Pass in Hand Privacy Policy

App: Pass in Hand: Wallet Loyalty (Shopify app)
Operator: FlowPass LLC, a Massachusetts limited liability company ("FlowPass", "we", "us")
Effective date: October 26, 2026
Contact: [email protected]

This policy explains what personal information the Pass in Hand app collects, why, where it goes, and how long we keep it. It covers two groups of people:

Merchants: Shopify store owners and staff who install and use Pass in Hand.
Customers: shoppers at those stores who get a loyalty card in Apple Wallet or Google Wallet.

1. Who is responsible for your data

For customer data, the merchant (the store) is the data controller. The merchant decides to run a loyalty program, and we process their customers' data on their behalf and on their instructions, as a service provider or processor. If you are a customer, please contact the store first about your data. We will help the store respond.
For merchant account data (for example, the store's domain and billing plan), FlowPass LLC is the controller.

2. Information we collect

2.1 From the merchant's Shopify store (through Shopify's APIs)

When a merchant installs Pass in Hand, they grant it these Shopify permissions: read and write customers, write discounts, read orders, read products, and read store credit accounts. Using them, the app reads:

Data	Why we use it
Customer ID, first and last name, email address, phone number	To create the customer's loyalty card, show their name on it, email them their card link, and let staff find a member at the point of sale (POS)
Order ID, order subtotal (after discounts), currency and order date for paid orders	To award loyalty points
Refunds (order ID and refunded amount)	To take back points for refunded purchases
Store credit balance (only if the merchant chooses "Store Credit" as the balance source)	To show the store credit balance on the card
Products and collections the merchant picks as rewards	To set up rewards
Store name and currency	To brand the card, the wallet page and our emails to customers

The app also creates single-use discount codes in the merchant's store when a customer redeems points for a reward.

If a customer has no email address on file, the app records a placeholder address ending in .invalid (a reserved domain that cannot receive mail) so the loyalty card can still be created. We never send email to these placeholder addresses.

2.2 When a customer opens the "Add to wallet" page

The store's "Add to Wallet" button links to a page served through Shopify's app proxy (/apps/pass-in-hand/wallet on the store's domain). Shopify tells the app which logged-in customer is visiting. The app uses that ID to create or look up the customer's card. The page also reads the browser's user-agent to decide whether to show the Apple Wallet button, the Google Wallet button, or a hint to open the page in Safari.

The page does not set cookies of its own, and it contains no analytics or advertising scripts. Shopify may set its own cookies on the store's domain under the store's and Shopify's policies. Tapping "I have added it" only changes what the page shows. Nothing is sent or saved.

2.3 At the point of sale (Shopify POS, paid plans)

If the merchant is on a paid plan and uses the Pass in Hand tile in Shopify POS, staff can:

Search customers by name, email or phone. The app returns up to 10 matches, with name, email and phone.
Scan a customer's wallet card barcode. The app resolves it to the customer's account.
See the customer's points balance, tier, available rewards and unused reward codes, and apply a reward code to the cart.

Looking up a customer at POS creates a loyalty card for them if they don't have one yet. The POS tile may temporarily store a pending redemption on the POS device. This lets an interrupted redemption be resumed or cancelled.

2.4 Merchant account data

Store domain, install and uninstall dates, and the billing plan (subscriptions are billed through Shopify; we never see card details).
Shopify access tokens and session data that Shopify's app framework requires. For staff sessions this can include the staff member's name, email and locale.
Card design settings, such as program name, colors, logo, points rules, rewards and tiers. If the merchant enters a store location to show the card on the lock screen nearby, that location is the store's, not a customer's. Uploaded images are stored on our own servers.
Push messages the merchant sends to card holders (up to 200 characters), with delivery counts.
If merchants or their staff sign in to the FlowPass dashboard outside Shopify, their login (email address and authentication data) is handled by our authentication provider, Supabase.

2.5 Wallet devices

When a customer adds a card to Apple Wallet, the iPhone registers with our server so the card can be updated. We store the device identifier and push token Apple provides, then use Apple Push Notification service (APNs) to tell the device a new version of the card is available. For Google Wallet, the card is stored as a loyalty object in Google's Wallet service, and we update it through Google's API.

We do not collect payment card numbers, customer passwords, precise device location, or customer addresses.

3. What appears on the wallet card

A card can show the customer's name, points balance (or store credit balance), tier, the program name and branding, a barcode or QR code that identifies the card, and any messages the merchant sends. Anyone who can see the customer's phone screen can see the card.

4. How we use information

We use this information only to provide Pass in Hand to the merchant:

issue and update wallet cards
award, take back and redeem points
create reward discount codes
send the merchant's push messages to card holders
send the customer emails described below
show stats in the merchant's dashboard
provide support
keep the service secure and fix errors
bill through Shopify

Welcome email. When a loyalty card is first issued to a customer who has an email address, we send them one email on the merchant's behalf with a link to their wallet card page. We send it through our email provider, Mailtrap, and keep a record of the emails we send.

Tier-upgrade emails. If the merchant's program has tiers and a customer moves up a tier, we email the customer a congratulations message through Mailtrap. If the merchant has set a bonus for that tier, the customer may also get an email about the bonus points.

These are service emails about the customer's loyalty card, not marketing from FlowPass. A customer who does not want them can ask the store, or email us at [email protected], and we will stop them.

