PatPat
Your Privacy Matters

Privacy Policy

Last updated: March 11, 2026

PatPat ("we", "us", or "our") operates the PatPat mobile application and admin panel (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

1. Information We Collect

1.1 Information You Provide

Account information: Email address, full name, and password when you create an account.
Profile information: Profile photo, job title, department, and bio that you choose to add.
Recognition content: Kudos messages, titles, and values you assign when recognizing colleagues.
Organization information: Company name and team structure provided by your organization's administrator.

1.2 Information Collected Automatically

Device tokens: Firebase Cloud Messaging (FCM) tokens used solely for delivering push notifications.
Device information: Device platform (iOS or Android), app version, and device identifier for push notification delivery.
Usage data: Interactions within the app such as kudos sent and received, leaderboard participation, and pin collection activity.

1.3 Information We Do Not Collect

Location dataContacts or address book dataFinancial or payment informationHealth or biometric dataBrowsing history or tracking data

2. How We Use Your Information

Provide the Service

Enable you to send and receive recognition, participate in leaderboards, and collect pins.

Push notifications

Send you notifications about kudos received, period updates, and leaderboard changes.

Account management

Authenticate your identity, manage your profile, and maintain your organization membership.

Service improvement

Understand how the Service is used to improve functionality and user experience.

3. Third-Party Services

We use the following third-party services to operate PatPat. These services process your data only as necessary to provide their respective functionality:

Supabase

Database hosting, authentication, and file storage. Data is stored securely with row-level security policies and encryption in transit.

Firebase Cloud Messaging (Google)

Push notification delivery. Only device tokens are shared with Firebase to deliver notifications to your device.

Vercel

Hosting for the admin panel. Processes web requests with encryption in transit.

We do not sell, rent, or share your personal information with third parties for advertising or marketing purposes.

4. Data Security

All data is transmitted over HTTPS/TLS encryption.

Database access is protected by row-level security (RLS) policies ensuring users can only access data within their organization.

Sensitive tokens are encrypted using AES-256-GCM at the application layer.

Authentication sessions use secure, rotating JWT tokens.

API endpoints are protected by rate limiting.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. When you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required by law to retain it.

Recognition content (kudos) that you have sent may be retained in anonymized form after account deletion to preserve the recognition history for other users.

Push notification device tokens are retained while your account is active. Tokens that have been inactive for more than 60 days are automatically deactivated and removed from our systems through scheduled maintenance.

Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users via email within 72 hours of becoming aware of the breach, in accordance with GDPR requirements. The notification will include the nature of the breach, the data affected, and the steps we are taking to address it.

6. Your Rights

Access

Request a copy of the personal data we hold about you.

Correction

Update or correct inaccurate information through your profile settings or by contacting us.

Deletion

Delete your account and associated data directly from the app or by contacting us. Account deletion is available in the Profile section of the mobile app.

Portability

Request your data in a structured, commonly used format.

Opt-out of notifications

Manage your notification preferences in the app settings, or disable push notifications through your device settings.

7. Children's Privacy

PatPat is a workplace recognition tool intended for use by adults in professional settings. We do not knowingly collect personal information from children under the age of 16. If we become aware that we have collected data from a child under 16, we will delete that information promptly.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure that appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

9. California Residents (CCPA)

If you are a California resident, you have the right to:

Know what personal information we collect and how it is used.
Request deletion of your personal information.
Opt out of the sale of your personal information. We do not sell personal information.
Not be discriminated against for exercising your privacy rights.

10. European Residents (GDPR)

If you are in the European Economic Area (EEA), our legal basis for processing your personal data includes:

Contract performance: Processing necessary to provide the Service you signed up for.
Legitimate interests: Improving the Service and ensuring security.
Consent: Where you have given explicit consent, such as for push notifications.

You may exercise your rights under the GDPR by contacting us at the email below.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights:

goowiia@gmail.com