Wildflower

Privacy Policy

Last updated: 22 April 2026

Wildflower ("we", "us", "our") operates the Wildflower mobile application and website at app.wldflwr.com.au. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

By using Wildflower, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our services.

1. Information We Collect

Information you provide

  • Account details - name, email address, and password when you create an account.
  • Profile information - phone number and birthday, if you choose to provide them.
  • Order information - shipping address, billing details, and purchase history for online shop orders (processed via Shopify).

Information collected automatically

  • Loyalty activity - NFC check-in timestamps, stamps earned, points balance, rewards redeemed, and loyalty tier.
  • Usage analytics - pages visited, features used, device type, browser, and operating system. We use this to improve the app experience.
  • Push notification tokens - device tokens for sending you notifications, if you opt in.

Information we do not collect

  • We do not collect precise location data.
  • We do not access your contacts, camera, or microphone.
  • We do not sell or share your data with third-party advertisers.

2. How We Use Your Information

  • To operate and maintain your account and loyalty card.
  • To process online shop orders and manage fulfillment.
  • To track and award loyalty points, stamps, achievements, and rewards.
  • To send push notifications about promotions, events, and order updates (opt-in only).
  • To enable features like referrals, coffee gifting, and biometric login.
  • To analyse usage patterns and improve the app.
  • To communicate with you about your account or respond to support requests.

3. Data Storage & Security

Your data is stored securely using industry-standard practices:

  • Database - hosted on Supabase (PostgreSQL) with encryption at rest and in transit.
  • Passwords - hashed using bcrypt. We never store or see your plain-text password.
  • Authentication - secured via HTTP-only cookies and JWT tokens.
  • Biometric credentials- stored in your device's secure enclave (iOS Keychain / Android Keystore). We never have access to your biometric data.
  • Payments - online orders are processed by Shopify. We do not store credit card numbers.

4. Third-Party Services

We use the following third-party services:

  • Shopify - for online shop product management and order processing.
  • Supabase - for database hosting.
  • Vercel - for application hosting.
  • Firebase Cloud Messaging - for delivering push notifications on iOS and Android.

Each service has its own privacy policy. We only share the minimum data required for each service to function.

5. Your Rights

You have the right to:

  • Access - view all personal data we hold about you via your profile.
  • Update - edit your name, email, phone, and birthday at any time.
  • Delete - request deletion of your account and all associated data by contacting us.
  • Opt out - disable push notifications at any time through your device settings or the app.

6. Data Retention

We retain your account data for as long as your account is active. If you request deletion, we will remove your personal data within 30 days. Anonymised analytics data may be retained for up to 12 months for business insights.

7. Children's Privacy

Wildflower is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

8. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with an updated revision date. Continued use of the app after changes constitutes acceptance.

9. Contact Us

If you have questions about this Privacy Policy or want to request data deletion, contact us at: