NFTD, Inc. (“Receipts,” “we,” “our,” or “us”) understands that privacy is important to our users. This Privacy Policy describes how we collect, use, share, and protect your personal information in connection with the Receipts website at receipts.xyz (the “Website”), our mobile applications, and all related services, products, and offerings (collectively, the “Services”). It also explains the rights and choices you have regarding your personal information and how to contact us. Capitalized terms that are not defined here, such as Reward, Credit, Cash Out, and Boost, have the meanings given in our Terms of Service.

By using or accessing the Services, you agree to this Privacy Policy. If you do not agree with our policies or practices, you should not use or access the Services or provide us with any personal information.

For information about how users with disabilities can access this Privacy Policy in an alternative format, please contact us at hello@receipts.xyz.

Who We Partner With

Throughout this policy we refer to three distinct types of third parties, because your information is treated differently for each:

Venues — the gyms, studios, clubs, stores, parks, and other locations that host our tap-to-verify pucks & stickers.
Brands — companies that fund Boosts, which are rewards and offers you may choose to activate through Receipts. When you activate a Boost, that brand receives certain personal information needed to recognize and fulfill it, as described in “How We Disclose or Share Your Information.”
Gift card brands and providers — the brands whose gift cards are available as Rewards, and the providers we use to purchase and deliver those gift cards. Depending on the agreement, some gift card providers may also receive certain personal information needed to recognize and fulfill it, as described in “How We Disclose or Share Your Information.”

Personal Information We Collect

We use “personal information” to mean information that reasonably identifies, relates to, describes, or can be associated with you. De-identified or aggregated data that cannot reasonably be linked back to you is not personal information. The precise definition may vary by jurisdiction, but we take the same general approach to protecting your privacy everywhere, subject to any additional measures required by applicable law.

We collect the following categories:

Identifiers, such as your name, email address, and mailing address you input for physical goods.
Device and online identifiers, including internet protocol (IP) address, mobile advertising identifiers, and data collected from cookies and similar technologies.
Health and fitness data from your connected wearable device (see below).
Check-in and location data generated when you tap a puck or sticker (see below).
Rewards and Boost data, such as the Rewards you select, the Credit and points you earn, your Cash Outs, the Boosts you activate, and your referral and streak activity.
Demographic data, such as date of birth, sex, etc.

Health and Fitness Data

With your permission, we collect physical activity information from your connected wearable device. Depending on your device, this may include activity type, duration, and intensity; energy output; running and cycling distance; heart rate; sleep data; exercise minutes; step count; and similar metrics.

We support direct integrations with Apple Watch, WHOOP, Garmin, Oura, and Coros. Other wearables may connect through Apple Health. We collect this information while your device is connected, and we stop when you disconnect the device or delete your account.

Check-in and Location Data

When you tap a puck or sticker at a venue, store, or park, we record that check-in, including the location of the puck, the time of the check-in, the Reward you are earning toward, and the Credit earned. We collect location only at the moment you tap a puck. We do not collect continuous or background location data, and we do not track your movements between check-ins. We may also derive approximate location from your IP address for security and service purposes.

Sensitive Personal Information

Some of the information we collect is treated as “sensitive personal information” under certain state laws, including your health and fitness data and the precise geolocation captured at check-in. We use and disclose this information only to provide and improve the Services, to power the Reward and Boost features you choose to use, and for other purposes permitted by law. Where required, you may limit our use of your sensitive personal information as described in “Your Choices.”

How We Collect Your Personal Information

Information you provide. We collect information you give us directly, such as when you register or create a profile; connect a wearable; select a Reward or activate a Boost; contact us; respond to a survey; enter a contest or promotion; carry out a transaction; or otherwise provide information through the Services.

Information we collect automatically. When you use the Services, we collect certain information using cookies and similar technologies. Cookies are small pieces of information placed on your device that help us recognize you, understand how you use the Services, and improve them.

From our partners. We may receive information about you from venues, brands, and gift card providers in connection with your use of the Services, such as whether a Boost was redeemed or a gift card was delivered, which we associate with your account.

