1. Who we are, and what this policy covers

Freklo ("we", "us") is a loyalty app for local businesses, developed and operated by the Freklo team in Yerevan, Armenia. This policy explains what information we collect, how it is used, and what your choices are.

It covers all three parts of the service:

  • Freklo for Android — "Freklo: Loyalty Rewards" on Google Play.
  • Freklo for iOS — "Freklo: Loyalty Rewards" on the App Store.
  • The Freklo website — freklo.com and freklo.am.

Both apps sign in to the same Freklo account and the same backend, so the information below applies to either one unless a point says otherwise. For anything unclear, write to frekloapp@gmail.com.

2. Information we collect

Account information. Your name and email address; your Freklo user ID (the identifier Firebase Authentication assigns your account) and, if you sign in with Apple or Google, the identifier that provider shares with us; a phone number if you choose to add one; which roles your account holds (customer, business, or both); which mode you prefer the app to open in; your preferred language; your notification preferences, including the per-category ones; and a link to the profile photo your sign-in provider supplies, if there is one.

Loyalty activity. The programs you join, your points and stamps, rewards you earn and redeem, when that activity happened, and the other actions you take on your account and your loyalty cards.

Business information. If you run a business on Freklo: your business name and category; an optional address or location you type in yourself; an optional phone number; your program names, descriptions, earning rules and rewards; the Wallet card image an owner or admin uploads, if you choose one; your team members' names, email addresses and roles; and the invitations you send them.

Device and diagnostic information. A Firebase installation ID that identifies your app install to Firebase services; a Firebase Cloud Messaging token for delivering notifications; and app-integrity information from Firebase App Check. In the Android app, Firebase Crashlytics additionally collects crash diagnostics — see section 4.

Support messages. What you send us by email.

What we do not collect. Freklo does not collect your device's location, precisely or approximately: there is no location permission in either app and no location data is sent to us. A business address is free text an owner types about their own premises, not tracking of anyone's device. We do not collect your contacts, files, health data or advertising identifiers, and neither app contains an analytics or advertising SDK. We do not browse or upload your photo library. Only two images ever reach Freklo: the profile photo your sign-in provider supplies, which we store as a link to the picture that provider hosts and never as a copy of the image; and the single Wallet card image a business owner or admin deliberately picks for their own loyalty card (section 8). A picture you choose on the customer setup screen in the iOS app is shown on that screen only, and is never uploaded or saved. This website uses no analytics or advertising trackers and sets no marketing cookies; the language you pick is stored only in your own browser.

3. How we use your information

We use this information to run the service: keeping your loyalty balances correct, showing businesses their own customers, delivering the notifications you have enabled, keeping Apple Wallet passes up to date, verifying that requests come from a genuine copy of the app, diagnosing crashes and stability problems, preventing fraud and abuse, and answering your messages.

We do not sell your personal data, we do not share it with data brokers, and we do not use it for third-party advertising or for advertising profiles of any kind.

4. Crash reporting and diagnostics

Production builds of the Android app include Firebase Crashlytics, which we use to detect, diagnose and fix crashes and stability problems. When the app crashes or reports a non-fatal error, Crashlytics may receive:

  • the stack trace of the crash, including thread and method information;
  • relevant application state at the moment of the crash, such as the app version, build type and how long the app had been running;
  • device and operating-system metadata, such as the device model, Android version, available memory and disk space, and CPU architecture;
  • a Crashlytics installation identifier (a Crashlytics installation UUID) and the Firebase installation ID for your app install.

This information is used only for diagnostics and app stability. It is not used for advertising, and it is not combined into an advertising or marketing profile. Crash reports are not intended to contain your name, email address or loyalty data, and we do not attach them.

Crashlytics collection is switched off in development builds. Freklo does not include the Google Analytics for Firebase SDK in either app: there is no Analytics dependency in the shipped Android build and none in the iOS app, so no analytics events are collected. The iOS app does not include Crashlytics at all; crash reports there reach us only if you have opted in to sharing diagnostics with Apple, in which case Apple provides them under Apple's own terms.

5. Where your data lives, and who processes it

Freklo is built on Google Firebase and Google Cloud. Google processes this data as our service provider, on our instructions, under Google's data-protection terms, and it may be processed on servers outside your country. Data is encrypted in transit between the apps and Google's services.

The services in use are:

  • Firebase Authentication — your account and sign-in, including Apple and Google sign-in. Both apps.
  • Cloud Firestore — your profile, loyalty memberships, business and program data. Both apps.
  • Cloud Functions — the server-side operations that award points, issue rewards, manage teams and delete accounts. Both apps.
  • Firebase Cloud Messaging — delivering push notifications. Both apps.
  • Firebase App Check — proving that a request comes from a genuine, unmodified copy of Freklo. It uses Play Integrity on Android, and Apple App Attest on iOS, falling back to Apple DeviceCheck on devices that do not support App Attest.
  • Firebase Crashlytics — crash and stability diagnostics in production builds of the Android app only (see section 4).
  • Cloud Storage — Apple Wallet card artwork for businesses: the validated image a business uploaded and the pass images generated from it (section 8). Neither app can read or write storage directly, and it holds no customer files.

Apple also processes data when you use Apple sign-in, Apple push notifications or Apple Wallet, under Apple's own terms.

