Privacy Policy

Information you give us

• Account details: your email address and password. We store only a salted one-way hash of your password, never the password itself. We give you a random username when you sign up, and you can change it.
• Referral code: the code or link of the friend who invited you, if any.
• Cash-out details: the reward you choose and, for top-ups and PayPal payouts, the recipient details the reward needs, such as a phone number, a game or player ID, or a PayPal email address.
• Support messages: what you write to us, and our replies, and any screenshots or short videos you attach. We keep a rebuilt copy of each file, not the original: images are re-saved as new pictures and videos get a new file wrapper, which removes hidden data such as the location where a photo or video was taken.
• Old account email: if you connect an account from our old website, the email you used there. We use it to send a link to that address and don’t keep it.
• Tax details: only if the law requires us to ask, such as your legal name, address and taxpayer identification number.
• Requests about your data: what you tell us when you use your rights.

Information collected automatically

• Network information: your IP address and, from it, the country you’re connecting from and your network (the internet provider or organisation the address belongs to). Cloudflare, our hosting provider, works these out.
• Browser details: your browser’s “user agent”, which names the browser, its version and your operating system.
• Device check: a random identifier stored in your browser, and a one-way summary (a hash) of basic browser settings: user agent, languages, time zone, screen size and colour depth, pixel ratio, number of processor cores, device memory and touch support. Your browser makes the summary, so we only receive the hash, and we store the identifier only in a keyed, hashed form. We don’t use canvas, audio or other invasive fingerprinting. This is sent when you sign up, sign in and cash out.
• Security signals: where available, a bot score and a technical fingerprint of your secure connection from Cloudflare, which help tell people apart from automated traffic, and the result of the sign-up check (Cloudflare Turnstile). We also ask proxycheck.io what kind of network each IP address you use is on (home, mobile, business or data centre) and whether it is a VPN, proxy or Tor, and keep its answer.
• Sessions: a cookie that keeps you signed in, and a record of when you signed in, with your IP address and browser details.
• Activity: when you open an offer wall, the rewards credited to you and reversed, your balance and history, daily bonus claims, referrals, cash-outs, and when you view a gift card code.

In our Android app

Our Android app opens GaintPlay with details of your phone added to the address. We take them out of the address straight away, keep them in the app’s browser storage, and send them to our servers once you’re signed in, and again when they change. They are:

• Device details: the phone’s brand, model and device name, the app’s version, your SIM operator’s name, your time zone, and the country and language set on the phone. Older versions of the app also report whether it was installed from Google Play, whether developer mode is on, and whether the phone is rooted, an emulator, a tablet or Wi-Fi only, or runs the app as a clone or for a secondary Android user.
• Advertising ID: the phone’s Google advertising ID. We store it encrypted, and a keyed one-way hash of it to spot several accounts on one phone.
• Android ID: the identifier Android gives the app on your phone, and the app’s install ID, which is made from it. We keep each only as a keyed one-way hash, never the identifier itself.
• AppsFlyer ID: the ID that AppsFlyer’s software in the app gives your installation (section 5).
• Push token: if you allow notifications, the token Google’s Firebase Cloud Messaging gives the app, so we can send notifications to that phone.
• Play Integrity result: when you collect the app bonus, the app asks Google’s Play Integrity service whether it is the genuine GaintPlay app from Google Play on a genuine Android device. We keep Google’s answer (yes or no for each check, and whether Play Protect is on), not anything that identifies the phone.

Some versions of the app also add the phone’s build details, screen size, memory and storage. We don’t keep those. Inside the app, AppsFlyer’s software also collects information on your phone for AppsFlyer, as section 5 describes.

Information from partners and suppliers

• Offer partners tell us when you complete a task, or when it is reversed: the transaction ID, the offer’s name, your reward, what the partner paid us, the status, and usually the IP address you used when you completed it.
• WizzGift, our reward supplier, tells us the status of your order and sends us the gift card code, PIN or link that we deliver to you. We store codes encrypted.

