Privacy policy
Last updated: 22 October 2026
TickPass, by Routless, runs digital stamp cards for businesses: you add a business's card to Apple Wallet or Google Wallet, and its staff stamp it when you buy. The business decides what its card offers and owns its list of cardholders; Routless processes the data for the business. This page explains what is collected, why, and what you can ask. Questions: support@routless.co.il.
Customers with a stamp card
- To join we ask only for your first name. Your phone number is optional and is used only to get your card back if you lose it. We keep it as a one-way keyed hash (to spot a second card with the same number) and encrypted (so the business can see it if you ask for help). We never show it to other customers.
- Deals and news from the business are a separate choice: the box starts unticked, and we record your answer and when you gave it. Without it you only get updates about your own card (stamps and rewards).
- We keep your card's history: stamps, rewards and redemptions, with their times and which staff member and device gave them, so the business can check mistakes and abuse.
- Apple Wallet: when you add the card, your iPhone gives us a device identifier and a push token so the card can update itself. When you remove the card, your iPhone tells us and we delete them.
- Google Wallet: the card is stored with Google under our issuer account so it can update; Google's own privacy policy covers your Google account.
- This browser keeps a cookie with your card's link, so the join page can show you your card again. You can delete it in your browser's settings.
Businesses and their staff
- Account: the email address you sign in with. If you sign in with Google, also your name, email address and profile picture as Google shares them.
- What you enter: the business name, logo, colors, contact details, address and card settings, and staff names and PINs. PINs are stored only as a keyed hash, so nobody can read them.
- Paired staff devices: the device type (for example "iPhone · Safari") and when it was last used.
- Cookies that keep you signed in and keep a staff device paired.
Technical data
- To stop abuse we count requests per IP address. We store only a hash of the address, for up to one day.
- The join form runs Vercel's bot check, which looks at the browser, not at who you are.
- Error reports, when enabled, are set up to exclude cookies, IP addresses, card links and form contents.
- No advertising, no tracking cookies, and we don't sell data.
Who processes it for us
- Supabase (database and sign-in), with servers in Ireland.
- Vercel (hosting and the bot check); our application servers run in Dublin, Ireland.
- Apple, which delivers card updates to iPhones and stores the cards in Apple Wallet.
- Google, which stores and updates cards in Google Wallet, and handles sign-in with Google.
- Resend, our email provider, which sends sign-in codes to businesses.
How long we keep it
- Cards and their history: as long as the business uses TickPass, or until you or the business ask us to delete them.
- Apple device registrations: until you remove the card from your iPhone.
- IP address hashes: up to one day.
- Business accounts: until the business asks us to delete them.
Your rights
- Under Israel's Privacy Protection Law you can ask to see, correct or delete your data. Ask the business, or write to us at support@routless.co.il and we'll handle it with them.
- You can stop deals and news at any time; your card keeps working.