file storage.
• Stripe — payments. Card details go to Stripe and never to us.
• Resend — sends our email.
• Vercel — serves the app.

Each is a processor acting on our instructions. Advertising and measurement partners are different: what we may share with them is described in the next section, with how to opt out.

Selling and sharing for advertising

What we may do. Bobao may use advertising, analytics and measurement tools from advertising, analytics and measurement partners — third-party analytics trackers, pixels, tags, software development kits, cookies and similar technologies such as local storage and device identifiers. These tools can share device or browser identifiers, a hashed email address or account identifier, and activity in the app — for example check-ins and pages viewed — with those partners, so they can measure and target advertising. A hashed email address or account identifier is shared only if you have said yes to "ad matching", described below. Under US state privacy laws, including the CCPA/CPRA, this may be a "sale" of personal information or "sharing" it for cross-context behavioral advertising.

Where they may run. Anywhere Bobao does:

• our website at getbobao.com, including the landing page and every public page;
• the web app, the Android app, and any future Bobao app, such as one for iPhone;
• the shop-owner tools — the counter, the dashboard and the card builder — and the staff and partner pages;
• our emails (see "In our emails" below).

They apply to everyone who uses those surfaces: customers, shop owners and their staff, and visitors who do not have an account. For a visitor without an account, what we hold is tied to a browser or device rather than to a person we can name.

What they may collect: device and browser identifiers; cookie identifiers; your IP address, and an approximate location derived from it, no finer than a city; browser and device type; the page that referred you; the pages you view and the actions you take on the website and in the app; and, if you are signed in, a hashed email address or account identifier. Never your precise location.

In our emails. Marketing and service emails from Bobao may include tracking pixels and tracked links that tell us, and a measurement partner, whether an email was opened and which links were clicked. They are off unless you turn them on with "Let our emails measure opens and clicks" in Your privacy choices, and you can turn that off again there at any time; opting out of selling or sharing turns it off too. Emails carrying a sign-in or password-reset code never include them, and neither do security and account emails. You can also turn off automatic image loading in your email app; marketing email can be switched off under Settings → Notifications & location.

The categories involved:

• identifiers, such as device or browser identifiers, and an account identifier or email address in hashed form;
• internet or other electronic network activity, such as the page that referred you, pages viewed and actions taken on the website and in the app, and whether an email was opened;
• approximate location derived from an IP address, no finer than a city;
• commercial information, such as which shops you have checked in at and when, and whether you are a Supporter;
• inferences drawn from those, such as the kinds of shops you tend to visit.

Who receives it. Advertising networks; measurement and attribution providers; and data analytics providers. We list categories rather than names; the list of current partners is available on request at hello@getbobao.com.

Ad matching — only with its own yes. "Use my email to show me relevant Bobao ads on other sites" lets us send a hashed (scrambled) copy of your email address or account identifier to an advertising partner, so Bobao's ads can reach you elsewhere. It is a separate, optional box when you create an account — never ticked for you, never required, and never part of agreeing to these terms — and a switch in Your privacy choices. It is off unless you turn it on, and opting out of selling or sharing turns it off. Without it, no email address or account identifier, hashed or not, goes to an advertising partner.

Your choices, and our limits:

• Opt-in, everywhere. Advertising, analytics and measurement tools run only after you choose "Accept all" on the cookie notice, wherever you are — not only in the UK and EU. Until you answer, and if you choose "Essential only", none of them runs.
• Opt out at any time. Your privacy choices (Settings → Privacy & your data → Privacy controls, and the "Your privacy choices" link in the footer) has a "Do Not Sell or Share My Personal Information" choice. It is recorded on your account and applies to every tool described here.
• Global Privacy Control is an opt-out. If your browser sends a GPC signal, we treat it as a request to opt out of selling and sharing — for that browser, and for your account when you are signed in.
• Nobody known to be under 16 without the required consent. We do not sell or share the personal information of anyone we know to be under 16 unless we have the opt-in consent the law requires.
• No sensitive information. Precise location, account passwords and sign-in codes, payment card details, and anything the law treats as sensitive personal information are never part of it. Precise location is never stored in the first place, and no tool described here is given it.
• No penalty for opting out. Opting out does not change your cards, your points, your rewards, or the price of anything.

In Canada, these tools run only with your consent, and you can withdraw it at any time with the same switches.

Usage counts and error reports are never included, because there is no field for who you are. The two optional questions are only ever reported as counts, with groups of fewer than five withheld, never as an individual's answer. A shop never receives your name or your visits, and we never sell a shop's customer list.

Cookies and similar technologies

Cookies are small files a website stores in your browser. Similar technologies do the same job another way: local storage in your browser, identifiers on your device, and pixels or tags in a page or an email. We use them in three groups:

• Essential — always on. Keeping you signed in, remembering your preferences on this device, and remembering your answer to the cookie notice. Bobao does not work without them, so they are not optional.
• Analytics — optional. Seeing which parts of Bobao people use, including through third-party analytics tools.
• Advertising and measurement — optional. The tools described under "Selling and sharing for advertising" above.

