Privacy Policy

1. Who We Are and Scope

Maxx Reward ("we", "us", or "our") operates the Maxx Reward mobile application and related web services. This Privacy Policy explains how we collect, process, store, and protect your information when you use our application.

By creating an account or accessing Maxx Reward, you agree to the collection and use of information in accordance with this policy and the Indian Digital Personal Data Protection (DPDP) Act, 2023.

2. Data We Collect

We believe in minimal data collection. We collect the following categories of data:

• Authentication Data: When you sign in using Google Sign-In, we receive your unique Google Account ID, verified email address, and basic profile name/avatar. We never receive your Google account password.
• Profile Data: Your self-chosen nickname and avatar identifier for the app and optional leaderboard display.
• Device & Security Identifiers: A cryptographic, keyed one-way hash of your hardware device ID (using SHA-256). We do not store raw hardware serial numbers or IMEI. We also collect Google Play Integrity tokens to confirm the app is authentic and not running on emulators or rooted devices.
• Phone Number (One-Time Claim): For referral verification and fraud prevention, you may verify your mobile number via OTP. We store only a keyed hash of your verified phone number (never the plain number in our database) to enforce our one-phone-one-account policy.
• Activity & Points Ledger: Append-only records of your earned points, task history (videos watched, check-ins, games played), and redemption requests.
• Technical Diagnostics: Minimal crash logs and network performance metrics via Firebase to identify bugs and improve app stability.

3. Why We Process Your Data (Purpose)

We process your data strictly for legitimate operational purposes:

• To establish your profile and maintain your points wallet balance.
• To credit rewards accurately when you complete daily check-ins, games, videos, or shopping offers.
• To prevent fraudulent behavior, including automated bot attacks, emulator farming, device spoofing, and circular referral rings.
• To process and deliver your gift card redemptions or UPI transfers.
• To comply with statutory financial accounting obligations under Indian laws.

4. Third-Party Service Providers (Data Processors)

We work with trusted third-party service providers who assist us in operating the platform. All providers are bound by strict confidentiality and data protection agreements:

• Supabase: Cloud database, authentication engine, and serverless Edge Functions hosting.
• Google LLC (Firebase & AdMob): Authentication verification, push notifications (FCM), Google Play Integrity attestation, and rewarded video ad delivery.
• Affiliate Networks (Cuelinks & Offerwall Partners): When you click shopping offers, an anonymized tracking reference (SubID) is passed to attribute completed merchant purchases so points can be credited.
• Upstash: Temporary in-memory Redis storage for rate-limiting and short-lived OTP session counters.
• APITxT: SMS gateway provider used exclusively to transmit one-time phone verification OTPs via DLT-approved templates.

5. E-Commerce & Affiliate Link Tracking

When you click on shopping deals (e.g. Flipkart, Myntra, Swiggy) within Maxx Reward, you are redirected to the merchant via affiliate links generated by our affiliate partners (such as Cuelinks).

A temporary, non-personal tracking parameter (subid) containing your anonymized internal user identifier is appended to the tracking link. This allows the affiliate network to notify our server when an order is completed, enabling us to credit your cashback points. No personal identifiers (such as your name, email, or phone) are ever shared with merchants.

6. Data Retention Policy

• Active Accounts: We retain your profile, points ledger, and redemption history as long as your account remains active.
• Temporary Logs: Ad sessions are deleted after 7 days; push notification outbox rows after 30 days; system job logs after 60 days.
• Upon Account Deletion: Your personal profile, email, nickname, push tokens, and device bindings are permanently purged. To satisfy financial accounting requirements and prevent abuse, anonymized points transactions and one-way hashed device/phone claims are retained without your personal identity.

7. Your Rights Under the DPDP Act, 2023

As an Indian citizen and data principal, you have the following rights:

• Right to Access: You can view your complete earning and redemption history in the app Wallet at any time.
• Right to Correction: You can edit your nickname or profile settings anytime.
• Right to Erasure (Account Deletion): You can delete your account at any time directly in the app (Me → Settings → Delete my account) or via our Public Deletion Page.
• Right to Grievance Redressal: You can submit privacy-related complaints to our designated Grievance Officer.

8. Age Restriction (18+ Only)

Maxx Reward is strictly intended for individuals who are 18 years of age or older. We do not knowingly collect or solicit personal information from minors under 18. If we learn that a user is under 18, the account will be promptly terminated.

9. Security Measures

We employ industry-standard technical and organizational security measures to protect your data. All communication between the app and our servers is encrypted using TLS/HTTPS. Delivered gift card codes are encrypted with AES-256-GCM encryption, and the app utilizes Android FLAG_SECURE to prevent unauthorized screen captures of your reward codes.

10. Grievance Officer & Contact Details

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, the details of our Grievance Officer are provided below:

11. Changes to this Policy

We may update this Privacy Policy periodically. Any modifications will be posted on this page with an updated Effective Date. Continued use of the application after changes constitute acceptance of the revised policy.