Your data should have a clear job.

This policy explains what BonusBites collects, why it is needed, how long it is kept, and how you can remove it.

Connected assistants

Share specific requests from your iPhone.

When you connect an assistant such as ChatGPT, it can prepare restaurant requests within the permissions you approve. You choose a restaurant account on your iPhone before sharing current balances, reward names, location or menu results. Orders and points redemptions require confirmation there. BonusBites temporarily stores request details and normalized results, including totals and order numbers, without restaurant credentials, payment identifiers, phone numbers or customer identity. Results become unavailable after 24 hours and are deleted during daily cleanup, within 48 hours. OAuth tokens are stored only as one-way hashes; refresh tokens expire after 30 days. Disconnecting in Profile → ChatGPT connections revokes access and removes stored requests. Account deletion also removes these records.

On your device

Restaurant sign-ins stay on your iPhone.

Restaurant passwords, one-time codes, cookies, and session tokens stay on your iPhone in protected app storage. BonusBites does not upload those secrets to its servers.

Stored by BonusBites

Your account and normalized reward wallet.

We store your name, email address, BonusBites user ID, installation ID, connected restaurant names, and normalized balances, rewards, offers, and refresh history so your wallet works across sessions. We also retain Apple-signed subscription transaction identifiers and subscription status to verify Gold access.

How data is used

Functionality, security, and support.

We use collected data to authenticate your account, display and sync your reward wallet, enforce Free and Gold limits, verify App Store purchases, deliver notifications you request, prevent abuse, diagnose failures, and respond to support requests. We do not sell personal data, use it for cross-app tracking, or serve third-party advertising.

Product analytics

Understanding whether your wallet works.

We record account-linked interactions such as restaurant connection attempts, wallet visits, refresh outcomes, reward actions, and Gold screen views. These records include restaurant names, app version, timestamps, and limited outcome metadata. They do not include restaurant credentials, reward contents, or browsing history. We use them to improve reliability and onboarding, schedule them for deletion after 90 days, and remove them when your account is deleted. Pending events remain on your device for up to seven days.

Service providers

Limited access to operate BonusBites.

Authentication, database, hosting, and infrastructure providers process only the information needed to run BonusBites. Apple processes subscriptions and sends signed purchase status to us. Restaurant services receive requests directly from your iPhone when you connect or refresh an account. Providers may not use this information for their own advertising. We may disclose information when required by law or necessary to protect users and the service.

Retention and deletion

Kept while your account is active.

Account details, device records, normalized reward snapshots, refresh history, and purchase verification records are retained while your BonusBites account is active. Use Profile → Delete Account to remove your live account and linked cloud data. Deletion begins immediately and retries automatically if a provider is temporarily unavailable. Data in encrypted provider backups may remain until those backups rotate and is not returned to normal use. A minimal deletion record containing technical identifiers and a one-way email hash is retained for 90 days to finish retries and prevent an old session from restoring the deleted account. Removing the app deletes its local protected data from that iPhone.

Your choices

Access, correction, and questions.

You can review core account information in the app, disconnect a restaurant, change notification permissions, or delete your entire BonusBites account. To request access or correction, ask about deletion, or report a privacy concern, email support@bonusbites.app. We may update this policy when the product or legal requirements change and will revise the effective date above.