Privacy Policy

Account information: When you register, we collect your email address and a hashed version of your password. We never store your plain-text password.

Activity data: We record points transactions, offer completions, login streaks, game activity (slots, spins), and withdrawal requests to operate your account and display your history.

Referral data: If you sign up through a referral link, we store the referral code of the user who invited you.

Usage data: We may automatically collect standard server log data such as IP address, browser type, pages visited, and timestamps to maintain security and improve the platform.

Third-party offer wall data: When you interact with embedded offer wall iframes, the third-party provider may independently collect data subject to their own privacy policies. We receive only a completion notification and the points amount to credit.

We use the information we collect to:

• Create and manage your account
• Credit and debit points accurately
• Send transactional emails (email verification, password reset) when enabled
• Detect and prevent fraud, abuse, or suspicious activity
• Enforce our Terms of Use
• Improve and develop platform features
• Comply with legal obligations

We do not sell your personal information to third parties.

We use session cookies to keep you logged in (via NextAuth.js). We also use sessionStorage for UI state such as dismissing the Starter Pack popup. We do not use advertising or tracking cookies.

We may share your information with:

• Infrastructure providers: Database and hosting services that process data on our behalf under confidentiality agreements.
• Email provider (Resend): Used only to deliver verification and password reset emails when configured.
• Offer wall partners: Your user ID is passed as a parameter to embedded offer walls so completions can be attributed to your account. No other personal data is shared.
• Law enforcement: When required by law, court order, or to protect the rights and safety of our users or the public.

We retain your account data for as long as your account is active. If you request account deletion, we will delete or anonymise your personal data within 30 days, except where retention is required by law or to resolve disputes.

We use industry-standard measures to protect your data, including bcrypt password hashing, HMAC-SHA256 webhook signature verification, and HTTPS in production. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

EarnColour is not directed to individuals under the age of 13 (or 16 where applicable under local law). We do not knowingly collect personal information from children. If you believe a child has provided us with their information, please contact us and we will promptly delete it.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict certain processing
• Data portability

To exercise any of these rights, contact us at privacy@earncolour.com.

Our platform may contain links to third-party offer walls and external sites. We are not responsible for the privacy practices of those sites and encourage you to review their policies before providing any information.

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date at the top of this page. Continued use of the platform after changes constitutes acceptance of the updated policy.

If you have questions or concerns about this Privacy Policy, please contact us at privacy@earncolour.com.