Privacy Policy

The only thing the app requires from you is your phone number. Everything else is optional, and when you leave it blank it is not sent at all - a blank field is not recorded as “unknown”, it is simply absent from the request.

• Your phone number and country code. To create your card, to send you the verification code, and to give you the same card back on a new phone. It is the only thing that identifies whose card it is.

• First name, last name, email, date of birth and gender. Asked for during enrolment, all optional. They let the restaurant recognise you at the till and run programme features such as a birthday offer.

• Your points activity. Points earned, spent and expired; the date of each; and the amount spent where the till recorded one. This is the record of why your balance is what it is, and it is shown back to you unchanged on the History tab.

• Your card id. Your card's unguessable identifier, held in your phone's secure store (Keychain / Keystore). It is how the app remembers you.

• Preferences kept on your device. Your language, your notification setting and the last balance you saw stay on the phone. They are not sent to the server.

The jar on the home screen responds when you tilt the phone by reading the device's motion sensor. That reading is used only to draw the screen. It never leaves the device and is never recorded.

What is collected is used only to run the loyalty programme:

• to create your card and bring it back from your number,

• to work out your points, your rewards and your tier,

• to find which card the code scanned at the till belongs to,

• to show you your own history,

• to send you transactional messages about the programme.

We do not profile you with it, make automated decisions about you, or target advertising.

When you enter your number, a six-digit code is sent to it. Whether it arrives by WhatsApp or SMS is decided from the country code, and your number is passed to a messaging provider so that the message can be delivered.

That message is sent only when you ask for it, at that moment. It is not marketing, and the number is not used to send you campaigns.

The app's notifications are produced on your own phone. There is no notification sent from a server: in the moments the operating system lets the app run in the background, it reads your card's balance, and if the balance has gone up your phone shows you a local notification.

Which means: no notification token for your device is held on any server. Turning notifications off likewise never travels beyond your phone.

Your personal data is not sold, not rented, and never shared with anybody for marketing. It is passed on only in these three cases:

• The Sopung restaurant. As a member of its own programme, it sees your card, your balance and your history. It is the party running the programme.

• The messaging provider. Only to deliver the verification code, and only your number.

• The hosting provider. The infrastructure the data sits on. Its access is limited to what providing the service requires.

Beyond these, data is disclosed only where the law requires it, and only as far as that requirement reaches.

Your card details and points activity are kept for as long as your card exists; they are the record of the loyalty programme. When you ask for your card to be deleted, the card and the history attached to it are deleted.

There is no button in the app that deletes a card. “Log out” in your profile only signs this phone out; it deletes nothing, and the same number brings the card back. Deletion has to be asked for at the address below, and the phone number your card is registered to is all it takes.

What is kept on your phone - the card id and your preferences - is removed from the device when you uninstall the app.

Under Article 11 of Turkish Law No. 6698 on the Protection of Personal Data you have the right to learn whether your data is being processed, to request information about it, to learn the purpose of the processing, to know the third parties it has been transferred to in Turkey or abroad, to have it corrected if incomplete or inaccurate, to have it erased or destroyed, to have those steps notified to the parties it was transferred to, and to seek compensation if you suffer loss.

To exercise any of these, write to the address below. Sending the phone number your card is registered to along with your request lets us answer it faster.

All traffic between the app and the server is encrypted. Your card id is held in the secure store your phone's operating system protects.

Your QR code carries your card's identity. The code you show at the till is the proof that the card is yours; not sharing a screenshot of it is what stops somebody else spending from it.

The app is not directed at children and does not knowingly collect data from anyone under 18. If we learn that such a record has been created, we delete it.

When this policy changes, the date at the top of the page is updated. Where a change materially affects how your personal data is processed, we will also say so from inside the app.

For questions about this document:

What to write, including for a deletion request, is set out on the contact page