TreatHopGet help

Privacy Policy

Effective: 2026-10-21 · Owner analytics and customer email choices updated: 2026-10-26 · Apple Wallet updates: 2026-10-29 · Sign-in and app lock updated: 2026-10-30

TreatHop is operated by ParagonID LLC, 8080 Westpark Drive STE 82205, Houston, TX 77063 (United States). This policy covers treathop.com and app.treathop.com. Contact us at support@treathop.com or through TreatHop support.

The short version

You can get and use a customer loyalty card without giving us your name or email. Adding an email is optional. Card recovery and cafe offers are separate choices that require email confirmation. We do not sell personal information or use advertising trackers in TreatHop.

Your cafe runs its rewards program. TreatHop provides the technology. Ask the cafe about qualifying purchases, missing stamps or rewards; ask TreatHop about card access, sign-in, scanning, Wallet and your data.

Information we use

Camera access is used to read a QR on your device. TreatHop does not upload or store the camera video. A business logo you deliberately upload is displayed on customer cards, signup pages and supported Wallet cards and is publicly accessible. Do not upload personal or confidential information as a logo.

Why we use it

We use this information to issue cards, record stamps and rewards, connect counters, authenticate owners, update supported Wallet passes, recover access, answer support requests and prevent duplicate operations or abuse. We use customer email only for the purposes you choose and confirm: card recovery, cafe offers, or both. Offers alone do not enable card recovery, and recovery alone does not subscribe you to offers. The form initially selects both purposes; you can clear either or skip email. These choices take effect only after your explicit confirmation from the email.

Who receives it

Your cafe can see the cards and loyalty activity in its own program and manage stamps, rewards and card status. If you add and confirm an email for either purpose, that cafe's owner can see the current confirmed address in the customer list and card details. Pending and removed addresses are not shown to the owner, and connected counters do not receive the address. Providing an address does not give the cafe permission to send marketing; cafe offers require their own separate confirmed choice. Other cafes do not receive that program's card data. A confirmed offer subscription is associated only with the cafe you chose; it does not permit unrelated marketing or sharing with other cafes.

We use Cloudflare for hosting, storage and service protection, Google Firebase for owner authentication, Apple Wallet or Google Wallet when you choose to save a supported pass, and Resend for service email. Support messages are delivered to our support mailbox. These providers process information needed for their services. Saving a pass also subjects information in that pass to the Wallet provider's privacy terms. Services and data processing may be located in the United States or other countries where our providers operate.

We may disclose information when legally required, to investigate abuse or protect rights, or as part of a business transfer with appropriate notice and safeguards. We do not grant merchants permission to use customer information outside their program and stated choices.

Product analytics

For new cafe owner accounts created under our U.S. signup notice, product analytics is included in registration. Before account creation, that notice identifies PostHog, the selected activity collected and the U.S. storage region, and requires an acknowledgment. This applies only when that signup notice is displayed. Existing accounts are not automatically enrolled, and earlier refusals are not changed. Receiving a customer card, adding an email, accepting ordinary Terms or subscribing to cafe offers does not by itself enable analytics.

When collection is on, we send selected screen names, selected button actions and confirmed operation outcomes to PostHog to understand feature use and improve TreatHop. These events contain fixed categories and timestamps, plus a random identifier that our system can associate with your owner account or browser/counter session. That identifier is pseudonymous, not anonymous. We do not send your name, email, form text, messages, audio, card QR, financial information, authentication tokens, private URLs or your browser's IP address in these events. We do not enable session recordings, heatmaps, automatic event collection, person profiles or geographic enrichment.

Product events are sent to the separate TreatHop project in PostHog Cloud in the United States. The signup notice and privacy settings identify this region; processing by service providers can involve international transfers. PostHog’s Free plan provides a one-year event retention window: older events are excluded from event queries. That window is not a guarantee of automatic deletion from all provider storage. You may request deletion of previously received events through our support or analytics privacy settings, including before the year ends. A delivery queue in TreatHop expires after 24 hours and is limited in size. A failed delivery can mean an event is lost.

Your owner-account setting applies to that account. Customer settings apply to customer use in that browser session, and counter settings apply to that connected counter session. Those roles require their own separate choice; a cafe owner's signup acknowledgment does not enroll customers or counters. We honor Global Privacy Control and Do Not Track signals by keeping product analytics off. Removing a signal or signing in again does not turn collection back on.

