Cookie Policy
Last updated November 3, 2026
This page lists every cookie and similar technology the rewardy.io website and the Rewardy app use, who sets it, why and how long it stays. Our Privacy Policy explains what data we keep about your account.
Who we are
Rewardy (rewardy.io and the Rewardy app) is run by Rewardy Media AB (org. nr 559335-8897), Gothenburg, Sweden. Email support@rewardy.io with any question about cookies or your data.
What cookies are
Cookies are small text files a website saves in your browser. Cookies we set ourselves are first-party cookies. Cookies set by other companies, for example through a video player or a security check on our pages, are third-party cookies. Session cookies disappear when you close your browser; the others stay for the time shown below.
We also use similar technologies: local storage and session storage in your browser, and scripts or players from other companies that can store their own data. The lists below cover all of them.
Why we're allowed to use them
Necessary cookies don't need your consent. The law allows cookies that are strictly needed to provide the service you asked for, and we have a legitimate interest in running Rewardy securely (GDPR Art. 6(1)(f)). Analytics and embedded content cookies are only used with your consent (GDPR Art. 6(1)(a)).
You can withdraw your consent at any time. That stops these cookies from then on but doesn't affect anything collected before.
Your choice
Visitors from the EU, EEA, UK and Switzerland choose which cookies we may use. Elsewhere you can stop Google Analytics with Google's opt-out add-on.
You can also block or delete cookies in your browser settings. If you block necessary cookies, signing in and parts of the site won't work.
Data outside the EU
Some providers, such as Google and Twitch, may process data in the United States. Our Privacy Policy explains how that data is protected.
Necessary cookies
Needed for the site to work and stay secure: signing in, protection against bots and remembering your cookie choice. These are always on.
__Secure-better-auth.session_token
Keeps you signed in.
Rewardy · 7 days, renewed while you use the site
__Secure-better-auth.session_data
Encrypted copy of your sign-in, so pages load faster.
Rewardy · 5 minutes
__Secure-better-auth.state
Protects Google and Twitch sign-in against forged requests.
Rewardy · 5 minutes
cc_cookie
Stores your cookie choice and its consent ID.
Rewardy · 12 months
cf_clearance
Shows Cloudflare that your browser passed its bot check.
Cloudflare · 12 months
__cf_ob
Cloudflare security and bot protection.
Cloudflare · Session
Google reCAPTCHA, hCaptcha
Bot check when you sign up, sign in or earn from streams. Loaded only at that step.
Google, Intuition Machines · Set by the provider
Offer wall partners
Set inside an offer wall when you open it, so your completed offers are tracked and paid.
TimeWall, Torox, BitLabs and other partners · Set by each partner
_cfPre_tabId
Cloudflare bot protection (session storage).
Cloudflare · Session
persist:nextjs
Saves app settings and your session state in your browser (local storage).
Rewardy · Until you sign out or clear it
isLoggingOut
Helps finish signing out cleanly (local storage).
Rewardy · Until you sign out or clear it
registeredDate
Your account creation date, sent along with requests to our server (local storage).
Rewardy · Until you sign out or clear it
lastAuthCheck
Avoids checking your sign-in on every page (session storage).
Rewardy · Until you close the tab
rushBannerDismissed, rushModalDontShow, rushModalLastAutoOpen
Remembers which Rewardy Rush banners and popups you closed (local storage).
Rewardy · Until you clear it
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| __Secure-better-auth.session_token | Rewardy | Keeps you signed in. | 7 days, renewed while you use the site |
| __Secure-better-auth.session_data | Rewardy | Encrypted copy of your sign-in, so pages load faster. | 5 minutes |
| __Secure-better-auth.state | Rewardy | Protects Google and Twitch sign-in against forged requests. | 5 minutes |
| cc_cookie | Rewardy | Stores your cookie choice and its consent ID. | 12 months |
| cf_clearance | Cloudflare | Shows Cloudflare that your browser passed its bot check. | 12 months |
| __cf_ob | Cloudflare | Cloudflare security and bot protection. | Session |
| Google reCAPTCHA, hCaptcha | Google, Intuition Machines | Bot check when you sign up, sign in or earn from streams. Loaded only at that step. | Set by the provider |
| Offer wall partners | TimeWall, Torox, BitLabs and other partners | Set inside an offer wall when you open it, so your completed offers are tracked and paid. | Set by each partner |
| _cfPre_tabId | Cloudflare | Cloudflare bot protection (session storage). | Session |
| persist:nextjs | Rewardy | Saves app settings and your session state in your browser (local storage). | Until you sign out or clear it |
| isLoggingOut | Rewardy | Helps finish signing out cleanly (local storage). | Until you sign out or clear it |
| registeredDate | Rewardy | Your account creation date, sent along with requests to our server (local storage). | Until you sign out or clear it |
| lastAuthCheck | Rewardy | Avoids checking your sign-in on every page (session storage). | Until you close the tab |
| rushBannerDismissed, rushModalDontShow, rushModalLastAutoOpen | Rewardy | Remembers which Rewardy Rush banners and popups you closed (local storage). | Until you clear it |
Analytics cookies
Google Analytics helps us see which pages people use, so we can improve Rewardy. Only turned on if you allow it.
