Privacy Policy

Last updated October 19, 2026

This policy explains what personal data Rewardy collects when you use the rewardy.io website or the Rewardy app, why we collect it, who we share it with, how long we keep it and what rights you have. Our Cookie Policy lists every cookie and similar technology we use.

1. Who we are

Rewardy is run by Rewardy Media AB (org. nr 559335-8897), Gothenburg, Sweden. We are the controller of your personal data. Email support@rewardy.io with any question about this policy or your data.

2. What we collect

Data you give us

Account details: email address, username and password (stored only as a secure hash). If you sign in with Google or Twitch, we receive your account ID, email address, username and profile picture from them.
Twitch follows: if you sign in with Twitch, the list of channels you follow, so we can show you their streams.
Payout details: the email address or crypto wallet address you enter when you cash out.
Identity verification (rarely): in a small number of cases, before a cashout, we ask for your full name, a photo of your passport, national ID or driver's license, and proof of address (for example a recent utility bill). If we use an identity verification provider, it may also ask for a selfie and compare it with your ID. That comparison uses biometric data, which is only processed with your explicit consent in the verification step.
Challenge details: your Discord user ID and whether your Discord status mentions Rewardy if you join Discord challenges, and links to social media videos you submit.
Messages: what you write when you contact support.
Choices: newsletter sign-up, notification settings and cookie choices.

Data we collect automatically

Activity: offers and surveys you start and complete, points earned, cashouts, game and raffle activity, referrals and leaderboard results.
IP address and approximate location: your IP address and the country and internet provider we derive from it. We don't use GPS or your precise location.
Device and browser data: device model, operating system, browser type and language.
Device identifiers (app): a device ID, and the advertising ID of your phone when offer partners need it to credit offers (on iOS only if you allow tracking).
Security signals (app): whether the app or device has been modified, runs in an emulator, or has known malicious apps installed. We use this only to protect your account and prevent fraud.
Notification token (app): an ID that lets us send you notifications.
Usage statistics: which pages and features are used, through Google Analytics on the website and Firebase Analytics in the app.
Server logs: technical records of requests to our servers (IP address, time, page or API called, browser or app), used to run and secure the service.

Data we receive from partners

When you complete an offer or survey, the partner tells us which offer it was, the reward and the status (for example completed or reversed). Payout partners tell us whether a payout went through.

Survey partners may ask questions about your background, opinions and sometimes sensitive topics such as health or politics. Your answers go directly to the survey partner under its privacy policy. We don't receive or store them.

3. Why we use it and our legal basis

To run your account and pay you (signing in, crediting rewards, sending payouts, support): this is necessary to provide the service you signed up for (GDPR Art. 6(1)(b)).
To prevent fraud and keep Rewardy secure (detecting multiple accounts, fake completions, stolen accounts and modified devices; checking IP addresses, devices and payout details, and verifying identity before some cashouts): our legitimate interest in protecting Rewardy, our partners and honest users (Art. 6(1)(f)).
To improve Rewardy (usage statistics, fixing errors): our legitimate interest, and your consent where the law requires it, for example analytics cookies for visitors in the EU (Art. 6(1)(a) and (f)).
To send you emails and notifications: account emails (verification codes, password resets, payout confirmations) are part of the service. The newsletter is only sent if you sign up, and every newsletter has an unsubscribe link. You can turn notifications off in your phone settings (Art. 6(1)(a) and (b)).
To meet legal obligations (bookkeeping, tax and requests from authorities): Art. 6(1)(c).
To handle disputes and legal claims, for example recovering rewards obtained by fraud: our legitimate interest (Art. 6(1)(f)).

Some checks run automatically, for example to hold a suspicious payout or flag an account for review. If a decision like that affects you, email us and a person will look at it.

We don't sell your personal data and we don't use it to show you targeted ads.

