Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Timothy Kardel, operating under "Claimo"
Rilkestr. 8
41541 Dormagen Zons
Germany
Email: support@claimo-app.com

We have not appointed a data protection officer because there is no legal obligation to do so. You can reach us with any privacy question at support@claimo-app.com.

2. Scope

This privacy policy applies to the mobile app Claimo (the "App") and the related server services: user account, balance and rewards, partner offers, reward videos, payouts, notifications and support. Our website claimo-app.com has its own privacy policy.

If you use games, tasks, surveys or ads from partners through the App, or redeem a payout with a third party, their privacy notices also apply. We describe below which data we share with whom.

3. Summary

• For your account we store your email address, sign-in method, display name and your age group (16–17 or 18+).
• For your balance and payouts we store your credits, transactions and payout requests.
• To protect against fraud we use a device identifier and your IP address; on our server we store both only as a hash value.
• Only with your consent: usage analytics, personalized offers, video ads and push notifications. You can find every switch at any time under Profile → Settings.
• Partners such as ayeT-Studios, CPX Research and TheoremReach receive a random partner ID instead of your email address or name. To select offers, your IP address and device details are sent to ayeT-Studios (section 9).
• We do not collect GPS location, contacts, camera or microphone content, or payment data. Your profile picture stays on your device. We do not use external analytics or crash reporting services.

4. Legal bases

We process personal data on the following legal bases:

• Art. 6(1)(b) GDPR (contract): for your account, balance, credits, payouts, support and everything that is part of Claimo's service under the Terms of Use.
• Art. 6(1)(c) GDPR (legal obligation): for statutory retention and documentation duties, for example accounting records or proof of consent.
• Art. 6(1)(f) GDPR (legitimate interests): for IT security, fraud and abuse prevention, protecting honest users, evaluating our business operations, product tests, and establishing or defending legal claims.
• Art. 6(1)(a) GDPR (consent): for usage analytics, personalized offers, video ads and promotional push notifications.

When we store information on your device or read it from your device, Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) also applies. Without your consent we only do this where it is strictly necessary to provide the App, for example for sign-in, the language setting and the security identifier (Section 25(2) no. 2 TDDDG). Everything else, in particular video ads and usage analytics, requires your consent (Section 25(1) TDDDG).

You can withdraw your consent at any time with effect for the future, most easily with the relevant switch in your profile. Withdrawal does not affect the lawfulness of processing before the withdrawal.

5. Minimum age and age information

Claimo may be used from the age of 16. Right after registration we ask for your age. We do not store a date of birth, only your age group (16–17 or 18+), the time of confirmation and the version of the question. You cannot change the age group yourself afterwards.

• Under 16: If you state that you are under 16, we delete your account and all associated data immediately. If the account had already been flagged, a pseudonymized security record may be kept for no more than 180 days (see section 17).
• 16 and 17: Video ads, PayPal payouts and Airbnb gift cards are not available. We only show partner offers that we have approved for this age group.

Your age is self-declared. If we learn that it is incorrect, we may restrict or delete the account. The legal basis is Art. 6(1)(b) and (f) GDPR; our legitimate interest is protecting minors and complying with our partners' age requirements.

6. Registration, sign-in and user account

You need an account to use the App. You can register with an email address and password, or with Google or Facebook. We process:

• email address, user ID and sign-in method,
• your password, which the authentication service stores only as a hash value,
• display name (initially the part of your email address before the @), avatar letter and your referral code,
• time of registration and of your last sign-in,
• the accepted version of the Terms of Use and the time of acceptance,
• a referral code you entered, if any,
• technical session data (access and refresh tokens).

When you register with an email address, we check whether it is already used with another sign-in method so that we can show you the right way in. Confirmation and password reset emails are sent by our authentication service.

Sign-in with Google or Facebook: Sign-in takes place in a browser window directly with the provider. We receive a provider ID and your email address and, depending on your settings, your name and profile picture URL. Google or Meta learns that you are signing in to Claimo. The providers are Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland); their privacy notices apply.

The legal basis is Art. 6(1)(b) GDPR.

7. Onboarding answers and settings

After the age question we ask you a few questions. All of them are optional except the payout currency:

• Gender (female, male or "Prefer not to answer"),
• Favorite game genres (e.g. puzzle, strategy),
• Payout currency (USD, EUR, GBP or CHF); it is fixed permanently afterwards.

In the last step you decide on the following settings:

• Email updates (on by default): status emails about your payouts and support. We do not send marketing emails.
• Personalized offers (off by default): see below.
• Allow usage analytics (off by default): see section 14.
• Allow video ads (off by default, 18+ only): see section 10.

