Privacy Policy

Information you give us

• Account details: your email address and password. We store only a salted one-way hash of your password, never the password itself. We give you a random username when you sign up, and you can change it.
• Referral code: the code or link of the friend who invited you, if any.
• Cash-out details: the reward you choose and, for top-ups and PayPal payouts, the recipient details the reward needs, such as a phone number, a game or player ID, or a PayPal email address.
• Support messages: what you write to us, and our replies.
• Old account email: if you connect an account from our old website, the email you used there. We use it to send a link to that address and don’t keep it.
• Tax details: only if the law requires us to ask, such as your legal name, address and taxpayer identification number.
• Requests about your data: what you tell us when you use your rights.

Information collected automatically

• Network information: your IP address and, from it, the country you’re connecting from and your network (the internet provider or organisation the address belongs to). Cloudflare, our hosting provider, works these out; we don’t use a separate IP-lookup service.
• Browser details: your browser’s “user agent”, which names the browser, its version and your operating system.
• Device check: a random identifier stored in your browser, and a one-way summary (a hash) of basic browser settings: user agent, languages, time zone, screen size and colour depth, pixel ratio, number of processor cores, device memory and touch support. Your browser makes the summary, so we only receive the hash, and we store the identifier only in a keyed, hashed form. We don’t use canvas, audio or other invasive fingerprinting. This is sent when you sign up, sign in and cash out.
• Security signals: where available, a bot score and a technical fingerprint of your secure connection from Cloudflare, which help tell people apart from automated traffic, and the result of the sign-up check (Cloudflare Turnstile).
• Sessions: a cookie that keeps you signed in, and a record of when you signed in, with your IP address and browser details.
• Activity: when you open an offer wall, the rewards credited to you and reversed, your balance and history, daily bonus claims, referrals, cash-outs, and when you view a gift card code.

Information from partners and suppliers

• Offer partners tell us when you complete a task, or when it is reversed: the transaction ID, the offer’s name, your reward, what the partner paid us, the status, and usually the IP address you used when you completed it.
• WizzGift, our reward supplier, tells us the status of your order and sends us the gift card code, PIN or link that we deliver to you. We store codes encrypted.

Information from our old website

If you had an account on our previous website (gaintplay.com) with a balance and activity in the year before we moved, we copied a small record of it so you can claim your balance here: a one-way hash of your email address (not the address itself), your old username, your balances and lifetime totals, your country, whether your identity had been verified there, whether the account was blocked, and counts of reversals and risk flags. If you connect your old account, we use the record to credit and review your old balance.

Information we create

Risk scores and flags, records of automated and staff decisions with their reasons, and records of AI reviews (section 4).

What we don’t collect

We don’t ask for your real name, date of birth, home address, photos, contacts or precise location, and we don’t ask for a phone number unless a reward you choose needs one. We don’t collect payment card or bank details, and we don’t currently ask for identity documents. We don’t use analytics, advertising or social media trackers.

Cash-out reviews

Every cash-out is checked before it’s sent. First, our risk rules look at signals such as: how old your account is and whether your email is confirmed; how much you’ve earned, from which partners and how quickly; how many rewards were reversed; whether rewards arrived without a recorded offer wall visit; how many countries and networks you’ve connected from; whether other accounts use the same device, network or payout details; and your past cash-outs. The rules produce a risk score.

Then an AI model, Anthropic’s Claude, reviews the same signals and the score, with a timeline of recent account events (their types, dates, countries and amounts), and recommends approving, holding or declining, with its reasons. We don’t send it your email address, your username, your IP addresses or your payout details.

• Approve: an AI approval stands only for smaller cash-outs, within limits we set, when the risk rules don’t flag anything and there’s no open concern on the account. Otherwise the cash-out waits for a person.
• Hold: our staff review the cash-out and decide.
• Decline: in clear cases, such as strong signs of multiple accounts, a cash-out can be declined without a person reviewing it first. Your coins go back to your balance, and we email you.

The result decides whether and when you receive the reward you asked for. It doesn’t otherwise change your balance.

Your right to a human review

You can ask for a person to review any decision about your cash-out, give your point of view, and contest it: reply to our email or write to support@gaintplay.com. A member of staff will look at the full picture, can overturn the decision, and will tell you the outcome. You can also ask us to explain the main reasons for a decision.