When the optional ones run. Only after you choose "Accept all" on the cookie notice, wherever you are. Before you answer, nothing optional runs. They are also subject to your opt-out in Your privacy choices and to a Global Privacy Control signal; either one stops them. The cookie notice appears on the website, the landing page and the public pages as well as in the app.

Changing your choice. Use "Cookie preferences" in the footer to bring the notice back and choose again, and Your privacy choices to opt out of selling and sharing. You can also block or delete cookies in your browser's settings; blocking essential ones will sign you out.

Third-party tools set their own cookies. An analytics or advertising partner's tool can set and read its own cookies and identifiers, and what that partner does with them is governed by its own privacy policy as well as by its agreement with us.

Notice of Financial Incentive

Bobao Points, levels and companions are free, and they are built on some of your personal information — your check-ins and the cards you fill. California law calls a program like that a "financial incentive", and asks us to explain it: what it is, what personal information it uses, how to join and leave, and what we think that information is worth. That explanation is our Notice of Financial Incentive. It is linked on the Create an account screen, before an account exists.

If Bobao is sold or merges

If Bobao LLC is involved in a merger, acquisition, financing, reorganization, or sale of all or part of its business, personal information may be transferred as part of that transaction. Whoever receives it is bound by this policy, including your opt-out, unless and until they give you notice of a new one. We will tell you before your information becomes subject to a different policy.

Your rights over what we hold

These apply to everyone who uses Bobao, not only to people in a jurisdiction that requires them.

See it and take a copy. Settings → Privacy & your data → Download your data. The file is built on your device, from your own records, and saved straight to it. Nothing is emailed and nothing is queued.

Correct it. Settings → Edit account.

Know how it was used. Ask the Privacy Officer, reachable at hello@getbobao.com, and we will tell you how your information has been used and to whom it has been disclosed.

Opt out of selling and sharing. Your privacy choices (Settings → Privacy & your data → Privacy controls) → Do Not Sell or Share My Personal Information, or send a Global Privacy Control signal from your browser. Nothing is sold or shared today; the opt-out is recorded so that it applies if that changes.

Delete it. Settings → Delete account. Everything is held for 14 days in case you change your mind, and then it is gone. Three things survive, and the deletion screen says so before you confirm: reviews you posted stay up, shown as written by a former member; the stamps a shop already recorded stay on the shop's side, because those are that business's record of its own trade; and the record of your choices stays, with your account number and no name or email.

Withdraw consent. Usage counts, email measurement, ad matching, news email and the two optional questions can be switched off or deleted at any time, and nothing else changes when you do.

Object, restrict, or complain. Write to the Privacy Officer, reachable at hello@getbobao.com. If you are in the UK or EU you may also complain to your local supervisory authority. If you are in Canada you may also complain to the Office of the Privacy Commissioner of Canada, and in Alberta or British Columbia to that province’s Information and Privacy Commissioner.

We answer within 30 days. We do not charge for any of this and we will not make you justify it.

Children

Bobao is not for anyone under 13. We ask you to confirm you are 13 or older when you create an account, and we record that confirmation with the date.

If we learn that an account belongs to someone under 13, we delete it and everything on it. If you believe a child has an account, write to hello@getbobao.com and we will act on it.

Security

Passwords are hashed by our authentication provider and are never visible to us. When you set or change one, the app checks it against Have I Been Pwned's list of passwords exposed in other services' breaches: only the first five characters of a one-way hash of it are sent, never the password, and the match is made on your device. Every request is over HTTPS. Access to your records is enforced in the database itself by row-level security rather than by application code, so a bug in a screen cannot show you somebody else's card.

Staff PINs are write-only: nobody, including us, can read a shop's PIN back out.

No system is perfect, and we will not pretend otherwise. If a breach affects you we will tell you, and we will tell you what actually happened rather than the smallest true thing. Where the law requires it, we also report a breach to the privacy regulator.

Where your data is held

On servers in the United States. If you are outside the US, using Bobao means your data is transferred there. It is stored and processed by our service providers Supabase, Vercel, Stripe and Resend in the United States, and while it is there it may be accessible to US courts, law enforcement and national security authorities under US law. Questions about this go to the Privacy Officer, reachable at hello@getbobao.com.

Changes to this policy

If we change it in a way that matters, we will say so in the app rather than only updating the date. The version you agreed to is recorded on your account.

Governing law and disputes

This policy is governed by the laws of California, and a dispute about it is settled the way the Disputes section of the terms of use says, including your right to opt out of arbitration and to use small claims court. If you live in Canada, nothing here takes away the protection of the laws and courts of your province, or your right to complain to your privacy commissioner.

Bobao LLC · hello@getbobao.com