Privacy Policy

01 Who this covers

This Policy explains the practices of the operator of AoyTasks for this website, its account and support services, advertising tools, publisher integrations, and the offerwall. It covers visitors, advertisers, publishers, and people who access activities through a publisher's website or app.

A publisher, advertiser, survey network, shortlink provider, payment service, or other external website may also collect information under its own notice. This Policy describes our handling of information; it does not replace those organizations' notices. Contact us through Support about our practices or a privacy request.

02 Information we receive

Information you provide

• Account information: username, email address, password credentials, country, gender where requested at registration, and verification or security settings.
• Publisher and campaign information: website or app details, integration and callback settings, reward configuration, campaign destinations, descriptions, targeting, images, budgets, and event requirements.
• Payment information: selected payment method, wallet or recipient address, network and memo where required, deposit and withdrawal amounts, transaction references, and provider status. Do not send us a wallet's private key or seed phrase.
• Support and task submissions: the name, email, message, and information you submit to Support, and text or images you submit as task proof. Include only information needed for the request or task.

Activity and technical information

We receive IP addresses, approximate country derived from an IP address, User-Agent and device/browser information, request times, session identifiers, browser security identifiers, and security-check results. Server and security logs may also record requested pages, response status, referring information when the browser sends it, and errors.

Activity records can include a publisher app ID and member identifier (Sub ID), campaign and provider identifiers, click and transaction IDs, event or goal names, timers, claim-session state, reward amounts, approvals, rejected actions, reversals, and callback delivery attempts. Faucet records also include the draw, reward tier, and session data used to verify a claim.

Information from integrations and providers

Publishers send member identifiers and, for the Publisher API, the member's IP address and User-Agent. Advertisers and external providers send completion, rejection, reversal, risk, and payment information needed to confirm an action or transaction. An identifier supplied by a publisher may not include your name, but that publisher can usually link it to your member account.

03 How we use information

• Register and authenticate accounts, verify email addresses, apply access controls, and respond to support requests.
• Show eligible activities using the app's enabled categories, device and country targeting, campaign funding, and completion limits.
• Attribute genuine actions, review task proof, calculate and reconcile rewards, deliver publisher postbacks, and process deposits or withdrawals.
• Detect duplicate activity, account misuse, automated claims, manipulated locations, payment abuse, and attempts to bypass verification.
• Investigate errors and disputes, maintain audit records, improve reliability, and comply with applicable legal obligations.

Where data-protection law requires a legal basis, we use information as necessary to provide the service you request or perform our agreement, meet legal obligations, or pursue legitimate interests such as service security, fraud prevention, and accurate accounting, subject to the protections required by that law. Where consent is required for a particular purpose or technology, we must obtain it separately; reading this Policy is not blanket consent to every use.

We may send account, security, verification, support, and transaction messages needed for the service. This Policy does not treat account registration as permission for unrelated promotional messages.

04 Cookies & browser signals

We use cookies and browser storage for sessions, authentication, security, offerwall continuity, and preferences such as the display theme. A browser identifier helps bind a member to the correct publisher and prevent a claim from being reused in another session.

Our offerwall security check also creates a hashed browser signal from platform, language, and time-zone values. We can compare that signal with the session, IP address, and activity history to check continuity. It is a security signal, not proof of a person's identity, and we do not describe it as anonymous simply because it is hashed.

Cloudflare and an enabled CAPTCHA provider may use their own cookies or technical signals to verify a request. External activity, survey, advertiser, shortlink, and payment pages may use additional cookies or storage governed by their own notices.

If site analytics is configured, Google Analytics may collect visit, browser, and device information and use cookies or similar technologies to measure site usage. Google's handling of that information is explained in its Privacy Policy. Any consent required by applicable law for optional analytics is separate from this Policy.

You can review or delete cookies and site storage through your browser. Blocking or clearing required storage can sign you out, invalidate a session, or prevent verification and reward completion. Controls for optional technologies, where used and required, do not remove the security checks needed to operate a protected activity.

05 Who receives information

We disclose information needed for the relevant service or a legitimate, lawful operational purpose to:

• The publisher you use: activity and transaction identifiers, its member ID, completion or reversal status, reward and payout values, and IP/country details in reports or authenticated callbacks. The publisher uses these to reconcile and credit its members.
• Advertisers and activity providers: click or member identifiers, device and country context, and completion or verification details needed to deliver an activity, apply its rules, and resolve invalid actions.
• Payment providers: recipient and transaction details needed to obtain a quote, confirm a deposit, send a withdrawal, or reconcile its status.
• Infrastructure, security, and support providers: information needed to host and deliver the service, send service messages, diagnose faults, and prevent abuse. Cloudflare provides website security and Turnstile verification when enabled; an enabled network-risk service may receive the visitor IP for country or proxy checks.
• Authorized reviewers and administrators: records needed to review campaigns, task submissions, support requests, security incidents, and transactions.