You can choose "Save choices" or "Accept all". We store your choice together with the time and the version of the notice as proof (Art. 7(1), Art. 6(1)(c) GDPR). You can change every setting at any time in your profile.

Personalized offers: When this switch is on, we sort games by your favorite genres and send the gender you provided to ayeT-Studios so that suitable offers can be selected there. The genres never leave our server. When the switch is off, we use neither. You can remove your personalization data at any time in your profile with "Delete personalization data". The legal basis is your consent (Art. 6(1)(a) GDPR).

App language: Before sign-in, the App reads your system language on your device only, to suggest a suitable language. After registration we store the selected language in your account so that notifications reach you in your language.

8. Balance, rewards and progress

For Claimo to work, we store the following with your account:

• your balance in the selected currency and every transaction with amount, type, description, technical details and time,
• daily bonus, streak, level and experience points,
• welcome bonus, first-offer bonus and limited-time promotions,
• for the referral program, who referred whom and whether the bonus conditions are met,
• partner credits, reversals and amounts not yet released,
• in-app messages (the "bell") about credits, payouts and status changes.

To convert between currencies we use daily reference rates of the European Central Bank. No personal data is transmitted for this.

The legal basis is Art. 6(1)(b) GDPR.

9. Games, tasks and surveys from partners

You earn rewards mainly through offers from our partners. Each partner receives its own randomly generated partner ID from us. We do not share your email address, your name or your Claimo user ID.

When you complete an offer, the partner notifies us directly from server to server. We store the partner ID, transaction and offer number, reward, the partner's payment to us, status (credited, reversed, rejected), time and technical verification values. If a partner reverses a credit later, we reverse it in your balance. Anything you enter directly with a partner, such as survey answers, is processed by the partner under its own responsibility.

ayeT-Studios (games, app tasks, surveys)

When the App loads the list of offers, our server sends to ayeT-Studios: your partner ID, your IP address (so that ayeT can determine your country and availability), device manufacturer and model, operating system and version, platform, app language and – only if personalized offers are on – the gender you provided.

As soon as an offer appears on your screen, the App loads a small image from an ayeT-Studios server (a so-called impression pixel). ayeT receives your IP address, technical device details and your partner ID and can measure which offers were shown.

When you start an offer, the App sends you via a one-time Claimo link to ayeT-Studios and from there to the app store or the advertiser's page. We store the start with its time in order to award start bonuses correctly. The game's publisher and its measurement services may then record, under their own privacy notices, whether you installed and used the app.

The App loads game icons, preview images and screenshots directly from the servers specified by ayeT-Studios, for example image servers of ayeT or YouTube (i.ytimg.com). These servers receive your IP address. The App caches game icons so that it does not have to load them again.

CPX Research (surveys)

When you open the CPX Research surveys, our server creates a secured entry link with your partner ID. The surveys open in a browser window inside the App. CPX Research and its survey partners receive your IP address and browser data there, as well as your answers and possibly cookies, under their own privacy notices.

TheoremReach (surveys)

TheoremReach surveys open in your default browser. TheoremReach receives your partner ID, your IP address and browser data, and your answers. The provider is TheoremReach Inc., USA.

The legal basis for crediting rewards and the transfers this requires is Art. 6(1)(b) GDPR; for the impression pixel and loading images it is Art. 6(1)(f) GDPR (displaying the offers properly and as contractually agreed); for personalization it is your consent (Art. 6(1)(a) GDPR).

10. Video ads (Unity LevelPlay)

If you are 18 or older, you can watch short video ads and receive a small credit for each. For this we use Unity LevelPlay. LevelPlay mediates the videos from ad networks, currently Unity Ads; Google AdMob may deliver only non-personalized ads through LevelPlay.

Only with your consent: The "Allow video ads" switch is off by default. You can turn it on in the last onboarding step, in your profile or via the prompt on the ad card. Without your consent the App does not start the ad SDK, and our server does not issue an ad identifier. We store whether you consented and the time of the last change.

With your consent, Unity and the ad networks process in particular:

• your device's advertising ID (Google Advertising ID) and the App Set ID,
• IP address and the approximate location derived from it,
• device and app information such as model, operating system, language and app version,
• ad events such as loading, display, clicks and complete views,
• a random LevelPlay ID that we create for you and that is not your Claimo user ID.

