Privacy, retention, and support.
Understand what Apple Wallet stores, what Reward Loyalty records, how deletion works, and where support responsibility sits.
Reward Loyalty is self-hosted. The installation operator is responsible for its privacy notice, legal basis, backups, retention choices, Apple Developer account, and local compliance.
Data in a pass
A signed pass contains the business and program name, pass kind, action hint, colors and artwork, an opaque pass identity, a staff QR and fallback scan code, and links for current details, support, and privacy. It does not contain points, stamp totals, tier, voucher state or code, remaining visits, or dates.
When the member adds it, Apple Wallet stores and renders that package on their device. This static foundation sends no PassKit device registration and no APNs update request from Reward Loyalty.
Data Reward Loyalty stores
The installation keeps:
- one operational pass row tied to the member, business, and exact loyalty subject;
- a random opaque serial and authentication token used only as reserved pass identity;
- render fingerprint, version, status, and download timestamps/counts;
- a short-lived signed package on a private cache disk;
- controlled lifecycle, download, cache, duration, and failure events;
- daily partner/kind/item aggregates for the business dashboard.
It does not use a member name, email address, QR value, pass token, certificate, password, or package content as an analytics dimension. The dashboard reports downloads, not confirmed installations or views.
Retention
Default retention is:
| Data | Default | Configurable bound |
|---|---|---|
| Private signed-package cache | 30 days | 1-90 days |
| Raw operational events | 90 days | 7-365 days |
| Daily anonymous aggregates | 24 months | 1-60 months |
Normal lifecycle changes can clear a cached package sooner. The scheduled retention task removes eligible data in bounded batches.
Export and deletion
A member export includes safe Apple Wallet history: business, pass kind, status, delivery mode, issued/downloaded times, and controlled lifecycle events. It excludes signing material, serials, authentication tokens, private paths, and package files.
When a member erases their account or one business relationship is erased, the matching operational pass rows, raw events, and private packages are deleted. Anonymous daily aggregates can remain because they cannot identify the member.
Deletion from Reward Loyalty cannot reach into Apple Wallet and remove a static pass already stored on the device. The member removes that copy in Apple Wallet. After server-side erasure, its QR no longer grants access to the deleted relationship.
Support boundaries
The Reward Loyalty software can diagnose controlled states such as missing configuration, wrong .p12 password, missing private key, expired certificate, Pass Type ID/Team ID mismatch, unhealthy private storage, unavailable entitlement, or invalid artwork.
The installation operator handles:
- Apple Developer membership, agreements, Pass Type ID, certificate issuance/revocation, and renewals;
- secure storage and recovery of the signing identity and
APP_KEY; - hosting permissions, backups, scheduler operation, and privacy requests;
- business access and Apple Developer agreement compliance.
Apple controls the Wallet add sheet, final device rendering, the Wallet app, and operating-system behavior. A support request should identify the pass kind, business/program, device and OS version, expected result, actual result, whether the add sheet appeared, and a screenshot without secrets. Never attach the .p12, password, APP_KEY, full private package, or authentication token to a support ticket.