One identity. Separate relationships.
A business sees its relationship with you, not your reward history at other merchants.
A funny name should still come with clear boundaries. Here is what your account means—and what it does not give a business permission to do.
A business sees its relationship with you, not your reward history at other merchants.
Choose location access while browsing offers, or choose a city. Loyalty does not need background location.
Merchant campaigns go through review and must respect your preferences and platform limits.
Staff should never need your SMS sign-in code. Use your personal QR, Duck ID or registered number for customer lookup.
Authorised corrections are recorded rather than silently rewriting transaction history.
Request account deletion in the app or through the public web route. Identity verification protects you.
Delete accountYour phone’s permission controls whether the app may display push notifications. Your Loyal Duck preferences control the messages you choose to receive. One is not a substitute for the other.
Use Me → notification settings for your account preferences. Inbox entries are separate from a push appearing on your lock screen.
A merchant paying for a campaign does not get permission to bypass those choices.
Read the privacy detailsCounter operations start with declared authority: an authorised owner or representative confirms their identity and authority to serve customers at the counter.
Public directory discovery requires business-control verification: appearing in the public merchant directory requires progressive evidence, such as domain ownership or location control. A Google listing alone does not confer verified business ownership.
We display no misleading “verified” badges on businesses that have only completed basic counter setup.