6. When information is shared

Freklo is not anonymous by design — a loyalty program only works if the business can recognise its own customers. Specifically:

  • With the businesses you join — a business you choose to join sees your name and your activity in their loyalty program: your points, stamps, rewards and visits with them, and the date you joined. Their staff see it in the Freklo business app. They never see your activity at other businesses, and they do not receive your email address, your phone number or your device information.
  • With service providers — Google (Firebase and Google Cloud) and Apple (sign-in, notifications, Wallet), only as needed to run the service, as described in section 5.
  • If the law requires it — when we are legally obliged to disclose information.

We do not sell personal data, and we do not disclose it to advertisers or data brokers.

7. Notifications

Push notifications are optional. We use your device's notification token to deliver messages about your own account and loyalty activity: points added or used, rewards unlocked, membership and team events such as an invitation or a role change, and important account notices. We do not send promotional or advertising notifications, and notification tokens are never used for advertising or marketing.

You can change this at any time, in three places:

  • In Freklo — the notification preferences in your profile, where categories can be turned off individually.
  • On Android — Android system notification settings for Freklo, under Settings → Apps → Freklo → Notifications.
  • On iOS — iOS Settings → Notifications → Freklo.

Notification tokens are stored server-side and are never visible to other users or to businesses.

8. Apple Wallet passes

Adding a loyalty card to Apple Wallet is an iOS feature. The pass contains your name, the business and your current balance. Apple delivers pass updates to your device; how Wallet handles passes on your device is governed by Apple's own terms. The Android app has no wallet-pass integration.

Card artwork. A business can give its loyalty card its own banner instead of the Freklo default design. Only the business owner or an admin can choose or remove it, and only in the iOS app; other staff cannot, and the Android app has no artwork upload. The chosen image is sent to our uploadWalletArtwork Cloud Function, which decodes and validates it on the server, applies the crop, discards all image metadata — including any location the original photo file carried — and produces the three pass images Apple Wallet requires. The validated image and the generated pass images are stored in Firebase Storage, under that business's own folder. Nothing there is publicly readable: the apps have no direct access to storage at all, and the images reach a phone only inside the signed Wallet pass. This artwork belongs to the business; it is not customer data.

When a business uploads new artwork, the files of the previous version are deleted straight away. When a business switches back to the Freklo default, that program's artwork files are deleted. Deleting the business removes its database records, but its artwork files are currently left in storage, with no automatic expiry configured for them today; email us and we will remove them.

9. Exporting and deleting your data

You can delete your account yourself, in either app, under Profile (or More in business mode) → Delete account. The deletion runs immediately and signs you out. The iOS app can also export a copy of your data first, under Your data.

If you cannot sign in or cannot open the app, email frekloapp@gmail.com with the subject "Freklo account deletion request", from the address associated with your account. We may ask for reasonable proof of identity, and we will never ask you for your password.

Deleting your account removes your sign-in credentials, your profile, every loyalty membership with its points and stamps, the related points and reward history, your Wallet pass tokens and registrations, your notification device tokens, and both of your in-app notification inboxes.

If you run a business, deleting your account does not delete the business, because it belongs to its team and its customers as well. Delete the business first, in business mode under More → Business profile → Delete business; otherwise the business, its programs and your team record — which holds your name and email address — remain, and you will need to email us to have them removed. If you are a team member rather than an owner, only an owner or admin can remove you from the team.

Full step-by-step instructions, and the complete list of what is deleted and what is kept, are on the Account Deletion page.

10. How long we keep data

While your account exists, we keep your profile and loyalty data so the service works. After deletion:

  • A security and fraud-prevention record remains: one audit entry with the action, your account's internal user ID, how many memberships were removed and the time. It contains no name, email address or activity. It is kept indefinitely — no automatic expiry is configured for these records today — and an internal abuse-prevention counter keyed to the same ID is kept alongside it.
  • Each business you had joined keeps an anonymous notice that a customer deleted their account. It carries only that business's own name and does not identify you; it stays in that business's notification list until the business deletes it.
  • Database version history is short-lived: Freklo runs no database backup schedule and point-in-time recovery is switched off, so there is no backup from which a deleted account could be restored. The database keeps only its own internal one-hour version window.
  • Business Wallet card artwork is deleted as soon as a business replaces it or switches back to the Freklo default design. If the business itself is deleted, its artwork files are currently left in storage until we remove them on request; no automatic expiry is configured for them today. They hold no customer data.
  • Crash diagnostics. Google states that Firebase Crashlytics keeps crash stack traces, extracted minidump data and the associated identifiers (Crashlytics installation UUIDs and Firebase installation IDs) for 90 days before beginning to remove them from live and backup systems.
  • Firebase installation IDs. Google states that these are retained until deletion is requested through its API, after which the data is removed from live and backup systems within 180 days.

Freklo keeps no financial, tax or other legally mandated records about customer accounts, and takes no payment from customers.

11. Age requirement

Freklo is intended for people aged 18 and over. It is not directed to children or to minors, and we do not knowingly collect information from anyone under 18. Do not create an account or use Freklo if you are under 18. If you believe someone under 18 has created an account, contact us and we will remove it.

12. Changes to this policy

When this policy changes, we update the effective date at the top of this page. For significant changes we will also let you know in the app.

13. Contact

Questions about privacy, or about the data held about you: frekloapp@gmail.com.