Unity and the ad networks use this data under their own responsibility, including for personalized advertising and fraud prevention. After you finish watching a video, LevelPlay sends a signed message to our server. We store the LevelPlay ID, transaction number, credit and time, and limit the number of videos per day.

Withdrawal: If you turn off "Allow video ads" in your profile, the App stops loading ads immediately and no longer passes consent to Unity; after a restart the ad SDK is not started at all. You can also reset or delete your advertising ID in your Android settings.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); for the credit it is Art. 6(1)(b) GDPR.

11. Payouts

When you cash out your balance, we review every request manually. For this we process:

• user ID, account email and display name,
• the selected payout (e.g. PayPal or a gift card from Amazon, Apple, Google Play, Nintendo eShop, IKEA, H&M, Netflix, Uber or Airbnb), amount, currency, and region or country of the gift card,
• the recipient email address the payout should go to,
• status, time of request, review and payout, and a reason for rejection, if any,
• review hints from fraud prevention (see section 12), notes and decisions of the reviewer,
• for gift cards, only the last four characters of the code as a reference, never the full code, and the email's delivery ID.

PayPal (18+): We send the amount from our PayPal account to the email address you provided. PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, receives the recipient address and amount for this purpose and processes them under its own responsibility.

Gift cards: We buy gift card codes from the respective brand or authorized resellers without sharing your data. You receive the code by email. When you redeem it, the gift card provider processes your data under its own privacy notices.

Email delivery: We send payout and rejection emails via Resend (Plus Five Five, Inc., USA). Resend receives the recipient address, subject, content including the gift card code, and delivery data.

Please provide a correct recipient address; payouts sent to a wrong address may be lost. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for accounting records.

12. Security and fraud prevention

Claimo pays out real money. To prevent multiple accounts, manipulated devices, fake activity and abuse, we process the following security data:

• Device identifier: On Android the Android ID specific to Claimo, on iOS the identifier for vendors (IDFV); if neither is available, a random installation ID. The App stores it in protected storage on your device and sends it to our server. There we store it only as a hash value created with a secret key.
• IP address: Our server reads it from requests and, for fraud prevention and abuse limits, stores it only as a hash value, never in plain text.
• Device check at registration: The App asks Google Play Integrity (Android) or Apple App Attest (iOS) to confirm that it is running unmodified on a genuine device. Google or Apple process information about the device and the App for this. We store only the result (e.g. "trusted"), a reason code, hash values and the time, no raw data.
• Risk assessment: From these signals, your earning history, reversals, referral patterns and shared payout addresses, we automatically calculate a risk score with reasons. Notes and blocks set by our reviewers are added.
• Bonus protection: So that bonuses such as the welcome or referral bonus are not created more than once on the same device, we record for which device (as a hash value) a bonus has already been granted and log every bonus decision.

Suspicious signals do not lead to an automatic block, but payouts may be flagged for closer review. If abuse is proven, a reviewer may block the account. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting Claimo and honest users against fraud and abuse. The device identifier on your device is strictly necessary for the secure operation of our reward service (Section 25(2) no. 2 TDDDG).

13. Push notifications and in-app messages

You only receive push notifications if you allow them in the App and then in the system dialog. We then store your push token, the platform, your device's time zone and your choices. We use the time zone to keep quiet hours from 10 pm to 9 am local time: we do not send reminders or offers then, and credit notifications arrive silently at night. You can turn off three types separately:

• Credits and payouts,
• Reminders about the daily bonus and your streak,
• Offers: promotional tips about new games and expiring deadlines; no more than three such notifications per week in total.

We log the reason, title, text, delivery status, error messages and whether you opened a notification. This tells us whether notifications are useful: for every type of reminder or offer, a randomly and permanently selected comparison group of about 10% of users does not receive that notification.

Delivery runs through Expo's push service (650 Industries, Inc., USA) and Google's Firebase Cloud Messaging or the Apple Push Notification service.

Separately, we show important events in the App's message list (the "bell"): no more than 100 entries, for no longer than 90 days.

The legal basis for promotional notifications is your consent (Art. 6(1)(a) GDPR); for credits, payouts and reminders it is Art. 6(1)(b) GDPR, and for measuring their effect Art. 6(1)(f) GDPR. You can turn everything off in your profile or in your system settings.

14. Usage analytics and product improvement

We analyze usage exclusively in our own database. We do not use external analytics services such as Google Analytics or Firebase Analytics, session replay or advertising tracking pixels.