Fraud investigations

When our systems or staff flag an account, the AI may review the flag and recommend what staff should do. It doesn’t take any action itself: a person decides. For this review it receives your username, account and activity details (status, country, balance, recent rewards and cash-outs), the countries and network operators you’ve connected from (not your IP addresses), how many other accounts share your devices or networks, and, if you connected an old account, its record.

Support replies

When you contact support, our AI assistant may reply first. It receives your messages and the account details it needs to answer: your username, account status and country, balance, pending rewards, and recent rewards and cash-outs. It can’t change your account or move coins, and it passes the conversation to a person for anything involving coins, cash-outs, restrictions or disputes, or after a few replies.

Other automatic steps

Some rules run automatically without AI: larger rewards are held for a set time before they become available; a reward reversed after its coins were spent flags the account and pauses its cash-outs; and accounts with signs of automated sign-up get a closer look.

Service providers

These companies process information for us, only on our instructions and under contracts that require them to protect it:

Offer partners

When you open a partner’s offer wall or survey, we send the partner your GaintPlay user ID and a visit ID so it can credit you. Some partners also receive your username, your country, or a coded version of your email address that only we can match (a keyed hash). We never send partners your email address itself. Partners send us reports of completed tasks (section 2), and we may share information with a partner to investigate fraud or a disputed task.

Inside their offer walls and surveys, partners and the advertisers they work with collect information directly from you, such as survey answers, device information and cookies. For that information they are independent controllers, responsible under their own privacy policies, which you’ll find in each offer wall. We don’t receive your survey answers.

Reward suppliers

WizzGift supplies gift cards and top-ups and sends PayPal payouts. For each cash-out we send WizzGift the reward and amount, our order reference, and any recipient details the reward needs (a phone number, a game or player ID, or a PayPal email). WizzGift passes them to whoever delivers the reward, such as your mobile operator, the game publisher or PayPal, which use them under their own privacy policies. We don’t send WizzGift your account email for gift cards: codes come back to us, and we show them to you.

Pictures from other services

Profile pictures are drawn from your username by DiceBear, an avatar service. When a picture is shown, the viewer’s browser asks DiceBear for it, so DiceBear receives the username and the viewer’s IP address. Gift card pictures load from our supplier’s servers, which see your IP address in the same way.

For legal reasons and safety

We may disclose information if we believe in good faith that the law requires it (for example a court order or a request from a tax authority), or to protect the rights, property or safety of our members, partners, us or the public, including to prevent fraud. Where we can and the law allows, we’ll tell you first.

If our business changes

If GaintPlay or Sapniverse LLC is sold, merged or reorganised, information may pass to the new owner, which must keep to this policy or tell you about any changes.

With your permission

We’ll share information in other ways only if you ask us to or agree.

Partner cookies in offer walls

Offer walls and surveys open inside GaintPlay in a frame, or in a new tab. The partner’s pages, and advertisers’ pages you visit from them, may set their own cookies and similar technologies, for example to record that you completed a task or to prevent fraud. The partner controls them under its own policy. You can manage them in your browser settings, but blocking them may stop tasks from being credited. Some offers ask to use your camera or microphone; your browser asks you first.

When you delete your account

• Straight away we erase your email address, password, username (replaced with a placeholder such as “deleted-1a2b3c4d”), settings, app tokens, the old username and email hash of any old account you connected, and all your sessions, so you’re signed out everywhere. The subject and text of your support messages are replaced with “[deleted]”. IP addresses and browser details are removed from your session, device, sign-in and activity records.
• We keep, linked only to an internal account number, your ledger, rewards and cash-out records (including encrypted recipient and delivery details and any AI review of a cash-out) for up to 7 years after each transaction, for accounting, tax, chargebacks, disputes and fraud prevention. IP addresses that partners reported with a completed task, or that were recorded with a cash-out, stay with those records.
• For up to 3 years we keep fraud markers: a keyed one-way hash of your email address and of your device identifier, so a deleted account can’t be re-created to claim new-member rewards again.
• We send a confirmation to your email address before we erase it. A deleted account can’t be restored, and an old-website balance you already claimed can’t be claimed again.

Partners and WizzGift keep what they received under their own policies; contact them directly to ask them to delete it.

