Lounge Wallet

Lounge Wallet is an independent application by MedielSoft. Contact for privacy, support and deletion requests: erdt.martin@medielsoft.cz. This policy describes data protection in the Android app, crash diagnostics, and data processing for advertising and in-app purchases. Lounge Wallet is not an official LoungeKey, Collinson or bank application.

Your accounts and membership data

You choose which existing LoungeKey accounts to add. The app sends your username and the password-derived authentication value directly to the LoungeKey/Collinson service over HTTPS to sign in and retrieve your memberships, visit allowances, visit history and current digital card. MedielSoft does not receive or store your LoungeKey wallet or account credentials. LoungeKey/Collinson separately controls its own service and account records.

Lounge directory and optional location

In a real wallet with added cards, the directory automatically stays scoped to your cards without a filter control. The general directory is used only when member search is unavailable (no added cards). For My cards, the app retrieves the authenticated account profile, its primary subscription, the actual subscription product's directory and that profile's excluded lounge codes directly from LoungeKey/Collinson over HTTPS. These requests use the account's Collinson session and do not pass through a MedielSoft server. In My cards mode, search text is matched against the retrieved catalogue on your device rather than sent as a public search query. For this purpose, derived profile and subscription data and the exclusion list remain only in temporary app memory and are reused for up to five minutes; product catalogues are reused for up to 30 minutes, with a maximum of three products. These caches are not written to disk; entries are replaced when refreshed or released with the client memory. Reused data can become outdated during that time and results do not guarantee admission, a free visit or terminal access. Check your card's current official terms before travel.

In general mode, submitting a search sends the city, airport or IATA-code search text directly over HTTPS to the public LoungeKey Single Use Pass directory operated by LoungeKey/Collinson. Credentials, account identifiers and membership data are not sent to the public directory or placed in its public links. This directory belongs to a separate programme and a listing does not confirm eligibility under your card. In both modes, photographs are loaded directly from the provider's image service; network services receive connection information such as your IP address. Unsaved results and loaded photographs remain in temporary app memory. The directory requires internet access and its content may be in English. Card badges on results use existing local card names and masked final four digits; they are displayed in the app and are not sent to the public directory.

If you mark a lounge as a favorite, a snapshot of its display details, including its name, conditions as received when saved, photograph URLs, source kind (membership directory or Single Use Pass) and save time, is stored in the app's private local storage; up to 100 lounges can be saved. This record contains no references to your accounts, card badges, subscription identifiers or credentials and does not preserve proof of a particular card's eligibility. Storing photograph URLs does not permanently store the photographs themselves. The app also remembers up to eight recently selected airports and your choices for showing introductory information and sorting by location. These preferences are not a history of all search queries and are not sent to a MedielSoft server. Saved information can become outdated; check it with the provider before travel. You can remove a favorite lounge in the app.

The optional Nearby button requests Android's foreground approximate-location permission only after you choose it. Approximate location is sufficient; this feature does not require precise or background location. If you separately enable remembered sorting by location, the directory may reuse already granted permission when it opens or returns to the foreground; you can turn this sorting off again. The app compares a short-lived position with a bundled public-domain OurAirports airport-coordinate index on the device. Our code does not store your position coordinates or send them to the directory, advertisements, diagnostics or MedielSoft. Location is supplied by Android and, where available, Google Play services under the device's settings and Google's policies. Choosing an airport from the nearby list uses its public IATA code as a local filter in My cards mode or sends it as a normal search in the general directory. Denying or revoking permission leaves manual search available. You can revoke permission in Android settings. Airport-coordinate data: https://ourairports.com/data/.

Optional background reminders

Reminders for airports with saved lounges are off by default. Before enabling them, the app presents a separate prominent explanation and asks for your agreement. Only afterwards are precise foreground location, notifications and background location handled in separate steps; on Android 11 and later you select Allow all the time for location in system settings. Reminders can work while the app is closed. Without these permissions, manual search and the separate approximate nearby-airport feature remain available.

Google Play services receive the public codes and centres of airports with your favorite lounges, up to 100 areas with a three-kilometre radius. Android and Google Play services evaluate dwelling nearby for approximately five minutes; delivery may be delayed. The app's private local storage contains chosen codes, public airport names and centres, opt-in flags and technical registration metadata. The app does not read the position attached to a reminder event and does not store GPS or other coordinates of your position. MedielSoft does not operate a location backend and the app does not send these data to MedielSoft.

To prevent repeated alerts, the phone locally stores an airport code and the time of the last alert for a 24-hour cooldown. This information may indicate that you were near that airport, so we do not treat it as anonymous technical data. After 24 hours the cooldown expires and the old time is removed when the app or reminders are next processed; physical deletion exactly at hour 24 cannot be guaranteed while the device is powered off or no further processing occurs. Switching the feature off and back on during that period does not bypass the cooldown. No further movement history is created.

An alert does not confirm access to a particular terminal or eligibility to enter a lounge. Notifications use private lock-screen visibility and generic public text; the app omits the airport name while the device is locked. Tapping opens the normal app with its optional lock, never a QR code directly. You can turn the feature off in the app or revoke its permissions in Android. Disabling stops alerts, removes registered areas and the selected area details; if technical removal fails, cleanup remains recorded for retry and the app shows an error. The last alert time can remain until the expiry described above. After device restart, only previously enabled areas are re-registered, provided permissions remain granted. Google's privacy information: https://policies.google.com/privacy.

The public demo uses fictional examples and bundled illustrative photographs offline. Its favorites and recent airports remain only in session memory; it does not request location, enable reminders, ask for ratings or load directory photographs from the network.