Information from our old website

If you had an account on our previous website, we don’t copy it here. When you ask to connect it, we look your old email up on the old website. When you open the link we send you, we read that one account’s earnings and cash-out history from the old website to work out your balance, and keep a small record of it: a one-way hash of your email address (not the address itself), your old username, your balance, lifetime totals and counts, the dates of your last earning and cash-out, and whether the account was active, deleted, banned or blocked. Our team may look at the old account’s history on the old website when reviewing a transfer or answering a support request. The old website records which GaintPlay account it was connected to.

Information we create

Risk scores and flags, records of automated and staff decisions with their reasons, and records of AI reviews (section 4).

What we don’t collect

We don’t ask for your real name, date of birth, home address, photos, contacts or precise location, and we don’t ask for a phone number unless a reward you choose needs one. We don’t collect payment card or bank details, and we don’t currently ask for identity documents. The website doesn’t use analytics, advertising or social media trackers; in the Android app, AppsFlyer’s ad measurement is the one exception (section 7).

Cash-out reviews

Every cash-out is checked before it’s sent. First, our risk rules look at signals such as: how old your account is and whether your email is confirmed; how much you’ve earned, from which partners and how quickly; how many rewards were reversed; whether rewards arrived without a recorded offer wall visit; how many countries and networks you’ve connected from; whether other accounts use the same device, network or payout details; if you use our Android app, whether other accounts were seen on the same phone and what the app reports about the phone (for example that it is an emulator or runs a cloned app); and your past cash-outs. The rules produce a risk score.

Then an AI model, Anthropic’s Claude, reviews the same signals and the score, with a timeline of recent account events (their types, dates, countries and amounts), and recommends approving, holding or declining, with its reasons. We don’t send it your email address, your username, your IP addresses, your payout details or your phone’s identifiers (it sees only counts, yes/no checks and short fragments of their hashes).

• Approve: an AI approval stands only for smaller cash-outs, within limits we set, when the risk rules don’t flag anything and there’s no open concern on the account. Otherwise the cash-out waits for a person.
• Hold: our staff review the cash-out and decide.
• Decline: in clear cases, such as strong signs of multiple accounts, a cash-out can be declined without a person reviewing it first. Your coins go back to your balance, and we email you.

The result decides whether and when you receive the reward you asked for. It doesn’t otherwise change your balance.

Your right to a human review

You can ask for a person to review any decision about your cash-out, give your point of view, and contest it: reply to our email or write to support@gaintplay.com. A member of staff will look at the full picture, can overturn the decision, and will tell you the outcome. You can also ask us to explain the main reasons for a decision.

Fraud investigations

When our systems or staff flag an account, the AI may review the flag and recommend what staff should do. It doesn’t take any action itself: a person decides. For this review it receives your username, account and activity details (status, country, balance, recent rewards and cash-outs), the countries and network operators you’ve connected from (not your IP addresses), how many other accounts share your devices, phones or networks, what the Android app reported about your phone (yes/no checks, not its identifiers), and, if you connected an old account, its record.

Support replies

When you contact support, our AI assistant may reply first. It receives your messages and the account details it needs to answer: your username, account status and country, balance, pending rewards, and recent rewards and cash-outs. It can’t change your account or move coins, and it passes the conversation to a person for anything involving coins, cash-outs, restrictions or disputes, or after a few replies.

Other automatic steps

Some rules run automatically without AI: larger rewards are held for a set time before they become available; a reward reversed after its coins were spent flags the account and pauses its cash-outs; accounts with signs of automated sign-up get a closer look; and when the Android app reports a phone already used by other accounts, an emulator, a cloned app, a rooted phone or a secondary Android user, the account is flagged for our team. A flag never closes or blocks an account by itself.

Service providers

These companies process information for us, only on our instructions and under contracts that require them to protect it:

Offer partners

When you open a partner’s offer wall or survey, we send the partner your GaintPlay user ID and a visit ID so it can credit you. Some partners also receive your username, your country, or a coded version of your email address that only we can match (a keyed hash), and, in the Android app, partners whose offers need it receive your advertising ID (all zeros if we don’t have it). We never send partners your email address itself. Partners send us reports of completed tasks (section 2), and we may share information with a partner to investigate fraud or a disputed task.

