Privacy Policy
This policy explains what we collect about you, why, how long we keep it and what you can require of us. It covers Reward ID only — a sponsor's own site has its own policy.
1. Who is responsible
The controller of your personal data is [registered company name], [registered address].
Write to [legal@example.com] about anything in this policy: a copy of your data, a correction, deletion, or a complaint.
We answer within one month. Where a request is complex we will say so and may take up to two months more.
2. What we collect
When you register we store your email address, a normalised form of it (lowercased, with dots and plus-suffixes removed) used only to stop the same address being registered twice, and your password as a one-way hash — we never see or store the password itself.
We store the country you give us and every later change to it, your Reward ID, your invite code, your language, and the invite or publisher link you arrived through.
At registration and at every login we record the IP address the request came from, the browser user agent, and a device fingerprint: a hash calculated in your browser from your user agent, language, time zone, screen size and processor count. It is a hash — it cannot be turned back into those values.
While you use the programme we record which sponsors you open through us and when, your credit ledger, quest and season progress, shop orders, jackpot tickets and notifications.
If you request a cash payment we store the details you enter — bank name, IBAN, BIC and account holder, or crypto asset, network and wallet address — on your payout profile and as a snapshot on the request itself.
If you report a missing reward or contact support, we store what you write, the date you give and the brand it concerns.
3. Why we use it, and on what legal basis
To run your account and the programme — registration, login, ranks, credits, prizes and payouts. Basis: performance of our contract with you.
To prevent fraud and abuse — detecting one person behind several accounts, self-referral, reward farming and account takeover. Basis: our legitimate interest in a programme that pays out real money, and our sponsors' interest in not paying for fake customers. This is why we keep IP addresses and device fingerprints.
To honour the country rules our sponsors are licensed under, and to show you only the brands that may legally take you. Basis: our legitimate interest.
To send you service messages, and — where you switch them on — season, quest and reward notifications, including on Telegram if you link it. Basis: our contract for service messages, your consent for the rest. You can switch the optional ones off in Settings at any time.
To keep the records we are required to keep, in particular of payouts. Basis: legal obligation.
4. IP address and device fingerprint
Your IP address does two jobs: it tells us which country to show you sponsors for before you have told us yourself, and it lets us compare a registration or login against other accounts.
The country lookup runs against a database on our own servers. Your IP address is not handed to an advertising network and is not used to build a profile of you.
The device fingerprint exists so that a second account created on the same machine is visible to us without us storing anything that identifies the machine itself.
These signals are read only by us and only for fraud review. A match never closes an account by itself — a person reviews every flag.
7. Transfers outside the EU
Our systems run in the EU. Where a provider processes data outside the EU or EEA, the transfer rests on the European Commission's standard contractual clauses or on an adequacy decision.
Write to us for a copy of the safeguards that apply to a particular transfer.
8. How long we keep it
Account data is kept for as long as your account is open.
After the account closes we delete or anonymise it, except what we must keep: payout records and the ledger entries behind them for the period accounting law requires, and the fraud signals of an account closed for confirmed abuse, so the same person cannot simply register again.
Session records, and the IP addresses in them, are kept for up to 12 months for security.
Support messages and claims are kept for up to 24 months after they are resolved.
9. Your rights
You can ask for a copy of your data, and for a machine-readable export of what you gave us.
You can have inaccurate data corrected. Your country and your payout details you can correct yourself in Settings.
You can ask for deletion. We will do it unless we have to keep something under the paragraph above — in which case we will tell you exactly what we kept and why.
You can object to processing we base on a legitimate interest, ask us to restrict it while a dispute runs, and withdraw a consent you have given. Withdrawing does not undo what was lawful before it.
You can complain to the data protection authority of the country you live in, or to the one where we are established. We would rather you told us first.
10. Security
Passwords are stored only as hashes, traffic runs over TLS, and administrative access to member data is limited to the people who need it.
If a breach is likely to put you at risk, we will tell you and the supervisory authority within the deadlines the law sets.
11. Children
Reward ID is not for anyone under 18, and we do not knowingly collect data about children.
If you believe someone under 18 holds an account, write to us and we will remove it.
12. Changes to this policy
We keep this page up to date, with the date of the current version at the top.
Where a change matters to you we will tell you in the app or by email before it takes effect.
Write to us and we will answer within 30 days.
Operator: [registered company name] · Registered address: [registered address] · Contact: [legal@example.com]
Also worth reading: Terms & Conditions