Privacy Policy
Last Updated: November 10, 2026
This Privacy Policy (“Policy”) describes how Tickle Global LTD, a company incorporated in England and Wales with registered address at 167–169 Great Portland Street, London, W1W 5PF, United Kingdom, and Tickle Inc., a corporation incorporated in Delaware with registered office at 447 Broadway, 2nd Floor #569, New York, NY 10013, United States (together, “Tickle,” “we,” “our,” or “us”), collect, use, disclose, and otherwise process personal data and personal information (“Data”) of users (“you,” “your,” “Data Subject(s)”) in connection with the operation of our products and services.
This Policy is intended to satisfy the requirements of the UK General Data Protection Regulation (“UK GDPR”), the EU General Data Protection Regulation (“EU GDPR”), the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA/CPRA”), and other applicable U.S. state and international data protection laws.
1. Scope of Application
This Policy applies to all personal data processed by Tickle in connection with:
The Tickle App (iOS and Android applications);
The Tickle Browser Extension;
Tickle-Powered Ads saved by users into mobile wallets (Apple Wallet or Google Wallet), also referred to as “Tickle Ads”;
Tickle Flashcards, being digital passes saved by users into mobile wallets (Apple Wallet or Google Wallet) issued by brands or by Tickle directly; and
Any websites, domains, or subdomains operated by Tickle where this Policy is made available.
2. Roles of the Parties
Tickle as Controller / Business
Tickle acts as a Data Controller (for UK/EU/EEA users) and as a Business (for California and other U.S. state users) with respect to personal data processed in the App, Extension, Tickle Ads, and Flashcards.Brands as Joint Controllers
For Tickle Ads and Flashcards saved into mobile wallets, Tickle and the relevant brand advertiser (the “Brand”) act as Joint Controllers (under GDPR/UK GDPR) for the limited purpose of delivering wallet notifications and processing related engagement data.
3. Categories of Data Processed
3.1 Tickle App and Extension
Account details (if supplied): email address, username, authentication credentials.
Device identifiers, IP address, and related metadata.
Application telemetry, crash reports, and diagnostics.
User interactions, including ads saved, links clicked, and offer redemptions.
3.2 Tickle Ads and Flashcards (Wallet Passes)
Engagement data: swipe, save, notification delivery, click-throughs, pass deletions.
Device identifier (UDID/Device ID) for the purposes of notification delivery and deduplication.
Technical metadata: source URL, timestamp, device/OS/browser type.
Not collected through wallet passes: names, email addresses, phone numbers, demographic information, or payment card details unless explicitly stated.
4. Purposes of Processing
Tickle processes Data for the following purposes:
Provision of services requested by the Data Subject, including the saving of ads or passes to Wallet and the delivery of associated notifications.
Measurement of engagement, campaign performance, and service functionality.
Security, fraud prevention, and abuse detection.
Compliance with legal and regulatory obligations.
Where applicable, marketing communications and promotional activities, subject to consent.
5. Lawful Bases for Processing (GDPR/UK GDPR)
Contractual necessity: Processing required to perform services requested by saving a pass or using the App/Extension.
Consent: Where required, we obtain your freely given, specific, informed and unambiguous consent for advertising measurement, non-essential device storage and promotional wallet notifications. Consent for promotional notifications identifies Tickle, the relevant brand and the type of messages you agree to receive. Saving a pass does not by itself constitute consent to unrelated marketing, measurement or third-party tracking. You may withdraw consent at any time.
Legitimate interests: Limited processing necessary to protect the service, prevent and detect fraud, fix errors, technically deliver advertising and content, and respect privacy choices, subject to the applicable necessity and balancing assessments. For the advertising service covered by our IAB registration, personal-data processing for campaign measurement relies on consent.
Legal obligations: Responding to regulatory, audit, or compliance requirements.