Inside their offer walls and surveys, partners and the advertisers they work with collect information directly from you, such as survey answers, device information and cookies. For that information they are independent controllers, responsible under their own privacy policies, which you’ll find in each offer wall. We don’t receive your survey answers.

Reward suppliers

WizzGift supplies gift cards and top-ups and sends PayPal payouts. For each cash-out we send WizzGift the reward and amount, our order reference, and any recipient details the reward needs (a phone number, a game or player ID, or a PayPal email). WizzGift passes them to whoever delivers the reward, such as your mobile operator, the game publisher or PayPal, which use them under their own privacy policies. We don’t send WizzGift your account email for gift cards: codes come back to us, and we show them to you.

Pictures from other services

Profile pictures are drawn from your username by DiceBear, an avatar service. When a picture is shown, the viewer’s browser asks DiceBear for it, so DiceBear receives the username and the viewer’s IP address. Gift card pictures load from our supplier’s servers, which see your IP address in the same way.

For legal reasons and safety

We may disclose information if we believe in good faith that the law requires it (for example a court order or a request from a tax authority), or to protect the rights, property or safety of our members, partners, us or the public, including to prevent fraud. Where we can and the law allows, we’ll tell you first.

If our business changes

If GaintPlay or Sapniverse LLC is sold, merged or reorganised, information may pass to the new owner, which must keep to this policy or tell you about any changes.

With your permission

We’ll share information in other ways only if you ask us to or agree.

Partner cookies in offer walls

Offer walls and surveys open inside GaintPlay in a frame, or in a new tab. The partner’s pages, and advertisers’ pages you visit from them, may set their own cookies and similar technologies, for example to record that you completed a task or to prevent fraud. The partner controls them under its own policy. You can manage them in your browser settings, but blocking them may stop tasks from being credited. Some offers ask to use your camera or microphone; your browser asks you first.

When you delete your account

• Straight away we erase your email address, password, username (replaced with a placeholder such as “deleted-1a2b3c4d”), settings, app tokens, what the Android app reported about your phones (including your advertising ID), the old username and email hash of any old account you connected, and all your sessions, so you’re signed out everywhere. The subject and text of your support messages are replaced with “[deleted]”, and the screenshots and videos you attached are deleted within a day. IP addresses and browser details are removed from your session, device, sign-in and activity records.
• We keep, linked only to an internal account number, your ledger, rewards and cash-out records (including encrypted recipient and delivery details and any AI review of a cash-out) for up to 7 years after each transaction, for accounting, tax, chargebacks, disputes and fraud prevention. IP addresses that partners reported with a completed task, or that were recorded with a cash-out, stay with those records.
• For up to 3 years we keep fraud markers: a keyed one-way hash of your email address and of your device identifier, and, if you used the Android app, the hashes of your Android ID, install ID and advertising ID, so a deleted account can’t be re-created to claim new-member rewards again.
• We send a confirmation to your email address before we erase it. A deleted account can’t be restored, and an old-website balance you already claimed can’t be claimed again.

If you used the Android app and haven’t opted out of ad measurement, we tell AppsFlyer that the account was deleted (with your AppsFlyer ID and advertising ID), as it is one of the app events in section 3. Partners, WizzGift and AppsFlyer keep what they received under their own policies; contact them directly, or ask us, to have it deleted.

How to use your rights

• Download your data: on your Account page, choose “Download my data”. You get a JSON file with your profile and settings, balance and ledger history, pending rewards, rewards (offer, partner, coins, status and dates), bonuses, cash-outs (reward, amount, status, dates and the recipient details you entered, but not gift card codes, which stay in the app), referral earnings, support conversations, sessions, devices, the IP addresses we’ve seen (with country, network, browser, first and last seen), what our Android app reported about your phones (including your advertising ID), your notification setting, the app events we sent to AppsFlyer, and any old account you connected. You can do this a few times a day.
• Delete your account: on your Account page, in the app or on the website. You’ll confirm with your password, and you can’t delete while a cash-out is in progress. Section 10 explains what happens.
• Change your username or public name setting: on your Account page.
• Anything else, or if you can’t sign in: email support@gaintplay.com from the address on your account and tell us what you’d like.

