YOUR DATA, CLEARLY EXPLAINED

Privacy Policy

Last updated: 10 August 2026

Hot Snack Ltd ("HotSnack", "we", "us") is the controller of personal information used by the HotSnack Rewards website and mobile apps. This policy explains what we collect, why we use it and the choices you have.

Information we collect

• Account: name, email address, mobile number, password hash, age-eligibility confirmation and your settings and consent choices. This can include an optional country or heritage-flag preference you select yourself.
• Orders and rewards: order-profile identifiers, eligible purchase values, payment references, refunds, Points, Gems, vouchers, referrals and loyalty history. HotSnack does not receive your full payment-card number.
• Games and community: game sessions, scores, challenge entries, football invitations, rankings, Kindness Meal contributions and your submitted public social-post URLs.
• Device and security: app version, operating system, session and security logs, push-notification token, notification preferences, language and time zone.
• Optional fitness data: steps, active energy, walking/running distance, data source, recording method and sync time when you choose to connect Apple Health or Android Health Connect.
• Optional location: location evidence only when a clearly identified fitness challenge requires GPS verification. We do not need or keep a route for ordinary fitness rewards.
• Optional photographs: a compressed Kindness Meal handover image uploaded by authorised kiosk staff. A person never has to appear in the image and separate consent is required for gallery use.

Why we use information

• To create and secure your account, connect eligible Hot Snack food orders and provide the rewards, games, challenges, referrals, vouchers and community features you request.
• To calculate balances and rankings, deliver football invitations and service notifications, prevent cheating and fraud, investigate faults and keep an audit trail.
• With your permission, to calculate Fitness Rewards and verify a GPS-required fitness challenge.
• To show contextual sponsor messages, apply a per-account frequency limit and report aggregate qualified views.
• To meet tax, accounting, consumer-protection, security and other legal obligations.

Depending on the activity, our UK GDPR legal basis is performance of our contract with you, your consent, compliance with law, or our legitimate interests in operating and securing the service. Fitness and location permissions are optional and are processed only after your explicit choice.

Your optional country or heritage-flag preference is never inferred. It is shown beside your Football Duel name, can be changed or cleared in Account settings, and is not used for advertising, rewards, eligibility or profiling. “Iran — Lion & Sun” is clearly offered as a heritage identity and is not represented as Iran’s current official flag.

Health and location protections

HotSnack requests read-only access to the minimum activity types needed for Fitness Rewards: steps, active energy and distance. We do not request heart rate, diagnoses, medication, contacts or precise routes. You can refuse or revoke access in Apple Health, Android Health Connect or your phone settings and continue using non-fitness features.

Health and location data are never sold, used to select or measure advertising, shared with sponsors, or combined with advertising profiles. We do not use HealthKit or Health Connect data for cross-app tracking. Our use of Android Health Connect data follows the applicable Health Connect permissions and limited-use requirements.

Advertising

Sponsor messages are contextual to HotSnack and its games, not behavioural advertising based on your health, location or activity. We use your HotSnack account only to avoid repeating the same sponsor more often than the configured interval and to prevent duplicate impression counting. Sponsors receive campaign totals and aggregate reporting, not customer contact details or health data. HotSnack does not use an advertising identifier and does not track you across other companies' apps or websites.

Children and younger users

HotSnack accounts are for people aged 13 or over. If you are under 13, a parent or guardian must create and supervise the account with you. We use contextual advertising and high-privacy defaults for all users. A parent or guardian may contact us about a younger user's account or request deletion.

Community photographs and social links

Receiving a Kindness Meal is never conditional on being photographed. Kiosk staff should photograph the meal or non-identifying handover. If a person appears, staff must record freely given consent, and a separate choice is required before an image can appear in a contributor gallery. Consent can be withdrawn and the image will be removed from that gallery. Social reward evidence is a public URL you submit; HotSnack does not ask you to upload the social photo or video itself.

Who receives information

We use service providers only where needed to run HotSnack, including hosting, email, push notifications, app distribution and payment/order processing. They may process information only for the contracted service and under appropriate safeguards. Information may also be disclosed when required by law, to protect users and the service, or during a properly governed business reorganisation.

Storage, security and retention

We use encrypted connections, access controls, hashed passwords, limited staff roles and security logging. No system can be guaranteed completely secure. Account information is kept while your account is active. When you delete the account, contact details are removed or anonymised and active sessions and device tokens are revoked. Financial, reward, fraud-prevention and prize records may be retained in anonymised or restricted form where law or a legitimate audit need requires it. Backups expire through the normal protected backup cycle.

Your choices and rights

You can change profile, marketing, sound, notification, fitness and location choices at any time. You may ask for access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier lawful processing.

You can delete your account inside HotSnack at More → Privacy & account → Delete my account, or use our public account deletion page. You can also read help and support.

Contact and complaints

Email info@hotsnack.co.uk with privacy questions or requests. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

We will post material policy changes here and, where appropriate, notify you in the app.