_ga
Tells visits from the same browser apart for statistics.
Google · 400 days
_ga_<ID>
Keeps the state of a Google Analytics session.
Google · 400 days
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _ga | Tells visits from the same browser apart for statistics. | 400 days | |
| _ga_<ID> | Keeps the state of a Google Analytics session. | 400 days |
Embedded content cookies
The Twitch player on stream pages. Twitch and its partners may set their own cookies, including for advertising. Only loaded if you allow it.
unique_id, unique_id_durable, api_token, experiment_overrides, server_session_id, referrer_url
Set by the embedded Twitch player.
Twitch (twitch.tv) · Session to 13 months
KP_UIDz-ssn
Set by the embedded Twitch player.
Twitch (twitchcdn.net) · 1 day
ad-id, ad-privacy
Shows and measures ads in the Twitch player.
Amazon Advertising (via the Twitch player) · Set by the provider
UID, XID
Measures who watches ads and videos in the Twitch player.
Comscore (scorecardresearch.com, via the Twitch player) · Set by the provider
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| unique_id, unique_id_durable, api_token, experiment_overrides, server_session_id, referrer_url | Twitch (twitch.tv) | Set by the embedded Twitch player. | Session to 13 months |
| KP_UIDz-ssn | Twitch (twitchcdn.net) | Set by the embedded Twitch player. | 1 day |
| ad-id, ad-privacy | Amazon Advertising (via the Twitch player) | Shows and measures ads in the Twitch player. | Set by the provider |
| UID, XID | Comscore (scorecardresearch.com, via the Twitch player) | Measures who watches ads and videos in the Twitch player. | Set by the provider |
In the Rewardy app
The app doesn't use browser cookies, but it stores and reads some data on your phone in a similar way:
On-device storage
Keeps you signed in (in the phone's secure storage) and saves your app settings.
Rewardy · Until you sign out or uninstall the app
Device ID
An ID for your device, used to prevent fraud and duplicate accounts.
Rewardy · Until you uninstall the app
Firebase Analytics
Statistics on how the app is used, so we can improve it.
Google · Until you reinstall the app
Security checks
Confirm requests come from the real app on a real device, and detect modified apps, modified devices and known malicious apps, to prevent fraud.
Rewardy and security providers · While the app runs
Offer wall SDKs
Run the offer walls you open and track completed offers so you get paid.
Adjoe, Tapjoy, TapResearch, CPX Research · Set by each partner
Advertising ID
Read by offer partners to credit completed offers. On iOS only if you allow tracking.
Google (Android), Apple (iOS) · Until you reset it in your phone settings
Push notification token
Lets us send you notifications, only if you allow them.
Google, Apple · Until you turn notifications off or uninstall
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| On-device storage | Rewardy | Keeps you signed in (in the phone's secure storage) and saves your app settings. | Until you sign out or uninstall the app |
| Device ID | Rewardy | An ID for your device, used to prevent fraud and duplicate accounts. | Until you uninstall the app |
| Firebase Analytics | Statistics on how the app is used, so we can improve it. | Until you reinstall the app | |
| Security checks | Rewardy and security providers | Confirm requests come from the real app on a real device, and detect modified apps, modified devices and known malicious apps, to prevent fraud. | While the app runs |
| Offer wall SDKs | Adjoe, Tapjoy, TapResearch, CPX Research | Run the offer walls you open and track completed offers so you get paid. | Set by each partner |
| Advertising ID | Google (Android), Apple (iOS) | Read by offer partners to credit completed offers. On iOS only if you allow tracking. | Until you reset it in your phone settings |
| Push notification token | Google, Apple | Lets us send you notifications, only if you allow them. | Until you turn notifications off or uninstall |
Changes to this policy
When we add a tool that sets cookies, it appears on this page. If it needs your consent, we ask you again before using it.
Contact
Questions about cookies or your data? Email support@rewardy.io.
Also read: Terms of Service · Privacy Policy