Checking it’s you. To protect your account, we act on requests made while you’re signed in, or sent from or confirmed through the email address on your account. If we can’t verify you that way, we may ask for a little more information, which we’ll use only to verify you.

Someone acting for you. An authorised agent, or a parent or guardian, can make a request for you. We’ll need proof of their authority, such as your signed permission or a power of attorney, and we may ask you to confirm your identity directly with us.

How long we take. We reply within one month under the GDPR and UK GDPR, within 45 days under US state laws, within 30 days in Canada, Australia and Singapore, and within 15 days for a full access report in Brazil, or sooner if your local law requires. If we need more time and the law allows it, we’ll tell you why within the first period. Requests are free unless they are clearly unfounded or excessive.

EEA, UK and Switzerland

Sapniverse LLC is the controller (447 Broadway, 2nd Floor Suite 2206, New York, NY 10013, USA). Section 3 sets out our legal bases. Some cash-out decisions are made by automated means (section 4); we rely on Article 22(2)(a) of the GDPR and UK GDPR, because the decision is necessary for our contract with you, and you have the right to obtain human intervention, to express your point of view and to contest the decision. You have the rights in Articles 15 to 22: access, rectification, erasure, restriction, portability and objection.

You can complain to the data protection authority where you live or work, or where you think a problem happened. In the UK that is the Information Commissioner’s Office (ico.org.uk), and in Switzerland the Federal Data Protection and Information Commissioner. We’d appreciate the chance to help first.

California

We give everyone in California the rights in the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA).

Notice at collection. We collect the categories of personal information in the table below, from the sources in section 2, for the purposes in section 3, and keep each for the periods in section 10. We don’t sell personal information. Our Android app’s ad measurement with AppsFlyer (section 7) may count as “sharing” for cross-context behavioural advertising, and you can opt out of it as section 7 explains. We use sensitive personal information only for purposes the CCPA allows.

Your rights. You can ask to know what personal information we’ve collected (including specific pieces), to delete it and to correct it. You have the right to opt out of sale and sharing (we don’t sell; for the app’s ad measurement see section 7; we honour Global Privacy Control), and to limit the use of sensitive personal information (we already use it only to provide and secure GaintPlay, so this right doesn’t change anything). You can access information about our automated decision-making for cash-outs and appeal a decision to a person who can overturn it (section 4). Use the steps in section 13; authorised agents are welcome.

No discrimination. We won’t deny you service, charge you a different price or give you a lower quality of service because you used your rights. Some rights, such as deletion, mean we can no longer provide your account.

Under 18. If you’re under 18 and live in California, you can remove content you posted publicly on GaintPlay (your username on the live feed and leaderboard) with the public name setting, or ask us to remove it. This may not remove copies others have made.

Direct marketing. We don’t share personal information with third parties for their own direct marketing.

Notice of financial incentive. GaintPlay is a rewards program: you earn coins for tasks you complete, plus the daily bonus, referral commissions and other promotions. Because we need some personal information to run it (the information in section 2), California law treats these rewards as a financial incentive.

• Material terms: coins are earned and cashed out under our Terms. Referral commissions are a share (currently 5%) of the coins your invited friends earn from offers, paid by us, not by your friends.
• Opting in: by creating an account and, for referrals, by sharing your link. Taking part is voluntary.
• Withdrawing: you can stop at any time by deleting your account. Coins left in the account are given up, so cash out first.
• Value of your information: we don’t set a separate value on your personal information. We work out its value to us from the revenue partners pay us when you complete their tasks, less what it costs to run GaintPlay. The coins we pay you are a share of that revenue, and they are our good-faith estimate of the value of your information to us. Referral commissions come from our share of what partners pay for your friends’ tasks.