How We Use Your Personal Information

We use the categories of personal information described above for the following purposes:

To operate and provide the Services, including creating and managing your account; recording check-ins, Credit, points, and progress toward Rewards; processing Cash Outs and delivering gift cards; delivering Boosts, including discount codes and other brand offers; enabling you to transact with venues and brands; and administering contests and promotions.
To communicate with you, including responding to your inquiries and providing customer support, and sending you emails and updates you have chosen to receive.
For analytics and personalization, including understanding how you use the Services, identifying trends, improving our products and marketing, and personalizing your experience and the Rewards and Boosts we show you.
For security and fraud prevention, including maintaining the safety and integrity of the Services; detecting and preventing malicious, deceptive, or illegal activity, such as falsified check-ins or duplicate accounts; and investigating suspected violations of our policies or the law.
To comply with legal obligations, including responding to lawful requests, meeting any tax reporting requirements, exercising or defending legal claims, and acting in connection with a merger, acquisition, or similar transaction.

If you specifically consent to additional uses of your personal information, we may use it consistent with that consent.

How We Disclose or Share Your Information

Venues. Venues that host our pucks may be able to see check-in activity and aggregated wearable activity for their visitors.

Brands. When you activate a Boost through Receipts, we provide the brand funding that Boost with the information needed to recognize and fulfill it. This may include your name, email address, aggregated activity data, and check-in data. We provide this information as part of a specific Boost that you chose to activate; we do not sell or provide bulk data feeds to data brokers, advertising exchanges, or information resellers. Once a brand receives your information, its own privacy policy governs how it uses it.

Under the California Consumer Privacy Act and similar laws, our disclosure of personal information to brands in exchange for payment may be considered a “sale,” and our disclosure of information for the brand’s own advertising may be considered a “share.” You can opt out of the sale or sharing of your personal information at any time — see “Your Choices” below.

Gift cards. Earning Credit toward a Reward and Cashing Out do not, on their own, cause us to disclose your personal information to the brand whose gift card you receive. When you Cash Out, we or our gift card provider deliver the gift card to the email address on your account, and the provider may receive your name and email address for that purpose. When you use a gift card with its issuer, the issuer’s own privacy policy applies.

Service providers. We share information with third-party service providers that perform functions on our behalf, such as hosting, data analysis, infrastructure, customer service, email delivery, gift card fulfillment, and payment processing. They may access personal information only as needed to perform services for us and are not permitted to use it for their own purposes.

Legal compliance and protection of rights. We may disclose information where we believe it is necessary or appropriate to comply with applicable law or legal process; respond to lawful requests from public and government authorities; enforce our Terms of Service; protect our operations, rights, privacy, safety, or property, or those of our users or others; or pursue available remedies.

Business transfers. We may disclose information in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of our assets, in which case information about our users may be among the transferred assets.

De-identified and aggregated data. We may share de-identified or aggregated information — which cannot reasonably be linked back to you — with venues, brands, and others.

Links to Other Sites and Social Media

The Services may contain links to, or integrations with, third-party websites and services, including those of our venues, brands, and gift card issuers. We are not responsible for the privacy practices of those third parties, and this Privacy Policy applies only to your use of our Services. We encourage you to review the privacy policies of any third-party sites or services you use, including when you redeem a Boost or use a gift card.

Any information you voluntarily post in a publicly accessible area may be viewed and used by others. By using such features, you assume the risk that your information may be viewed and used by third parties.

How We Protect Your Personal Information

We maintain personal information on our servers or those of our service providers, accessible by authorized personnel as necessary for the purposes described in this policy. We use reasonable and appropriate physical, technical, and organizational safeguards designed to protect the confidentiality, integrity, and availability of personal information. However, no method of safeguarding information is completely secure, and we cannot guarantee absolute security. If you believe your interaction with us is no longer secure, please contact us immediately at hello@receipts.xyz.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Services, and for a reasonable period thereafter to comply with our legal obligations, resolve disputes, and enforce our agreements. This includes records of Cash Outs, gift cards delivered, and Boosts activated, which we may keep after your account is deleted for fraud prevention, accounting, and tax purposes. We stop collecting information from your connected wearable when you disconnect the device or delete your account. Even after deletion, we may retain de-identified or aggregated information.

Your Choices

Marketing emails. You may unsubscribe from marketing emails using the unsubscribe link in any such message or by emailing hello@receipts.xyz.

Boosts. Activating a Boost is always your choice. If you do not want a brand to receive your information, do not activate that brand’s Boost. You can still check in and earn Credit toward Rewards without activating any Boost.

Opt out of the sale or sharing of personal information. You have the right to opt out of the sale or sharing of your personal information. You can do this through the “Your Privacy Choices” link on our Website or by emailing hello@receipts.xyz. We also honor Global Privacy Control (GPC) signals as a valid opt-out of sale or sharing. We do not respond to other “Do Not Track” signals. If you opt out, some Boosts may not be available to you, because they cannot be fulfilled without sharing your information with the brand.