How to use your rights

• Download your data: on your Account page, choose “Download my data”. You get a JSON file with your profile and settings, balance and ledger history, pending rewards, rewards (offer, partner, coins, status and dates), bonuses, cash-outs (reward, amount, status, dates and the recipient details you entered, but not gift card codes, which stay in the app), referral earnings, support conversations, sessions, devices, the IP addresses we’ve seen (with country, network, browser, first and last seen), and any old account you connected. You can do this a few times a day.
• Delete your account: on your Account page, in the app or on the website. You’ll confirm with your password, and you can’t delete while a cash-out is in progress. Section 10 explains what happens.
• Change your username or public name setting: on your Account page.
• Anything else, or if you can’t sign in: email support@gaintplay.com from the address on your account and tell us what you’d like.

Checking it’s you. To protect your account, we act on requests made while you’re signed in, or sent from or confirmed through the email address on your account. If we can’t verify you that way, we may ask for a little more information, which we’ll use only to verify you.

Someone acting for you. An authorised agent, or a parent or guardian, can make a request for you. We’ll need proof of their authority, such as your signed permission or a power of attorney, and we may ask you to confirm your identity directly with us.

How long we take. We reply within one month under the GDPR and UK GDPR, within 45 days under US state laws, within 30 days in Canada, Australia and Singapore, and within 15 days for a full access report in Brazil, or sooner if your local law requires. If we need more time and the law allows it, we’ll tell you why within the first period. Requests are free unless they are clearly unfounded or excessive.

EEA, UK and Switzerland

Sapniverse LLC is the controller (447 Broadway, 2nd Floor Suite 2206, New York, NY 10013, USA). Section 3 sets out our legal bases. Some cash-out decisions are made by automated means (section 4); we rely on Article 22(2)(a) of the GDPR and UK GDPR, because the decision is necessary for our contract with you, and you have the right to obtain human intervention, to express your point of view and to contest the decision. You have the rights in Articles 15 to 22: access, rectification, erasure, restriction, portability and objection.

You can complain to the data protection authority where you live or work, or where you think a problem happened. In the UK that is the Information Commissioner’s Office (ico.org.uk), and in Switzerland the Federal Data Protection and Information Commissioner. We’d appreciate the chance to help first.

California

We give everyone in California the rights in the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA).

Notice at collection. We collect the categories of personal information in the table below, from the sources in section 2, for the purposes in section 3, and keep each for the periods in section 10. We don’t sell or share personal information, and we use sensitive personal information only for purposes the CCPA allows.

Your rights. You can ask to know what personal information we’ve collected (including specific pieces), to delete it and to correct it. You have the right to opt out of sale and sharing (we don’t do either, and we honour Global Privacy Control), and to limit the use of sensitive personal information (we already use it only to provide and secure GaintPlay, so this right doesn’t change anything). You can access information about our automated decision-making for cash-outs and appeal a decision to a person who can overturn it (section 4). Use the steps in section 13; authorised agents are welcome.

No discrimination. We won’t deny you service, charge you a different price or give you a lower quality of service because you used your rights. Some rights, such as deletion, mean we can no longer provide your account.

Under 18. If you’re under 18 and live in California, you can remove content you posted publicly on GaintPlay (your username on the live feed and leaderboard) with the public name setting, or ask us to remove it. This may not remove copies others have made.

Direct marketing. We don’t share personal information with third parties for their own direct marketing.

Notice of financial incentive. GaintPlay is a rewards program: you earn coins for tasks you complete, plus the daily bonus, referral commissions and other promotions. Because we need some personal information to run it (the information in section 2), California law treats these rewards as a financial incentive.

• Material terms: coins are earned and cashed out under our Terms. Referral commissions are a share (currently 5%) of the coins your invited friends earn from offers, paid by us, not by your friends.
• Opting in: by creating an account and, for referrals, by sharing your link. Taking part is voluntary.
• Withdrawing: you can stop at any time by deleting your account. Coins left in the account are given up, so cash out first.
• Value of your information: we don’t set a separate value on your personal information. We work out its value to us from the revenue partners pay us when you complete their tasks, less what it costs to run GaintPlay. The coins we pay you are a share of that revenue, and they are our good-faith estimate of the value of your information to us. Referral commissions come from our share of what partners pay for your friends’ tasks.

