Privacy Policy

Who we are

XPReward is a rewards platform operated by [COMPANY NAME — to be completed]. You can reach us at [CONTACT EMAIL — to be completed].

This policy explains what we collect when you use xpreward.com, why we collect it, and what control you have over it.

What we collect

• Account details you give us: email address, username, and password (stored hashed — we never see it).
• Your points ledger: every credit and debit, with the reason and timestamp. This is append-only by design, so your balance can always be audited.
• Activity needed to award points: missions completed, offers started and credited, referrals, raffle entries, and Gaming Hub posts, comments and likes.
• Technical data used for fraud prevention: IP address, browser and device characteristics, and sign-in times. A rewards platform without this cannot tell a real player from a farm of bots.
• A visitor identifier stored in a cookie, used to count visits and understand how people arrive. It is not shared with anyone.

Third parties that receive data

We keep this list short and specific rather than saying “trusted partners”.

• Offerwall providers (CPX Research, AdGate Media). When you open an offer wall we pass an anonymous account identifier so the provider can tell us which account to credit. They operate their own privacy policies and collect their own survey responses directly from you.
• Meta (Facebook) Pixel and Google Ads tag, when enabled, to measure whether advertising works. These set their own cookies.
• Supabase, our database and authentication host.
• Vercel, our hosting provider, which processes request logs.

Why we are allowed to hold it

We process your account and activity data because it is necessary to provide the service you signed up for — you cannot have a points balance without a record of the points. Fraud prevention and advertising measurement rest on our legitimate interest in keeping the reward pool fair and understanding where users come from. Where your local law requires consent for advertising cookies, we rely on that consent and you can withdraw it.

How long we keep it

Account and ledger data is kept while your account exists. Because the points ledger and audit log are append-only, individual entries cannot be edited or selectively removed — that is what makes a balance trustworthy. When an account is erased, the personal details attached to those entries are removed and the entries themselves are anonymised.

Your rights

You can request a copy of your data, ask us to correct it, or ask for your account to be erased, by writing to [CONTACT EMAIL — to be completed]. Depending on where you live you may also have the right to object to processing or to complain to a data protection regulator.

Children

XPReward is not intended for anyone under 16, and we do not knowingly create accounts for them. If you believe a child has registered, contact us and we will remove the account.

Changes

If this policy changes materially we will update the date at the top of this page and, where the change affects how we use data you have already given us, tell you in the product.