Limit the use of sensitive personal information. Where applicable law provides this right, you may request that we limit our use and disclosure of your sensitive personal information to what is necessary to provide the Services.

Disconnect your wearable. You can disconnect your wearable device at any time in the app, which stops our collection of your health and fitness data going forward.

Cookies. You can adjust your browser settings to restrict or delete cookies. Some features of the Services may not function properly if you do. Note that cookie-based opt-outs must be set on each browser and device you use.

Financial Incentives

We offer Credit toward gift cards, points, and Boosts, which may include discount codes, store credit, gift cards, free product, and experiences, in connection with connecting your wearable, logging verified workouts, completing check-ins, referring other users, and maintaining streaks. These programs may be considered a “financial incentive” under certain laws. Participation is voluntary, and you may withdraw at any time by not checking in, not activating Boosts, or deleting your account; our Terms of Service explain what happens to Credit you have not Cashed Out. The value of these incentives is reasonably related to the value of the information you provide in connection with them.

California Privacy Rights

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, and other applicable U.S. state privacy laws (“Applicable Privacy Laws”) provide certain rights regarding your personal information. This section describes those rights and how to exercise them.

Right to know. You may request that we disclose the categories and specific pieces of personal information we have collected about you; the categories of sources; our purposes for collecting, selling, or sharing it; and the categories of third parties with whom we disclose it.

Right to delete. You may request that we delete personal information we collected from you, subject to certain exceptions.

Right to correct. You may request that we correct inaccurate personal information we maintain about you.

Right to data portability. You may request a copy of the personal information we have collected about you in a readily usable format.

Right to opt out of the sale or sharing of personal information. You have the right to opt out of the sale or sharing of your personal information, as described in “Your Choices.” The Services are not intended for anyone under 18, and we do not knowingly sell or share the personal information of anyone under 18.

Right to limit the use of sensitive personal information. You may direct us to limit our use and disclosure of your sensitive personal information as described above.

Right to non-discrimination. We will not discriminate against you for exercising any of your rights, including by denying you goods or services, charging different prices, or providing a different level or quality of service (except where a difference is reasonably related to a financial incentive you have chosen).

Exercising your rights. To exercise these rights, email us at hello@receipts.xyz. We will take steps to verify your identity before responding, which may require you to provide information such as your name, email, phone number, and address so we can match it against our records. Only you, or an agent legally authorized to act on your behalf, may make a request; authorized agents must provide proof of authorization. We will respond within the time required by law, generally within 45 days, and will let you know if we need additional time.

California “Shine the Light.” California residents may request information about categories of personal information we have disclosed to third parties for their direct marketing purposes. To make such a request, email hello@receipts.xyz.

Other U.S. State Privacy Rights

Depending on your state of residence, you may have additional rights, including the right to access, correct, delete, or obtain a copy of your personal information, and to opt out of targeted advertising, the sale of personal information, and certain profiling. Where applicable, we honor recognized universal opt-out signals such as Global Privacy Control. To exercise these rights, email hello@receipts.xyz.

Nevada Privacy Rights

If you are a Nevada resident, you have the right to opt out of the sale of certain personal information that we have collected or may collect from you. To exercise this right, email us at hello@receipts.xyz with the subject line “Nevada Do Not Sell Request.”

Cross-Border Data Transfers

If you submit personal information to us, it may be processed in the United States or other jurisdictions where privacy laws may differ from those in your country of residence. By using the Services, you consent to the transfer, storage, and processing of your information in the United States and other jurisdictions. Personal information transferred to the United States may be subject to access by law enforcement.

Children’s Privacy

The Services are intended solely for individuals who are 18 years of age or older, as stated in our Terms of Service. We do not knowingly collect personal information from anyone under 18, and we do not knowingly sell or share such information or disclose it to brands. If we learn that we have collected personal information from someone under 18, we will take reasonable steps to delete it. If you believe we may have information from someone under 18, please contact us at hello@receipts.xyz.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting an updated policy or other notice on the Website, and we may also notify you by email or within the Services. Changes are effective when posted unless otherwise stated. We will not use your personal information in a materially different manner than described at the time of collection without your consent. Your continued use of the Services after an update constitutes your acceptance of the revised policy.

Contacting Us

If you have questions about our privacy or security practices, please contact us at hello@receipts.xyz.