Other US states

If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island or Nebraska, your state’s privacy law gives you the right to confirm whether we process your personal data and to access it, to correct it, to delete it, to get a portable copy, and to opt out of targeted advertising, the sale of personal data, and profiling that leads to decisions with legal or similarly significant effects. We don’t sell personal data or use it for targeted advertising. We use profiling to review cash-outs (section 4), and you can ask for a person to review any of those decisions. In Minnesota, you can also question the result of profiling, learn the reasons for it, and have it looked at again with corrected data. In Oregon, Delaware, Maryland and Minnesota, you can ask for a list of the specific third parties we’ve disclosed your data to; section 5 names them.

Appeals. If we turn down your request, you can appeal by replying to our answer, or by emailing support@gaintplay.com with “Privacy appeal” in the subject, within 45 days of our decision. We’ll answer within 60 days (45 days in Colorado) and explain what we decided and why. If you’re not satisfied, you can contact your state’s attorney general.

Nevada residents: we don’t sell covered information. We don’t collect consumer health data. If a partner’s survey asks health questions, the partner collects the answers under its own policy.

Canada

We handle personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, the Act respecting the protection of personal information in the private sector. You can access and correct your information, and withdraw your consent, subject to legal and contractual limits, by deleting your account. Your information is stored and processed outside Canada, mainly in the United States, where authorities may be able to access it under local law.

In Quebec, you have the right to be told when a decision about you is based only on automated processing, to know the information and the main factors used, to have that information corrected, and to submit your observations to a member of staff who can review the decision (section 4). You also have the right to data portability. Our person in charge of the protection of personal information can be reached at support@gaintplay.com. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

Brazil

Under the Lei Geral de Proteção de Dados (LGPD), our legal bases are performance of a contract, compliance with a legal obligation, the regular exercise of rights in legal proceedings, and legitimate interests, applied to the purposes in section 3. You have the rights in Article 18: confirmation and access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, information about who we share with, information about not giving consent and its consequences, and revoking consent. Under Article 20 you can ask for a review of decisions made only by automated processing, and for information about the criteria used (section 4). International transfers rely on the mechanisms in Article 33, including standard contractual clauses approved by the ANPD. Contact us at support@gaintplay.com; you can also complain to the Autoridade Nacional de Proteção de Dados (ANPD).

India

Under the Digital Personal Data Protection Act, 2023 and its Rules, you have the right to a summary of the personal data we process and how we process it, to have it corrected, completed, updated or erased, to nominate someone to use your rights if you die or become unable to, and to have your grievances addressed. Send grievances to support@gaintplay.com; we’ll respond within the time the Rules set. If you’re not satisfied, you can complain to the Data Protection Board of India. Because the Act treats everyone under 18 as a child, GaintPlay is only for people 18 or older in India.

Australia

We handle personal information in line with the Privacy Act 1988 and the Australian Privacy Principles. You can ask to access and correct your information. We disclose personal information to recipients overseas, mainly in the United States (sections 5 and 9). Section 4 describes the kinds of personal information used in automated decisions that could significantly affect you, and those decisions. If you have a complaint, contact us first; if we haven’t resolved it within 30 days, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Nepal

We collect and use personal information in line with the Individual Privacy Act, 2075 (2018) and its Regulations: with your knowledge, only for the purposes in this policy, and kept secure. You can ask to see, correct or delete your information, and ask us to stop using it where the law allows. Contact us at support@gaintplay.com.

Singapore, Japan, South Korea and South Africa

• Singapore: under the Personal Data Protection Act you can ask for access to and correction of your personal data and withdraw consent. Our contact for data protection matters is support@gaintplay.com, and you can also contact the Personal Data Protection Commission.
• Japan: we provide personal data to service providers in the United States (sections 5 and 9), whose privacy rules differ from Japan’s, and we require them by contract to protect it. You can ask us to disclose, correct, stop using or delete your retained personal data.
• South Korea: your personal information is transferred overseas as sections 5, 9 and 10 describe (the recipients, countries, purposes, items and retention periods), to provide GaintPlay. You can refuse by not using GaintPlay or by deleting your account, but we can’t provide the service without it. You can ask for access, correction, deletion and suspension of processing.
• South Africa: under the Protection of Personal Information Act you can access, correct and delete your information and object to its use, and complain to the Information Regulator (inforegulator.org.za).