With consent ("Allow usage analytics", off by default): The App records events such as app start, sections viewed (home, games, tasks, profile, cash out), registration and onboarding steps, opened offer lists, viewed and tapped offers, displayed bonus timers and opened payout dialogs. For each event we store the time, session ID, platform, app version and, where relevant, offer, partner, displayed reward and test variant, linked to your user ID. These events do not contain your email address, name, IP address or location. For this the App creates a random analytics ID and briefly keeps events on the device until they are sent. Without consent the App does not send any of these events and discards them.

Without consent: From processes that occur anyway when your account is used (registration, starting an offer, credits, reversals, payout requests), our server creates pseudonymous events. We also store whether you came to us through a referral or directly, as well as platform and app version. This helps us understand revenue, costs, drop-offs and fraud patterns.

Product tests (A/B tests): New accounts may be randomly assigned to a test group that sees a variant of a feature. We store the assignment and whether the variant was shown, and compare the groups using the events described above. Assignment is never based on personal characteristics.

We delete raw data after 180 days; after that only aggregated statistics without personal reference remain. We keep test assignments until your account is deleted. The legal basis for the app events is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), otherwise Art. 6(1)(f) GDPR; our legitimate interest is running and improving the service economically. You can object to this at any time (section 23).

15. Storage on your device and permissions

The App stores on your device in particular:

• your sign-in session and access token (necessary),
• the selected app language (necessary),
• the device identifier for fraud prevention in protected storage (necessary, section 12),
• when registering with Google or Facebook, a device check proof for no more than 15 minutes; on iOS a key identifier for App Attest,
• after you allow notifications, your push token,
• with consent to usage analytics, the analytics ID, the session, events not yet sent and your test variants,
• with consent to video ads, data of Unity's ad SDK,
• cached game icons and small flags, for example whether a rating prompt has already been shown,
• the profile picture you chose. It is not uploaded and stays on your device only.

Permissions: The App only asks for notifications and – if you choose a profile picture – access to the selected photo. We do not use location, contacts, camera or microphone. You can remove stored data by clearing the App's data or uninstalling it; your account is not affected.

16. Support, emails, sharing and ratings

• Support: If you email us, we process your address, your message, attachments and the conversation history to handle your request (Art. 6(1)(b) or (f) GDPR). The email passes through your and our email providers.
• Referral code: When you copy your code, the App only places it on your device's clipboard. When you share it, your system's share dialog opens; the app you choose processes the message under its own rules.
• Ratings: We do not store the star rating in the App on our servers. If you rate Claimo on Google Play or the App Store, this happens through the respective store.
• Legal texts: Links to the legal notice, Terms of Use and this policy open our website in your browser. The website's privacy policy applies there.

17. Retention and deletion

We store data only for as long as necessary for the respective purpose:

• Account, profile, settings, balance, transactions, payout requests, proof of consent: until your account is deleted.
• Device signals: at most for as long as your account exists. Entries for a device you have not used to sign in for 90 days are deleted, unless a bonus record is attached to them. Device check logs are deleted after 90 days.
• Usage analytics: raw data for 180 days.
• Offers delivered to you: 180 days; offer progress 30 days; started offers until your account is deleted.
• Push: delivery logs for 180 days; disabled push tokens 30 days after they were disabled.
• In-app messages: no more than 90 days or 100 entries.
• Abuse limits (request counters with a hashed IP address or user ID): no more than 7 days.
• Server logs of our hosting provider (including IP address, time and endpoint): only briefly, for operation and troubleshooting.
• Support emails: until your request is resolved; business correspondence until the statutory periods expire.

Deleting your account

You can delete your account yourself in the App under Profile → Settings → "Delete account permanently". Without the App or signing in, you can request deletion free of charge by email to support@claimo-app.com; you will find instructions on our page Delete your Claimo account. While a payout is still in progress, deletion in the App is possible only after it has been completed; blocked accounts are deleted by support.

Deletion removes your account and the associated data described in sections 6 to 16. If you request deletion by email, we inform you of the outcome within one month at the latest. The following data remains after deletion:

• Security record: Only if an account was blocked, showed an increased risk, requested payouts or had reversals, we keep a pseudonymized record: hash values created with a secret key of the former user ID and of the payout addresses and, in the case of a block, high risk or reversals, also of the devices, plus the account creation date, risk level and reasons, block status, and rounded counts of payouts, reversals, bonuses and referrals. It contains no name, email address or IP address. It is deleted automatically three years after the deletion, or after no more than 180 days if the account was deleted because the user was under 16.
• Device bonus record: The hash value of a device for which a welcome or referral bonus has already been granted remains, without any link to your account, for three years after the deletion, so that the same bonus cannot be obtained again by deleting the account and registering again.
• Partner credit records: We keep the transaction number, partner ID, amount and time without any link to your account, for settlement with the partner and to prevent duplicate credits.
• Records subject to statutory retention: We generally keep records of completed payouts (e.g. PayPal transactions, purchase receipts for gift cards) for eight years, business correspondence subject to retention for six years and books for ten years (Section 147 of the German Fiscal Code, Section 257 of the German Commercial Code), each from the end of the calendar year.