6. Data Sharing and Disclosure
Tickle may disclose Data to:
Brands (Joint Controllers): For Wallet passes, limited engagement data and device identifiers are shared to enable Wallet notifications and measure interaction.
Service Providers / Processors: Cloud hosting, analytics, support, and security partners.
Professional Advisors: Legal, accounting, audit, and consultancy services.
Authorities: Where compelled by law, regulation, or valid legal process.
Corporate Transactions: In connection with a merger, acquisition, financing, or sale of assets.
7. Retention
Wallet engagement data and device identifiers are retained for no longer than 24 months from the last activity or until deletion/opt-out, whichever occurs first.
Security logs retained up to 12 months, subject to extension for investigations.
Account data (App/Extension) retained while active and thereafter in accordance with statutory requirements (generally up to 6 years).
8. Security
Tickle implements technical and organisational measures appropriate to the risks, including encryption, access controls, and monitoring. While no system is entirely secure, Tickle maintains incident response procedures and will notify regulators and affected Data Subjects where required by law.
Wallet passes operate within the technical infrastructure of Apple Wallet and Google Wallet; consumers are encouraged to review their security statements.
For information on how Apple Wallet protects pass data, including encryption and secure element safeguards, see https://support.apple.com/en-afri/guide/security/secb569bf393/web.
For an overview of Google Wallet’s security, tokenization, and user privacy safeguards, see https://safety.google/pay/.
9. Data Subject Rights
UK/EU/EEA Users (GDPR/UK GDPR)
Rights to access, rectification, erasure, restriction, objection, portability, and withdrawal of consent. Complaints may be lodged with the Information Commissioner’s Office (ICO) or the relevant supervisory authority.
California Users (CCPA/CPRA)
Rights to know, access, correct, delete, and opt out of the sale or sharing of personal information. Non-discrimination for exercising rights. Tickle recognises Device IDs as personal information under CPRA.
Other U.S. State Users
Tickle will extend comparable rights in jurisdictions such as Virginia, Colorado, and Connecticut.
Exercise of rights: Contact privacy@JoinTickle.com or utilise the “Do Not Sell or Share My Personal Information” mechanism accessible from Wallet passes and our website.
10. Children’s Privacy
Tickle services are not directed at children under the age of 13 in the U.S. or under the age of 16 in the UK/EU. Data inadvertently collected will be deleted upon request.
11. Data Hosting and International Transfers
Tickle uses regional infrastructure to host wallet pass data and related engagement information. Hosting arrangements depend on the service and market concerned.
For our Australian service, Tickle’s regional application databases and backups are hosted in Australia. Authorised personnel in the United Kingdom may access those records for reporting and support. UK and EEA consumer records are not copied or replicated into the Australian regional databases or backups.
These regional hosting arrangements relate to infrastructure operated for Tickle. They do not mean that every organisation involved in delivering a wallet pass processes data exclusively in that region. Apple, Google and other service providers may process information in other countries when providing wallet, hosting, security or related services. Their processing locations and applicable privacy arrangements must therefore also be considered.
Where processing involves a restricted international transfer under UK or EU data protection law, we use an applicable adequacy regulation or decision, or appropriate safeguards such as the European Commission’s Standard Contractual Clauses together with the UK Addendum where required, or the UK International Data Transfer Agreement. Where required, we assess the protection available in the destination country and apply supplementary safeguards.
We also take account of applicable local privacy laws and contractual commitments concerning regional hosting and cross-border access. You can contact privacy@JoinTickle.com for further information about relevant processing locations, recipients and transfer safeguards, including how to obtain a copy of applicable safeguards, subject to appropriate redactions.
12. Cookies and Similar Technologies
Our websites and advertising or wallet-pass pages may use cookies, localStorage, sessionStorage and similar technologies. Their purposes can include operating the service, remembering privacy choices, maintaining an advertising journey and measuring campaign performance.