We may also disclose relevant information when required by law or reasonably necessary to protect lawful rights, investigate abuse, or respond to a valid authority request. Access should be limited to the purpose involved, rather than exposing unrelated account or credential information.

For Turnstile and Cloudflare challenge checks, Cloudflare may receive your IP address, User-Agent, connection fingerprints, and the site key and origin associated with the check to detect bots and improve its verification service. See Cloudflare's Turnstile Privacy Addendum and Privacy Policy. Before entering information on another external destination, review that provider's privacy notice.

06 Publisher integrations & public content

Publishers operate their own member databases and decide how their reward currency maps to member balances. They are responsible for explaining the information they collect and send to us and for handling privacy requests concerning their own records. You may need to contact both the publisher and AoyTasks when a request concerns both services.

The Publisher API uses an app-scoped backend token and the intended member's browser context. We record token status and management audit events, and keep a hash of the bearer token for authentication. Temporary selection and launch references connect an API selection to the normal verified browser flow. Publishers must keep private credentials out of public pages, client apps, and logs.

Campaign titles, descriptions, targeting-related labels, and campaign images are intended to be shown to eligible users. Task proof is submitted for completion review. Do not upload private documents, passwords, or unrelated personal information into campaign content or proof.

07 Security & fraud prevention

We use access controls, encrypted transport, password hashing, credential protection, signed or authenticated callbacks, session binding, request limits, and verification checks to reduce unauthorized access and false activity. No online service can guarantee complete security.

Cloudflare or CAPTCHA checks may appear at sign-in, registration, contact, offerwall access, or reward steps depending on the current configuration. A check can succeed, expire, or fail, and a failed or unavailable verification may prevent a protected action from proceeding.

Security signals and activity history may automatically restrict an action or flag it for review. If a restriction or reward decision seems incorrect, contact Support with the relevant account, app, or transaction reference and ask for review. Do not send a password, seed phrase, API bearer token, or postback secret.

08 Retention & international processing

Different records serve different purposes. We retain information for as long as needed to provide the relevant service, maintain accurate transaction records, investigate abuse, resolve disputes, and meet applicable legal obligations. The purpose, sensitivity, account status, possible reversals, and legal requirements affect that period; a short session expiry does not mean all related transaction or security records are deleted at that time.

Account closure or a deletion request may not immediately remove records that must be retained for a lawful reason. We will explain applicable limits when responding to a request and handle retention, deletion, or de-identification in accordance with applicable law.

External providers may process information in countries other than yours. Where applicable law restricts international transfers, the required lawful safeguards must apply. Contact Support if you need information about a transfer or provider relevant to your activity.

09 Your choices & rights

You can keep account and payment details up to date, choose whether to start an activity or visit an external provider, manage browser storage, and contact Support about account closure or your information. Publishers can configure app content visibility and rotate or revoke API access.

Depending on the law that applies to you and the relevant processing, you may have rights to:

• Know how your information is used and obtain access to, or a copy of, relevant personal information.
• Correct inaccurate information or request deletion, subject to lawful exceptions.
• Restrict or object to certain processing, or receive eligible information in a portable form.
• Withdraw consent for processing based on that consent, without changing the lawfulness of earlier processing.
• Opt out of a sale or sharing of personal information, or certain targeted advertising, where those activities occur and the applicable law grants that right.
• Raise a complaint with the relevant data-protection authority and exercise applicable rights without unlawful discrimination.

For a request about AoyTasks records, use Contact Support, identify the account or publisher app involved, and state the request. We may ask for proportionate verification of identity or authority before disclosing or changing records. We will respond within the period required by applicable law and explain any lawful exception or extension. We do not routinely charge a fee simply to exercise a privacy right; any permitted exceptional fee would be explained first.

For more about rights that may apply, see the European Commission's data-protection guidance and the California Attorney General's CCPA guidance. Applicability and exceptions depend on the law and circumstances.

10 Children

The service is not intended for children under 13, and we do not knowingly collect their personal information. Higher age requirements may apply to an activity, provider, or country. If you believe a child under 13 has provided information to us, contact Support so we can investigate and take the appropriate steps to remove it, subject to any lawful preservation obligation.

11 Updates & contact

We may update this Policy to reflect changes in the service, providers, or applicable requirements. The date at the top identifies the current version. We will give appropriate notice of material changes and seek additional consent where required.

The operator of AoyTasks can be contacted through Support for questions about this Policy, privacy rights, a security concern, or a provider involved in an activity. Include enough context to locate the relevant records without exposing secret credentials.