Local storage and images

Usernames, password-derived authentication values, session credentials, membership data and preferences are stored locally using the device's protected storage. The app does not store your original plaintext password. Optional card images are cropped and masked by you, stripped of EXIF metadata and encrypted on the device. Camera and image-picker access are used only when you choose an image; images are not automatically uploaded. Do not photograph a CVV/CVC or the reverse of a card, and verify that all but the final four digits are covered before saving.

Encrypted backups

Backups are created only when you request an export. They contain the selected wallet data, optionally including masked images, encrypted with your separate backup password. You choose their destination using the system picker, which may include your own cloud provider. The developer cannot read or recover the backup or its password. Removing an account from the app does not remove existing backup files; manage those copies separately.

Crash diagnostics

We use Google Firebase Crashlytics to investigate crashes and improve reliability. Reporting starts when you choose the real wallet. The public demo uses fictional in-memory data and does not initialize Firebase on a cold start; previously queued reports from a real session may still be processed. Crashlytics can send crash stack traces, technical application state, app/OS versions, device metadata and generated installation identifiers to Google. The Firebase installations and sessions components support crash diagnostics and quality metrics. Dart error reports sent by our code contain the error type and stack trace rather than the original exception message. We do not attach account names, usernames, card numbers, wallet balances, QR contents, photos, passwords, session tokens or purchase tokens to crash reports. Native crash reports can include technical exception messages and device state. Crash reporting is enabled for real-wallet sessions in this release and there is currently no separate in-app opt-out switch for that mode.

According to Firebase's published retention policy, Crashlytics keeps crash traces and associated identifiers for 90 days before starting removal from live and backup systems. Firebase installation and session data can follow different retention periods. Details: https://firebase.google.com/support/privacy and https://policies.google.com/privacy. Processing by Google may take place outside your country under its applicable data-protection arrangements. Network services also receive connection information such as your IP address when you contact them.

Advertising and purchases

When the free version displays AdMob ads, it uses the Google Mobile Ads SDK; this app marks ad requests as non-personalized and requests ads only after Google's User Messaging Platform (UMP) says they are allowed. UMP updates consent information when the ad flow initializes, displays any required message and provides a privacy-options entry point when required. If consent status cannot be obtained or ads are not allowed, the app does not request ads. Even for non-personalized ads, Google says the SDK automatically collects and shares data for ad delivery, analytics and fraud prevention: IP address (which may be used to estimate approximate location); app and ad interactions (such as app launches, taps and ad views); app and SDK performance diagnostics (such as launch time, hang rate and energy usage); and device and account identifiers, including Android Advertising ID, App Set ID and, where applicable, other identifiers for accounts signed in on the device. Google says SDK data is encrypted in transit using TLS. Android Advertising ID collection can be limited through device settings or the app manifest. The app shows an interstitial only on a user-initiated transition to a QR card, subject to a frequency limit (at least two minutes between displayed ads and three QR transitions). We do not send LoungeKey account data, QR contents, photos or purchase tokens to the ads SDK. See Google's [Mobile Ads data disclosure](https://developers.google.com/admob/android/privacy/play-data-disclosure) and [UMP privacy documentation](https://developers.google.com/admob/flutter/privacy).

If you choose the one-time, permanent removal of ads (remove_ads_lifetime), Google Play processes the payment; we do not receive payment-card numbers or CVV. The app verifies the signature of the Google Play purchase receipt locally and stores the entitlement record in the device's protected storage. Restoring a purchase checks ownership through Google Play under the account used for the purchase. We do not send the receipt, purchase token or installation identifier to MedielSoft or to a developer-operated verification server. The entitlement does not depend on a seven-day server certificate or periodic renewal with MedielSoft. Verification and restoration depend on Google Play's availability and information. Deleting local data removes the local record; the purchase can be restored through Google Play. See [Google Play purchase information](https://support.google.com/googleplay/answer/1050566).

Google Play reviews

The app includes an optional link to its Google Play listing. It may also offer Google's in-app review flow at a natural pause after use; app features and benefits do not depend on reviewing, and no advance question asks about your satisfaction or a number of stars. To limit frequency, the device stores the first-use date, a count of real-wallet launches, the count and time of review-flow attempts, and when you manually open the review listing. These preferences do not record an actual rating and are not sent to MedielSoft. Google Play decides whether to show a dialog; the app does not learn whether you reviewed, your star rating or your review text. Google Play handles submitted ratings and reviews under its own policies. The public demo does not use this feature.

App lock

On Android, an optional app lock is off by default. When enabled, the operating system authenticates the user with biometrics or the device screen-lock credential. The app receives only the system authentication result and stores only an enabled flag in protected local storage. The app cannot see, store or send the device PIN/passcode or biometric data or templates; Android manages those. This feature does not add biometric data collection and is separate from LoungeKey sign-in credentials and the encrypted-backup password. If the device has no screen lock configured, the regular wallet remains available. The public demo does not use the app lock.

Retention, deletion and your choices

Local account data remains until you remove the account or remove the app's data. Public favorite lounges, recent airports, display preferences and review scheduling are separate from a LoungeKey account; removing that account does not automatically delete them. Favorites can be removed in the directory, newer choices replace older recent airports, and removing the app's data deletes all local preferences. The last-reminder time follows the 24-hour cooldown expiry described above. This does not delete your official LoungeKey account or records retained by LoungeKey, your bank or a backup provider. Contact the relevant service for those records. We do not create a separate developer-hosted user account. Contact erdt.martin@medielsoft.cz for privacy questions or requests about diagnostic and purchase data; we may need enough information to identify the relevant report, and cannot identify every installation from an email address alone. Depending on applicable law, you may have rights to access, correct or erase personal data, restrict or object to processing, and complain to your data-protection authority.

The app is intended for people eligible to hold and use their own lounge memberships, not for children. We do not sell wallet data. If the app's processing changes, we will update this policy before enabling the new services.