Where a technology is strictly necessary to provide a service you explicitly request, we explain its function and assess the applicable exemption from consent. Technologies used for advertising measurement or other non-essential purposes require consent where applicable. A technology does not become exempt merely because it contains a random identifier or is deleted when the browser session ends.
Google Tag Manager is used to manage website tags. The consent requirements depend on the tags and services it deploys. Non-essential analytics and advertising tags must not operate before the relevant consent has been obtained.
Details of the technologies used, their providers, purposes and durations are set out in our cookie information and, for the relevant Tickle advertising service, our device-storage disclosure:
https://tcf.jointickle.com/tcf-device-storage.json
You can accept or reject non-essential technologies and change or withdraw your choice through the cookie settings available on the relevant website or page. Rejecting non-essential technologies does not prevent access to the basic service, although optional measurement or advertising functions may be unavailable.
Our website uses Google Analytics 4 (GA4), managed through Google Tag Manager, to analyse website traffic and understand how visitors interact with our website.
Google Analytics is only activated when visitors accept optional analytics cookies. If visitors reject optional cookies, Google Analytics remains disabled and does not collect analytics data.
The cookies used by Google Analytics include:
_ga
Provider: Google
Purpose: Distinguishes website visitors
Duration: Up to 2 years
ga*
Provider: Google
Purpose: Maintains session state
Duration: Up to 2 years
Our cookie consent functionality also stores visitors' consent preferences. Details of the specific storage technology and its retention period are included in our supporting cookie inventory.
13. Amendments
Tickle may revise this Policy from time to time. Material changes will be notified via our website, and where appropriate, in-app or via email. Continued use of our services following such changes constitutes acceptance.
14. Contact
Tickle Global LTD (UK): 167–169 Great Portland Street, London, W1W 5PF
Tickle Inc. (US): 447 Broadway, 2nd Floor #569, New York, NY 10013
Email: privacy@JoinTickle.com
Representative
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:
European Union (EU)
Prighter EU Rep GmbH
Schellinggasse 3/10
1010 Vienna
Austria
Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/Tickle
This Privacy Policy (“Policy”) describes how Tickle Global LTD, a company incorporated in England and Wales with registered address at 167–169 Great Portland Street, London, W1W 5PF, United Kingdom, and Tickle Inc., a corporation incorporated in Delaware with registered office at 447 Broadway, 2nd Floor #569, New York, NY 10013, United States (together, “Tickle,” “we,” “our,” or “us”), collect, use, disclose, and otherwise process personal data and personal information (“Data”) of users (“you,” “your,” “Data Subject(s)”) in connection with the operation of our products and services.
This Policy is intended to satisfy the requirements of the UK General Data Protection Regulation (“UK GDPR”), the EU General Data Protection Regulation (“EU GDPR”), the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA/CPRA”), and other applicable U.S. state and international data protection laws.
1. Scope of Application
This Policy applies to all personal data processed by Tickle in connection with:
The Tickle App (iOS and Android applications);
The Tickle Browser Extension;
Tickle-Powered Ads saved by users into mobile wallets (Apple Wallet or Google Wallet), also referred to as “Tickle Ads”;
Tickle Flashcards, being digital passes saved by users into mobile wallets (Apple Wallet or Google Wallet) issued by brands or by Tickle directly; and
Any websites, domains, or subdomains operated by Tickle where this Policy is made available.
2. Roles of the Parties
Tickle as Controller / Business
Tickle acts as a Data Controller (for UK/EU/EEA users) and as a Business (for California and other U.S. state users) with respect to personal data processed in the App, Extension, Tickle Ads, and Flashcards.Brands as Joint Controllers
For Tickle Ads and Flashcards saved into mobile wallets, Tickle and the relevant brand advertiser (the “Brand”) act as Joint Controllers (under GDPR/UK GDPR) for the limited purpose of delivering wallet notifications and processing related engagement data.
3. Categories of Data Processed
3.1 Tickle App and Extension
Account details (if supplied): email address, username, authentication credentials.