Other US states

If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island or Nebraska, your state’s privacy law gives you the right to confirm whether we process your personal data and to access it, to correct it, to delete it, to get a portable copy, and to opt out of targeted advertising, the sale of personal data, and profiling that leads to decisions with legal or similarly significant effects. We don’t sell personal data. The Android app’s ad measurement (section 7) may count as targeted advertising under some of these laws; you can opt out of it as section 7 explains. We use profiling to review cash-outs (section 4), and you can ask for a person to review any of those decisions. In Minnesota, you can also question the result of profiling, learn the reasons for it, and have it looked at again with corrected data. In Oregon, Delaware, Maryland and Minnesota, you can ask for a list of the specific third parties we’ve disclosed your data to; section 5 names them.

Appeals. If we turn down your request, you can appeal by replying to our answer, or by emailing support@gaintplay.com with “Privacy appeal” in the subject, within 45 days of our decision. We’ll answer within 60 days (45 days in Colorado) and explain what we decided and why. If you’re not satisfied, you can contact your state’s attorney general.

Nevada residents: we don’t sell covered information. We don’t collect consumer health data. If a partner’s survey asks health questions, the partner collects the answers under its own policy.

Canada

We handle personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, the Act respecting the protection of personal information in the private sector. You can access and correct your information, and withdraw your consent, subject to legal and contractual limits, by deleting your account. Your information is stored and processed outside Canada, mainly in the United States, where authorities may be able to access it under local law.

In Quebec, you have the right to be told when a decision about you is based only on automated processing, to know the information and the main factors used, to have that information corrected, and to submit your observations to a member of staff who can review the decision (section 4). You also have the right to data portability. Our person in charge of the protection of personal information can be reached at support@gaintplay.com. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

Brazil

Under the Lei Geral de Proteção de Dados (LGPD), our legal bases are performance of a contract, compliance with a legal obligation, the regular exercise of rights in legal proceedings, and legitimate interests, applied to the purposes in section 3. You have the rights in Article 18: confirmation and access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, information about who we share with, information about not giving consent and its consequences, and revoking consent. Under Article 20 you can ask for a review of decisions made only by automated processing, and for information about the criteria used (section 4). International transfers rely on the mechanisms in Article 33, including standard contractual clauses approved by the ANPD. Contact us at support@gaintplay.com; you can also complain to the Autoridade Nacional de Proteção de Dados (ANPD).

India

Under the Digital Personal Data Protection Act, 2023 and its Rules, you have the right to a summary of the personal data we process and how we process it, to have it corrected, completed, updated or erased, to nominate someone to use your rights if you die or become unable to, and to have your grievances addressed. Send grievances to support@gaintplay.com; we’ll respond within the time the Rules set. If you’re not satisfied, you can complain to the Data Protection Board of India. Because the Act treats everyone under 18 as a child, GaintPlay is only for people 18 or older in India.

Australia

We handle personal information in line with the Privacy Act 1988 and the Australian Privacy Principles. You can ask to access and correct your information. We disclose personal information to recipients overseas, mainly in the United States (sections 5 and 9). Section 4 describes the kinds of personal information used in automated decisions that could significantly affect you, and those decisions. If you have a complaint, contact us first; if we haven’t resolved it within 30 days, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Nepal

We collect and use personal information in line with the Individual Privacy Act, 2075 (2018) and its Regulations: with your knowledge, only for the purposes in this policy, and kept secure. You can ask to see, correct or delete your information, and ask us to stop using it where the law allows. Contact us at support@gaintplay.com.

Singapore, Japan, South Korea and South Africa

• Singapore: under the Personal Data Protection Act you can ask for access to and correction of your personal data and withdraw consent. Our contact for data protection matters is support@gaintplay.com, and you can also contact the Personal Data Protection Commission.
• Japan: we provide personal data to service providers in the United States (sections 5 and 9), whose privacy rules differ from Japan’s, and we require them by contract to protect it. You can ask us to disclose, correct, stop using or delete your retained personal data.
• South Korea: your personal information is transferred overseas as sections 5, 9 and 10 describe (the recipients, countries, purposes, items and retention periods), to provide GaintPlay. You can refuse by not using GaintPlay or by deleting your account, but we can’t provide the service without it. You can ask for access, correction, deletion and suspension of processing.
• South Africa: under the Protection of Personal Information Act you can access, correct and delete your information and object to its use, and complain to the Information Regulator (inforegulator.org.za).