← Back to Coinlyft

Privacy Policy

Last updated: [fill in date]. This is a starting draft — have it reviewed by a lawyer familiar with your jurisdiction's data protection rules before relying on it, especially since redemptions involve real payouts (UPI/gift cards) tied to personal identifiers.

1. What we collect

Account info: the email/login details you provide when you register.
Device ID: a random identifier generated in your browser (stored via localStorage) used to detect duplicate accounts and prevent abuse. This is not tied to your real-world identity by itself.
Points and offer activity: which offers you've completed, points earned/spent, and referral activity, so your balance and history can be shown to you accurately.
Redemption details: when you redeem points for UPI cash or a gift card, we collect the destination details you provide (UPI ID or email) solely to fulfill that specific payout.

2. What we don't collect

We don't collect payment card numbers or bank account details directly — UPI and gift card redemptions only require the destination identifier you enter at redemption time.

3. How we use this data

To operate your account, track your points balance, and process redemptions.
To detect duplicate accounts and fraud (see Terms of Service, Section 5).
To communicate with you about your account or a specific redemption, if needed.

4. Third parties

Offer completion is verified by the third-party advertisers whose offers you complete — they receive the information needed to confirm you completed their specific offer (this is generally handled through the offer network, not shared by us directly beyond what's needed). We use Firebase (Google) for authentication and data storage.

Fill in the actual offer network/ad partner you use here by name, since "third-party advertisers" alone is vague for a real privacy policy — reviewers and users will want to know specifically who that is.

5. Data retention

We retain account and redemption records for as long as your account is active, and as needed to resolve disputes or fraud investigations. [Fill in a specific retention period after account deletion, if you have one.]

6. Your choices

You can request account deletion by contacting us. Note that redemption records tied to completed payouts may need to be retained for a period for fraud/accounting purposes even after account deletion — [confirm this against your actual practice and local law].

7. Contact

Questions about this policy or a request to access/delete your data can be sent to [fill in a real support email].