Privacy policy
Last updated: 8 October 2026
This policy covers the GameCash web app, the Android app, the iPhone app (iOS) and getgamecash.com. It explains what personal data we process, why, and what rights you have under the EU General Data Protection Regulation (GDPR).
1. Controller
The controller is the operator of GameCash, a sole proprietorship in Germany. Full name and address: see our Impressum. Email: support@getgamecash.com.
2. Data we process
| Data | Examples |
|---|---|
| Account data | Email address, password (stored only as a hash), user ID, referral code, country, language. |
| Device data | Device model, operating system, app version, device identifiers, advertising ID (Android advertising ID or Apple IDFA, only if you allow it), device integrity check results. In the web app, a random device ID and your login token are stored in your browser's local storage. In the iPhone app, a random device ID and your login token are stored in the iOS Keychain. |
| Network data | IP address and the country and connection type derived from it, such as VPN or proxy. |
| Activity data | Tasks completed, points earned and reversed, daily spin and streak, invites, sign-in times. |
| Payout data | PayPal email address or gift card choice, withdrawal amounts and dates, payout status. |
| Support data | Messages and screenshots you send us. |
We do not see your survey answers. Surveys are run by our survey partners, who receive your answers directly.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Running your account, crediting points, paying withdrawals, sending account emails (verification, password reset, login codes), support | Contract, Art. 6(1)(b) GDPR |
| Preventing fraud, bots and multiple accounts; securing our systems (including reCAPTCHA at sign-up) | Legitimate interests, Art. 6(1)(f) GDPR: protecting honest users, our partners and our business |
| Personalised ads in the Android and iPhone apps | Your consent, Art. 6(1)(a) GDPR (and, on iPhone, your permission in Apple's "Allow Tracking" prompt). Without consent you see non-personalised ads. |
| Keeping payment and accounting records | Legal obligation, Art. 6(1)(c) GDPR (German tax and commercial law) |
4. Fraud checks
We check device, network and activity data automatically to detect multiple accounts, VPNs, emulators and unusual task patterns. These checks can block earning on a suspicious device. Every withdrawal and every account closure is reviewed by a person, so no decision with legal or similarly significant effect is made solely by automated means.
5. Who receives data
We share only the data each recipient needs.
Hosting
Our website, web app and backend run on servers of Hetzner Online GmbH, Gunzenhausen, Germany, under a data processing agreement. Your data is stored in Germany.
Offer, survey and cashback partners
When you open an offer wall, we pass your GameCash user ID and basic device and country data to the partner so it can show suitable tasks and tell us when you finish. Our partners are AdGem, adjoe, Ayet Studios, Torox, CPX Research and BitLabs, plus the partners shown in the "More" section of the web app. They process your data under their own privacy policies, which you can read before starting a task.
Advertising (Android app)
We use Appodeal to show rewarded videos and other ads. Appodeal and the ad networks it connects to (currently Google AdMob, Unity Ads and Pangle) receive device data, advertising ID (if allowed), IP address and ad interaction data to deliver and measure ads and, with your consent, to personalise them.
Advertising (iPhone app)
The iPhone app shows optional rewarded videos through Google AdMob (Google Ireland Ltd.). AdMob receives device data, IP address, ad interaction and diagnostic data, and the Apple advertising identifier (IDFA) only if you allow tracking in Apple's prompt. In the EU/EEA and UK, Google's consent form asks for your ad consent first. After a video, AdMob sends our server a signed confirmation with your GameCash user ID so we can credit the points. You can change tracking in iPhone Settings → Privacy & Security → Tracking.
Push notifications (Android app)
To tell you when points arrive, the Android app uses Firebase Cloud Messaging (Google Ireland Ltd.). It receives a device token and the notification content. You can turn notifications off in your phone settings.
Bot protection
At sign-up we use Google reCAPTCHA (Google Ireland Ltd.). reCAPTCHA receives your IP address and browser data to tell humans from bots.
Payments and gift cards
PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, receives your PayPal email and the payout amount. Gift cards (such as Amazon, OTTO and Target) are bought directly from the issuers; we do not pass your personal data to them. The code is sent to your account email.
Account emails
We send account emails (verification, password reset, login codes, payout notices) through Resend (Resend, Inc., USA). Resend receives your email address and the content of these emails. Besides account e-mails (verification, sign-in codes, payouts) we may send you at most one reminder a week when points are waiting in your account; every reminder has a one-click unsubscribe link, and you can switch reminders off in the web app (History). If you report missing points, we store your request (offerwall, offer name, date, your note) to check it with the partner and answer you.
Authorities
We disclose data to authorities only when the law requires it.
6. Transfers outside the EU
Some partners are located outside the European Economic Area, for example in the United States. Transfers take place on the basis of an adequacy decision (such as the EU-US Data Privacy Framework where the recipient is certified) or the European Commission's standard contractual clauses.
7. How long we keep data
- Account, device and activity data: while your account exists.
- Fraud and dispute records (postback logs, reversal data): up to 3 years after the event.
- Paid-out withdrawal records: 10 years, as required by German tax law (§ 147 AO).
- Support messages: up to 2 years after the case is closed.
8. Your rights
You have the right to access your data, correct it, delete it, restrict its processing, receive it in a portable format, and withdraw consent at any time with effect for the future.
Right to object: where we process data based on legitimate interests, you can object for reasons arising from your situation. We then stop unless we have compelling legitimate grounds.
To use your rights, email support@getgamecash.com from your account email. You can delete your account yourself in the iPhone app (Account → Delete account) or as described on our delete account page. You can change ad consent in the Android app settings, and tracking on iPhone in Settings → Privacy & Security → Tracking.
You can complain to a data protection supervisory authority, in particular in the EU country where you live, work or where you think your rights were infringed.
9. Age
GameCash is only for people aged 16 and over. If we learn that a user is younger, we close the account and delete the data.
10. Security
Data is transmitted encrypted (HTTPS). Passwords are stored only as hashes. Access to our servers and database is restricted.
11. Changes
We update this policy when our processing or partners change. The date at the top shows the latest version.