Privacy Policy

Effective 2026-04-18 · RewardPass POC

What we collect

• Account: email, password hash, confirmation state, account creation date.
• Preferences: vertical interests, email and push opt-in state.
• Activity: earn events (scratch, poll, reads, offers, referrals), redemption history, click-throughs to offer partners.
• Device: IP, user-agent, a weak device fingerprint (hash of UA + IP + language) for fraud detection.
• Beacons: pageviews and earn events are logged to PubOS, our own analytics layer (not a third-party tracker).

Why we collect it

• Run your account, credit your points, pay out your gift cards.
• Send you email you signed up for (transactional and marketing).
• Send you push notifications if you opted in.
• Detect and block fraud — bots, multi-accounting, offer-completion spam.
• Improve the product.

Who we share it with

• Resend — delivers email we send you.
• Tremendous — mints and delivers your gift cards.
• Offerwall partners (Tapjoy, etc.) — when you click an offer, we pass a per-click identifier so they can credit you. They do not receive your email or password.
• Cloudflare — hosts the service and stores logs.

We do not sell your data. We do not run third-party tracking pixels or ad cookies.

Cookies we set

• rp_sess — HttpOnly session cookie, 7 days. No tracking outside RewardPass.

Retention and deletion

Your data lives in our database as long as your account is active. To delete, email dave@zakur.org. We will delete your profile, balance, earn log, and any push subscriptions within 30 days. Redemption records may be retained as required for tax/accounting.

Children

RewardPass is 18+. We do not knowingly collect data from anyone under 18.

Questions or a deletion request? dave@zakur.org. See also Terms.