Device identifiers, IP address, and related metadata.
Application telemetry, crash reports, and diagnostics.
User interactions, including ads saved, links clicked, and offer redemptions.
3.2 Tickle Ads and Flashcards (Wallet Passes)
Engagement data: swipe, save, notification delivery, click-throughs, pass deletions.
Device identifier (UDID/Device ID) for the purposes of notification delivery and deduplication.
Technical metadata: source URL, timestamp, device/OS/browser type.
Not collected through wallet passes: names, email addresses, phone numbers, demographic information, or payment card details unless explicitly stated.
4. Purposes of Processing
Tickle processes Data for the following purposes:
Provision of services requested by the Data Subject, including the saving of ads or passes to Wallet and the delivery of associated notifications.
Measurement of engagement, campaign performance, and service functionality.
Security, fraud prevention, and abuse detection.
Compliance with legal and regulatory obligations.
Where applicable, marketing communications and promotional activities, subject to consent.
5. Lawful Bases for Processing (GDPR/UK GDPR)
Contractual necessity: Processing required to perform services requested by saving a pass or using the App/Extension.
Consent: Where required, we obtain your freely given, specific, informed and unambiguous consent for advertising measurement, non-essential device storage and promotional wallet notifications. Consent for promotional notifications identifies Tickle, the relevant brand and the type of messages you agree to receive. Saving a pass does not by itself constitute consent to unrelated marketing, measurement or third-party tracking. You may withdraw consent at any time.
Legitimate interests: Limited processing necessary to protect the service, prevent and detect fraud, fix errors, technically deliver advertising and content, and respect privacy choices, subject to the applicable necessity and balancing assessments. For the advertising service covered by our IAB registration, personal-data processing for campaign measurement relies on consent.
Legal obligations: Responding to regulatory, audit, or compliance requirements.
6. Data Sharing and Disclosure
Tickle may disclose Data to:
Brands (Joint Controllers): For Wallet passes, limited engagement data and device identifiers are shared to enable Wallet notifications and measure interaction.
Service Providers / Processors: Cloud hosting, analytics, support, and security partners.
Professional Advisors: Legal, accounting, audit, and consultancy services.
Authorities: Where compelled by law, regulation, or valid legal process.
Corporate Transactions: In connection with a merger, acquisition, financing, or sale of assets.
7. Retention
Wallet engagement data and device identifiers are retained for no longer than 24 months from the last activity or until deletion/opt-out, whichever occurs first.
Security logs retained up to 12 months, subject to extension for investigations.
Account data (App/Extension) retained while active and thereafter in accordance with statutory requirements (generally up to 6 years).
8. Security
Tickle implements technical and organisational measures appropriate to the risks, including encryption, access controls, and monitoring. While no system is entirely secure, Tickle maintains incident response procedures and will notify regulators and affected Data Subjects where required by law.
Wallet passes operate within the technical infrastructure of Apple Wallet and Google Wallet; consumers are encouraged to review their security statements.
For information on how Apple Wallet protects pass data, including encryption and secure element safeguards, see https://support.apple.com/en-afri/guide/security/secb569bf393/web.
For an overview of Google Wallet’s security, tokenization, and user privacy safeguards, see https://safety.google/pay/.
9. Data Subject Rights
UK/EU/EEA Users (GDPR/UK GDPR)
Rights to access, rectification, erasure, restriction, objection, portability, and withdrawal of consent. Complaints may be lodged with the Information Commissioner’s Office (ICO) or the relevant supervisory authority.
California Users (CCPA/CPRA)
Rights to know, access, correct, delete, and opt out of the sale or sharing of personal information. Non-discrimination for exercising rights. Tickle recognises Device IDs as personal information under CPRA.
Other U.S. State Users
Tickle will extend comparable rights in jurisdictions such as Virginia, Colorado, and Connecticut.
