Preview — demo only. No payments are taken; Wallet passes are in test mode.

Stampdrop Privacy Policy

Last updated: 30 October 2026

Effective date: 30 October 2026.

1. About Stampdrop and this policy

This Privacy Policy applies to Stampdrop, the app shown on the Google sign-in consent screen, available at https://getstampdrop.com (homepage). Stampdrop provides digital loyalty stamp cards for Australian cafés: café owners create and manage a stamp card program, and their customers collect stamps and rewards on the web, in Apple Wallet or in Google Wallet.

Stampdrop is operated by Stampdrop, Melbourne, Victoria, Australia. Privacy contact: privacy@getstampdrop.com. We handle personal information in line with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles.

2. Information we collect

  • Account information: your name, email address, and a unique user identifier issued by Google Firebase Authentication. Passwords (if you use email and password) are held by Firebase, never by Stampdrop.
  • Café information (café owners): café name, card design, logo and images you upload, reward settings, and subscription status. Payments are processed by Stripe; we never see or store full card numbers.
  • Loyalty card information (customers): the cafés you hold cards with, stamps and rewards with date and time, whether you opted in to promotional emails, and reminder settings.
  • Wallet pass information: device and push identifiers that Apple or Google provide so we can update a pass you added.
  • Technical information: IP address and browser information in server logs, used for security and troubleshooting.

3. Google user data we access

Stampdrop offers “Continue with Google” (Google Sign-In through Google Firebase Authentication). We request only the scopes openid, email and profile. From your Google Account we receive only:

  • Name
  • Email address (and whether Google has verified it)
  • Profile picture (a URL; Stampdrop does not store or display it)
  • Google account ID (a unique identifier for your Google Account)

Stampdrop does not request or access your Gmail, Google Drive, Google Contacts, Calendar or any other Google service or data.

4. How we use Google user data

  • Name: to create your Stampdrop account and show your name on your account and loyalty card, and to the café whose card you hold.
  • Email address: to identify your account, sign you in, link your stamp cards to you (instead of a single browser), and send emails you have requested or that relate to your card (reward reminders, and café offers only if you opted in).
  • Google account ID: to securely recognise you when you sign in again.
  • Profile picture: not used.

We use Google user data only to provide and improve the user-facing features of Stampdrop described above. We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train artificial intelligence or machine-learning models. People at Stampdrop do not read it except with your consent, for security or abuse investigations, or where required by law.

5. Limited Use disclosure

Stampdrop’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. How we store Google user data

  • Google Firebase Authentication (Google) stores your sign-in record: name, email address, profile picture URL and Google account ID.
  • Cloudflare D1 (our database, run by Cloudflare) stores your name, email address, email-verified status and Firebase user ID, together with your stamp card data.

All data is sent over HTTPS (encrypted in transit) and stored by these providers with encryption at rest.

7. How we share data

We do not sell personal information or Google user data. We share it only:

  • With the café whose stamp card you hold: your name, email address, stamps, rewards and opt-in choice, so it can run its loyalty program.
  • With service providers that process it on our behalf to run Stampdrop: Google Firebase (sign-in), Cloudflare (hosting and database), Stripe (subscription billing for café owners only; customers’ data is not sent to Stripe), Resend (email delivery), and Apple and Google (Wallet passes, if you add one).
  • Where required by law, or to protect the safety and security of users or Stampdrop.

Some providers process data outside Australia, including in the United States.

8. Retention and deletion

  • We keep your data, including Google user data, only while your account is active.
  • Customers can delete their data themselves at getstampdrop.com/me: “Remove card” deletes one café card; “Delete my account” deletes your account, all your cards and your Google-derived data, including your Firebase sign-in record.
  • Café owners can close their account in the dashboard under Settings → Close account, which cancels the Stripe subscription and deletes the café’s data.
  • You can also email privacy@getstampdrop.com from your account’s email address to request deletion; we complete it within 30 days.
  • Deleted data is removed from our database immediately. Billing records may be kept where Australian tax law requires (generally 7 years). Server logs are kept for up to 90 days.
  • You can revoke Stampdrop’s access to your Google Account at any time at myaccount.google.com/permissions.

9. Cookies

Stampdrop uses only essential, first-party session cookies that keep you signed in (Secure, HttpOnly). We do not use advertising, analytics or cross-site tracking cookies.

10. Security

We use HTTPS for all traffic, sign-in through Firebase Authentication with verified Google ID tokens, session tokens stored only in hashed form, Secure HttpOnly SameSite cookies, cross-site request protection, sign-in rate limits, and restricted, logged administrator access. If a data breach is likely to cause serious harm we will notify you and the OAIC as required by law.

11. Children

Stampdrop is not directed to children under 13 and we do not knowingly collect their personal information. If you believe a child has given us information, contact privacy@getstampdrop.com and we will delete it.

12. Your rights (Australian Privacy Act)

  • Access the personal information we hold about you and ask us to correct it.
  • Delete your account and data (see section 8).
  • Unsubscribe from promotional emails using the link in any email, and turn off reward reminders on your card page.
  • Complain: contact privacy@getstampdrop.com; we respond within 30 days. If unsatisfied, contact the Office of the Australian Information Commissioner at oaic.gov.au.

13. Changes to this policy

We will post changes on this page with a new effective date and notify account holders by email of material changes.

14. Contact

Stampdrop, Melbourne, Victoria, Australia · privacy@getstampdrop.com · https://getstampdrop.com

© Stampdrop · Privacy · Terms · Made in Australia