We use this data only for its specific purpose – fraud prevention, establishing or defending claims within the regular limitation period (Section 195 of the German Civil Code) and legal obligations – and restrict it for everything else. The legal bases are Art. 6(1)(c) and (f) GDPR in conjunction with Art. 17(3)(b) and (e) GDPR. We also arrange deletion with our processors. Deleted data may remain in our hosting provider's backups until they are overwritten in the regular cycle; we do not restore anything from them except to repair data loss. Partners that process data under their own responsibility delete it according to their own rules.

18. Recipients and service providers

The following recipients receive personal data, in each case only as far as necessary for the stated purpose:

Processors (acting on our instructions, Art. 28 GDPR)

• Supabase Inc., USA: database, authentication, server functions and hosting. The data is stored in a data center in Frankfurt am Main (EU).
• 650 Industries, Inc. (Expo), USA: delivery of push notifications.
• Plus Five Five, Inc. (Resend), USA: sending payout and status emails.

Independent controllers

• ayeT-Studios GmbH, Hannover, Germany: games, app tasks and surveys (section 9).
• Make Opinion GmbH (CPX Research), Berlin, Germany: surveys (section 9).
• TheoremReach Inc., Sanford (North Carolina), USA: surveys (section 9).
• Unity Technologies and its affiliates (Unity LevelPlay, Unity Ads): video ads, only with consent (section 10); via LevelPlay possibly Google AdMob with non-personalized ads.
• Google Ireland Limited or Google LLC: sign-in with Google, Play Integrity, Firebase Cloud Messaging, Google Play Store.
• Meta Platforms Ireland Limited: sign-in with Facebook.
• Apple Distribution International Ltd., Ireland: on iOS, App Attest, push service and App Store.
• PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg: PayPal payouts.

Authorities, courts or advisors may also receive data where we are obliged to share it or where this is necessary to establish or defend legal claims. We do not sell personal data.

19. Transfers to third countries

Some recipients are based in the USA or access data from there. For the USA, there is an adequacy decision of the European Commission for companies certified under the EU-U.S. Data Privacy Framework; according to their own statements this applies, among others, to Expo, Resend, Google, Meta and Apple. We have agreed the European Commission's Standard Contractual Clauses with Supabase. Unity and TheoremReach state that they base their transfers on Standard Contractual Clauses. For Israel, where Unity affiliates are based, there is an adequacy decision. You can request a copy of the safeguards from us.

20. Automated decisions

We do not make decisions with legal effect solely by automated means. Payouts and blocks are always decided by a person; automated risk scores only serve as hints.

We automatically check whether a welcome or referral bonus has already been granted for your device. This check is necessary for the bonus conditions (Art. 22(2)(a) GDPR). If you believe a mistake was made, a person will review the decision at your request, and you may state your point of view.

21. Data security

We protect your data, among other things, through encrypted transmission (TLS), row-level access rules in the database, server-side crediting, signed partner notifications, hash values with a secret key for security signals, secure sign-in with PKCE, and access to our administration tool restricted to authorized persons, where every review decision is logged. Nobody can guarantee absolute security; please protect your login details and contact us if you suspect misuse.

22. Your rights

You have the right to:

• access your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object (Art. 21 GDPR, see section 23),
• withdraw consent you have given (Art. 7(3) GDPR).

To do so, write to us at support@claimo-app.com. If we have reasonable doubts about your identity, we only ask for the information needed to confirm it.

You can also lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

23. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your data that we base on Art. 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

You can unsubscribe from promotional push notifications at any time by turning off the "Offers" category in your profile.

24. Obligation to provide data

Without an email address or sign-in with Google or Facebook, an age group and a payout currency we cannot create an account, and without a recipient address we cannot make a payout. All other information and consents are voluntary. If you decline them, individual features such as video ads or personalized offers are not available.

25. Changes to this privacy policy

We update this policy when the App, our service providers or the law change. You can find the current version in the App and at claimo-app.com/datenschutz-app.html. We inform you about material changes in the App. If a new processing activity requires your consent, we ask you first.