Exercise of rights: Contact privacy@JoinTickle.com or utilise the “Do Not Sell or Share My Personal Information” mechanism accessible from Wallet passes and our website.
10. Children’s Privacy
Tickle services are not directed at children under the age of 13 in the U.S. or under the age of 16 in the UK/EU. Data inadvertently collected will be deleted upon request.
11. Data Hosting and International Transfers
Tickle uses regional infrastructure to host wallet pass data and related engagement information. Hosting arrangements depend on the service and market concerned.
For our Australian service, Tickle’s regional application databases and backups are hosted in Australia. Authorised personnel in the United Kingdom may access those records for reporting and support. UK and EEA consumer records are not copied or replicated into the Australian regional databases or backups.
These regional hosting arrangements relate to infrastructure operated for Tickle. They do not mean that every organisation involved in delivering a wallet pass processes data exclusively in that region. Apple, Google and other service providers may process information in other countries when providing wallet, hosting, security or related services. Their processing locations and applicable privacy arrangements must therefore also be considered.
Where processing involves a restricted international transfer under UK or EU data protection law, we use an applicable adequacy regulation or decision, or appropriate safeguards such as the European Commission’s Standard Contractual Clauses together with the UK Addendum where required, or the UK International Data Transfer Agreement. Where required, we assess the protection available in the destination country and apply supplementary safeguards.
We also take account of applicable local privacy laws and contractual commitments concerning regional hosting and cross-border access. You can contact privacy@JoinTickle.com for further information about relevant processing locations, recipients and transfer safeguards, including how to obtain a copy of applicable safeguards, subject to appropriate redactions.
12. Cookies and Similar Technologies
Our websites and advertising or wallet-pass pages may use cookies, localStorage, sessionStorage and similar technologies. Their purposes can include operating the service, remembering privacy choices, maintaining an advertising journey and measuring campaign performance.
Where a technology is strictly necessary to provide a service you explicitly request, we explain its function and assess the applicable exemption from consent. Technologies used for advertising measurement or other non-essential purposes require consent where applicable. A technology does not become exempt merely because it contains a random identifier or is deleted when the browser session ends.
Google Tag Manager is used to manage website tags. The consent requirements depend on the tags and services it deploys. Non-essential analytics and advertising tags must not operate before the relevant consent has been obtained.
Details of the technologies used, their providers, purposes and durations are set out in our cookie information and, for the relevant Tickle advertising service, our device-storage disclosure:
https://tcf.jointickle.com/tcf-device-storage.json
You can accept or reject non-essential technologies and change or withdraw your choice through the cookie settings available on the relevant website or page. Rejecting non-essential technologies does not prevent access to the basic service, although optional measurement or advertising functions may be unavailable.
Our website uses Google Analytics 4 (GA4), managed through Google Tag Manager, to analyse website traffic and understand how visitors interact with our website.
Google Analytics is only activated when visitors accept optional analytics cookies. If visitors reject optional cookies, Google Analytics remains disabled and does not collect analytics data.
The cookies used by Google Analytics include:
_ga
Provider: Google
Purpose: Distinguishes website visitors
Duration: Up to 2 years
ga*
Provider: Google
Purpose: Maintains session state
Duration: Up to 2 years
Our cookie consent functionality also stores visitors' consent preferences. Details of the specific storage technology and its retention period are included in our supporting cookie inventory.
13. Amendments
Tickle may revise this Policy from time to time. Material changes will be notified via our website, and where appropriate, in-app or via email. Continued use of our services following such changes constitutes acceptance.
14. Contact
Tickle Global LTD (UK): 167–169 Great Portland Street, London, W1W 5PF
Tickle Inc. (US): 447 Broadway, 2nd Floor #569, New York, NY 10013
Email: privacy@JoinTickle.com
Representative
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:
European Union (EU)
Prighter EU Rep GmbH
Schellinggasse 3/10
1010 Vienna
Austria
Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/Tickle