On first use, the server creates a customer and installation using random identifiers. We do not use device fingerprinting, IDFA, Android Advertising ID or advertising identifiers.

An anonymous identity represents one installation; it is not proof that a natural person has only one device.

Email is optional. Once verified, we keep an encrypted value and an HMAC lookup. Recovery never grants marketing consent automatically.

Recovery, analytics, marketing email and push consents are separate and can be withdrawn.

Account deletion removes email, push subscriptions and profile data. Loyalty and audit events are anonymized and retained for 24 months for fraud and dispute resolution.

Private responses and QR codes are excluded from offline caches.

The operator will add the GDPR request contact before public launch. Until then, production loyalty features remain disabled.