Privacy policy

thanko ("thanko", "we", "us") operates a workplace recognition platform that lets employees give each other kudos, earn points, and redeem those points at participating British Columbia businesses. This policy explains what personal information we collect, why, and the choices you have about it.

1. Who this applies to

This policy covers three kinds of accounts on thanko:

• Employees — people invited by their employer to give/receive kudos and redeem points.
• Organization admins — the small business or non-profit that manages the team roster and points budget.
• Reward partners — local businesses where points get redeemed.

2. Information we collect

2.1 Account information. Name, work email, and password (stored as a salted hash, never in plain text) when you or your employer create an account.

2.2 Organization information. Company/non-profit name, roster of employee names and emails, role assignments (admin/member), and hire dates, entered by an organization admin.

2.3 Activity data. Kudos you give or receive (message text and tag), points balances and history, and redemptions you make — including which reward partner and how many points.

2.4 Optional profile details. Fields you choose to add yourself, such as a birthday, used only to power in-app moments (e.g. a birthday shout-out) — never required.

2.5 Technical information. Session cookies needed to keep you signed in, and basic request logs (IP address, browser type, timestamps) kept for security and debugging.

We do not collect payment card details directly — if your organization is billed for a paid plan, that is handled by a third-party payment processor who receives only what's needed to process the charge.

3. How we use it

• Operate the core product: authentication, kudos, points, and redemption.
• Let your organization admin manage the roster, points budget, and permissions.
• Send transactional email (e.g. account verification, redemption confirmations).
• Coordinate redemption fulfillment with the specific reward partner you redeemed at.
• Keep the platform secure, prevent abuse, and debug issues.
• Understand aggregate usage (e.g. how many kudos are given per month) to improve the product — never sold or used for advertising.

4. Who we share it with

We do not sell personal information. We share it only:

• Within your organization — kudos are visible to your team by design; your organization's admins can see roster and points-balance data.
• With the reward partner you redeem at — limited to what's needed to honour the redemption (e.g. your name and the points/amount redeemed).
• With service providers who host our infrastructure, send email, or process payments on our behalf, under contracts that limit their use of your data to providing that service.
• If required by law, or to protect the rights, safety, or property of thanko, our users, or the public.

5. Data retention

We keep account and activity data for as long as your account is active. If your organization removes you or closes its account, we delete or anonymize personal information within a reasonable period, except where we're required to retain it for legal, tax, or security reasons.

6. Your choices

• Access, correct, or request deletion of your personal information by contacting us (below) or, for roster data, your organization admin.
• Optional fields (like birthday) can be added or removed at any time from your profile.
• You can ask your organization admin to remove you from the platform at any time.

7. Cookies

We use a single essential session cookie to keep you signed in. We don't use third-party advertising or tracking cookies.

8. Data location and security

Your data is stored on servers we operate or contract with, with encryption in transit and access controls limiting who inside thanko can see it. No system is perfectly secure, but we take reasonable steps to protect your information against unauthorized access.

9. Children

thanko is a workplace tool and is not directed at, or intended for use by, anyone under 16.

10. Changes to this policy

If we make material changes, we'll update the date at the top of this page and, where appropriate, notify organization admins by email.

11. Contact us

Questions about this policy or your data? Email us at privacy@tymuch.dev — [replace with your real contact address before launch].