We share only what each partner needs to do its job:

Offer wall and survey partners: Adjoe, Adscend Media, Ayet Studios, BitLabs, CPX Research, Lootably, MM Wall, myChips, Prime Surveys, TapResearch, Tapjoy, TimeWall, Torox and Tyrads. They receive your Rewardy user ID so they can credit you. Some also receive your IP address or email address to match surveys to you and prevent fraud. Tapjoy and Adjoe receive device data and your advertising ID in the app. If you use Adjoe's Playtime on Android and give it usage access, Adjoe receives which apps you use and for how long, so it can reward you for playing. Each partner collects its own data under its own privacy policy, which applies when you use its offers and surveys.
Payout partners: Tremendous (PayPal, Visa and gift cards) receives your payout email address. Our crypto payment provider receives your wallet address.
Sign-in and social partners: Google and Twitch when you sign in with them, Twitch when you watch streams on Rewardy, and Discord when you join Discord challenges.
Analytics: Google (Google Analytics and Firebase Analytics).
Service providers that process data for us under contract: hosting and database providers, content delivery and network security providers, an email delivery provider, IP location services, captcha, fraud-prevention and identity verification providers, and app security providers.
Authorities and others where the law requires it, or to protect our rights, for example in a fraud case.
A buyer or successor if Rewardy or its business is sold or merged.

5. What other users can see

Your username can appear publicly on Rewardy, for example in the live cashout feed, the activity bar, leaderboards and raffle results, together with what you earned or cashed out. If someone referred you to Rewardy, they can see your username, when you joined and how much you have earned. Choose a username that doesn't reveal your real name if you prefer not to be identified.

6. Data outside the EU

Our servers and database are in the United States, and some partners are based outside the EU. When we transfer data outside the EU/EEA, we use the safeguards the GDPR requires: the EU-US Data Privacy Framework where the recipient is certified, or the European Commission's Standard Contractual Clauses. Email us for more details.

7. How long we keep it

Your account: until you delete it. When you delete it, we close it right away and finish deleting it within 90 days, so late rewards or reversals from partners can still be processed. We may delete accounts that have been inactive for 180 days.
Rewards and payout history (completed offers, payouts, IP addresses, payout email or wallet): 7 years, as Swedish bookkeeping law requires.
Fraud-prevention data (device IDs, IP addresses, your email address in hashed form and the reason for any ban): up to 3 years after your account is deleted, so we can spot deleted accounts that sign up again to claim the same rewards. For banned accounts, as long as the ban applies.
Identity documents: deleted once the verification is complete. We keep only the result and the date.
Sign-in sessions: until you sign out or the session expires.
Support messages: as long as needed to handle your request, then up to 2 years.
Cookie consent records: 2 years.

8. Your rights

You have the right to:

get a copy of the personal data we hold about you
have incorrect data corrected
have your data deleted (except what we must keep, see above)
restrict or object to how we use your data, including processing based on our legitimate interest
receive your data in a machine-readable format
withdraw your consent at any time, which doesn't affect processing that happened before

To use any of these rights, or to delete your account, email support@rewardy.io from the email address on your account. It's free, and we reply within one month. We may ask you to confirm your identity first so nobody else can get your data. If you're unhappy with how we handle your data, please contact us first so we can put it right. You also have the right to complain to a data protection authority, such as IMY in Sweden.

9. Age limit

You must be at least 18 years old to use Rewardy. We don't knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we close it.

10. Security

We protect your data with encrypted connections, hashed passwords, limited staff access and automated fraud and security checks. No system is completely secure, so use a strong password that you don't use anywhere else. If a breach affects your data, we will tell you and the authorities as the law requires.

11. Changes to this policy

We update this policy when we change how we handle data. The date at the top shows the latest version. If we make important changes, we will tell you by email or with a notice on the website and in the app.

12. Contact

Rewardy Media AB, Gothenburg, Sweden
support@rewardy.io

Also read: Terms of Service · Cookie Policy