No text messages. Pass in Hand does not send text messages (SMS) to customers. If Shopify gives us a customer's phone number, we store it on their loyalty record so staff can find them at POS, but text messages are blocked for every card issued through Pass in Hand.

We do not sell personal information, share it for cross-context behavioral advertising, or use it for automated decisions with legal or similarly significant effects.

5. Where data goes (service providers)

Provider	What it does for us	Data involved
Shopify	Hosts the merchant's store, app proxy, POS, billing and webhooks	All of the data above originates in Shopify
FlowPass backend (operated by FlowPass LLC at api.getflowpass.com)	Stores loyalty members, balances and point history; generates and signs the wallet cards	Customer ID, name, email, phone, balance, tier, points transactions, device registrations
Render (Render Services, Inc.)	Hosts our app and backend servers and their PostgreSQL databases, in Virginia, USA	All app and backend data
Mailtrap	Sends the welcome and tier-upgrade emails	Customer email address, name, store name, card link, email content
Apitally	API monitoring for the backend	API request and response traffic and logs, which can include customer IDs, names, emails, phone numbers and balances. Access tokens and query parameters are redacted
Sentry (Functional Software, Inc.)	Error monitoring	Technical error details such as stack traces, request paths and server information; these may include personal data, such as a customer ID, contained in a failing request
PostHog (PostHog, Inc.) and Mixpanel (Mixpanel, Inc.)	Product analytics for the FlowPass backend, which counts events such as a card being issued or redeemed	Event names and internal identifiers, such as the card ID, member ID, pass type and the store's account ID. We do not intend to send customer names, emails or phone numbers. Merchant account contact details, such as a name and email, may be included for the merchant's own account events
Apple (Apple Wallet)	Stores the Apple Wallet card on the customer's device	Card contents
Apple Push Notification service (APNs)	Tells the customer's iPhone that an updated card is available, for example after a points change or a merchant message	Device push token and the card's pass identifier (the updated card itself is fetched from our server)
Google (Google Wallet API)	Stores and updates the Google Wallet card	Card contents, including the customer's name and balance
Supabase	Login and authentication for merchants and staff using the FlowPass dashboard	Merchant or staff email address and authentication data

We may also disclose information if required by law or to protect rights and safety. If FlowPass LLC is involved in a merger or sale, information may transfer under this policy.

6. Retention and deletion

While the app is installed, we keep loyalty data so cards and balances keep working.
Customer data requests. When a customer asks the store for a copy of their data, Shopify sends us a customers/data_request. We save the request and compile the customer's loyalty data that the app holds (card enrollment, points earned on orders, and reward redemptions). The merchant can download it as a JSON file from the app's Settings page and provide it to the customer. We do not write the customer's personal details to our logs when handling the request.
Customer deletion requests. When a store asks Shopify to erase a customer's data, Shopify sends us a customers/redact request. We then delete that customer's earning and redemption records and card enrollment from the app database, and delete their loyalty card and member record from the FlowPass backend. If the deletion in the FlowPass backend fails, Shopify retries the request. A card already on the customer's phone stays there until they remove it, but it will no longer be updated.
Uninstall. When a merchant uninstalls, we mark the store inactive. About 48 hours later, Shopify sends a shop/redact request. We then delete each of the store's loyalty members from the FlowPass backend, one by one, followed by all of the store's data in the app database: Shopify sessions, card designs, order earnings, redemptions, push message history, import jobs, card enrollments, saved data requests and the store record itself. If the deletion in the FlowPass backend fails, Shopify retries the request.
Logs and monitoring. Our servers and our monitoring providers (Apitally and Sentry) keep operational logs and error reports. These can include customer and order IDs, and in some cases email addresses and other request data. They are kept for a limited time under each provider's retention settings and are used only to run, secure and fix the service.
Backups. Our databases run on Render's managed PostgreSQL service, which keeps backups for recovery. Deleted data may remain in these backups until they expire.

7. Security

Data is encrypted in transit using HTTPS (TLS).
Data is stored on Render's managed infrastructure.
Requests from Shopify are verified with Shopify's signatures and session tokens.
Each store's FlowPass API key is stored encrypted.
Wallet card barcodes are cryptographically signed.
Access to production systems is limited to authorized FlowPass personnel.

8. Your rights

Depending on where you live, you may have the right to:

access, correct or delete your personal information
object to or restrict processing
receive a portable copy of your data
not be discriminated against for exercising these rights

We offer these rights to everyone who uses Pass in Hand, wherever they live.

Customers: please contact the store where you joined the loyalty program. You can also email us at [email protected], and we will pass your request to the store and help it respond. You can remove the card from your wallet at any time.
Merchants: email [email protected].

We may need to verify your identity before acting on a request.

9. International transfers

Our servers and service providers process data in the United States (our hosting is in Virginia). If you are outside the US, your data will be processed in the US. Merchants who need a data processing agreement can contact us at [email protected].

10. Children

Pass in Hand is a business tool and is not directed to children under 13 (or under 16 where local law sets a higher age). We do not knowingly collect their data. Merchants are responsible for their own customer eligibility.

11. Changes

We will post changes on this page and update the effective date. If a change materially affects how we use personal information, we will notify merchants through the app or by email.

12. Contact

FlowPass LLC
[email protected]