You can turn collection off or request deletion of analytics data in Privacy & analytics without losing account access or receiving a service penalty. Turning it off deletes waiting events; data already received by PostHog follows its retention rule unless you request earlier deletion. A deletion request stops collection and removes local queued data immediately. Previously sent identifiers are added to an operator deletion task; contact support for progress. We aim to complete verified requests within 30 days. We retain the minimum identifier needed to finish that task until it is completed and its completion receipt for up to 30 days.

Necessary service and security records and statistics calculated from surviving loyalty records continue independently of the product analytics setting. Product reports describe only the activity included in collection, and cannot replace the loyalty ledger.

Your choices

Retention and deletion

We keep active program and card records while needed to provide the service. Card deletion removes the card, balance, history and contact details from the live application immediately. Account deletion is completed through support, including the separate authentication record; we complete account deletion within 3 calendar days (72 hours) after the owner’s confirmed request, as described above.

Application recovery snapshots can contain earlier data for up to 30 days. A separate deletion record prevents deleted cards and accounts from being reactivated when an application snapshot is restored. That record contains the deleted record's identifier, type and date and, for cafe accounts, the original deletion-request identifier and date, without email. It is kept for 90 days. Minimal retry receipts and completed Wallet-retirement records are kept for up to 30 days. For Google Wallet, if invalidation has not succeeded, the minimum pass identifier and retry state remain until invalidation completes; this does not restore the deleted TreatHop card. A saved pass may remain on your device after it is invalidated; remove it from Wallet yourself.

Email confirmation and recovery tokens are short-lived and cleaned up within a day after expiry. Subscription-change history is generally kept for 90 days, with the current opt-in record retained while the subscription is active. Support requests remain while being handled and for up to 90 days after closure. Email providers and support mailboxes maintain separate message records; our support deletion procedure includes reviewing those records and removing personal content that is no longer needed. We may retain limited information where legally required or necessary to resolve a specific dispute, and explain that exception when applicable.

For Apple Wallet, we keep a random pass identifier, an encrypted pass token and cached pass, and encrypted notification tokens with hashed device-library identifiers to provide updates. Your pass includes the cafe identity, card conditions, purchases, rewards and your existing counter QR; it does not include your recovery email or browser sign-in cookie. Active pass records remain while needed for your card. After a card is deleted or replaced, cached card content and its link to the card are removed. Only the minimum technical record needed to deliver an inactive pass remains, for up to 30 days from retirement, then its tokens and registrations are deleted. Updates to offline devices are best effort; a saved file may remain on your device, but its old QR stops working on the server. Removing a pass from Wallet stops that device's updates and does not delete your loyalty card.

Wallet performance and delivery-event records are kept for up to 30 days; closed operational incidents and operator security audit records are kept for up to 90 days. These records exclude customer QR codes, passwords and email contents. Application API measurements use registered route templates, response status, count and duration, without private URL parameters or request content. Client crash reports use only a fixed screen name, a fixed error category and an error reference, without messages or stack traces. These diagnostics are kept for up to 30 days; detailed error references are also limited to the most recent 1,000 records. Optional analytics identifier mappings are retained while needed for the active choice and for up to one year after a session expires or collection is turned off, to support privacy requests. An owner account’s current refusal is retained while the account exists so it is not silently reversed.

Customer browser access expires after 90 days without use; using the web card renews it. Owner sessions in the TreatHop app last up to 90 days and end after 30 days without use; in a browser they last at most 12 hours and end after two hours of inactivity. Closing a program, connecting, renewing or revoking a counter phone, and requesting account deletion ask for a recent sign-in. In the app, owners can turn on app lock, which asks your phone for Face ID, Touch ID, fingerprint or passcode when the app opens or after it has been away for 30 seconds. Your phone performs that check; TreatHop does not receive or store biometric data and keeps only whether app lock is on. The owner chooses seven-day counter access or access until revoked. Seven-day access expires unless renewed through a new invitation; access until revoked has no scheduled expiry. Both can be revoked by the owner. Browser storage limits or clearing saved data can require reconnecting. Essential browser storage keeps sign-in, card access, camera preferences and safe retry state. Blocking it can prevent these functions. TreatHop uses Do Not Track and Global Privacy Control signals to disable optional product analytics. These signals do not disable necessary service and security processing.

Security and children

We use HTTPS, access controls and limits on sensitive actions. No service can guarantee absolute security. Keep your card QR private: someone who has it may use the card at the cafe, although the QR alone does not grant permission to delete the card or change its email settings.

TreatHop is not directed to children under 13. Do not provide a child's personal information. Contact us if you believe such information was submitted so we can investigate and remove it as appropriate.

Changes and contact

We will publish updates here with an effective date and give additional notice of material changes when appropriate. Questions about your rewards go to your cafe. Privacy and technical questions go to support@treathop.com.