Privacy Policy
Last updated October 14, 2026
This policy explains how Volcano Rewards (“we”, “us”) collects, uses and shares personal information when you use Volcano Rewards (the “Service”), and the rights you have over it. It should be read with our Terms of Service. Sections for people in the European Economic Area, UK and Switzerland, California and other US states are below.
- We collect what we need to run your account, pay your rewards and stop fraud.
- Offer and survey partners get an anonymous ID, never your email address.
- We don't sell your personal information or share it for targeted advertising.
- You can ask to see, correct, download or delete your information at any time.
1. Who is responsible for your information
Volcano Rewards, based in Indiana, United States, is the controller of your personal information (the “business” under California law). Contact us about privacy at support@volcanorewards.com.
2. Information we collect
| Type | What it includes | Where it comes from |
|---|---|---|
| Account details | Email address, username, password (stored only as a one-way hash), join date | You |
| Phone number | The mobile number you verify before cashing out | You |
| Rewards activity | Offers and surveys you start and complete, points earned and reversed, daily check-ins and streaks, cashouts, referrals, teams and battles | You, and our offer and survey partners when they report completions |
| Device and connection | IP address, browser user agent, approximate location derived from your IP address (country or region, never precise location), and a device identifier: a one-way hash derived from browser and device signals, including browser type, language, screen, fonts, and canvas, WebGL and audio rendering characteristics | Your browser, automatically |
| Things you send us | Community chat messages, proof you submit for featured offers (including screenshots), and support emails | You |
| Tax information | Only if US tax law requires it once your cashouts pass a yearly threshold: the details on a tax form such as a W-9, which include your name, address and taxpayer identification number | You |
| Fraud signals | Risk checks on your account, such as shared devices, many accounts from one connection, or unusual reversal rates | Generated by us from the information above |
You don't have to give us any information, but we can't create an account without an email address, and we can't send a cashout without a verified phone number (and, where required, a tax form).
3. How we use it, and our legal bases
If you're in the EEA, UK or Switzerland, the law requires us to name the legal basis for each use. For everyone, this is what we use your information for.
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, track offers, credit points and deliver the rewards you redeem | Performing our contract with you |
| Send service emails and texts: email confirmation, password resets, phone verification codes | Performing our contract with you |
| Send a daily summary email on days your balance changes (points that cleared, new rewards, cashouts). It's about your account only, never ads, and you can turn it off with one click in any summary or on your profile | Our legitimate interest in keeping you informed about your account. You can object at any time by unsubscribing |
| Prevent fraud and abuse: verify your phone number, detect duplicate accounts, VPN or proxy use and fake completions, and review cashouts | Our legitimate interest in keeping the Service and our partners safe from fraud, and performing our contract (the Terms require one account per person) |
| Find and fix bugs, and keep the Service fast and reliable: error reports and performance timings | Our legitimate interest in a Service that works. You can object at any time |
| Run community chat and moderate it | Our legitimate interest in a safe community |
| Show recent rewards to other signed-in members on the Games tab (your username, the game and the amount only), and how many members earned from a game this week (a count, never names). You can leave the feed with one switch on your profile | Our legitimate interest in a lively community, which you can object to at any time |
| Answer support requests and investigate missing credits | Performing our contract with you |
| Keep tax, accounting and payout records | Complying with legal obligations |
| Enforce our Terms, and establish or defend legal claims | Our legitimate interests |
| Marketing emails (only if we ever offer them, and only if you opt in) | Your consent, which you can withdraw at any time |
Where we rely on legitimate interests, we've weighed them against your rights, and you can object (see your rights below). We don't use your information to build advertising profiles.
4. Automated fraud checks
To protect rewards from fraud, our systems automatically score accounts using signals such as shared devices, many accounts on one connection, VPN or proxy use, and how often a partner reverses your completions. A higher score can send your cashout to a person for manual review or, above a set level, pause cashouts on the account while you can still earn. We never close an account or refuse a reward based only on the automated score; a person reviews those decisions. If your cashouts are paused, you can ask why, give us your side and ask for a person to review the decision by emailing support@volcanorewards.com.
5. Who we share it with
We share personal information only as described here, and only as much as each recipient needs.
| Recipient | What they receive | Why |
|---|---|---|
| Offer and survey partners: Klink Labs, Offerwall.gg, ClickWall, GemiAd, VortexWall (MobiVortex), Offery, CPX Research, TheoremReach | An anonymous ID we generate for you (never your email or name). For surveys, also your IP address and browser user agent, so partners can match surveys to you and block fraud. When you start an Offermaru offer, also your IP address, so it can check the offer is available where you are | To show you offers and surveys, and to report completions so we can credit you |
| Prelude | Your phone number, IP address and browser user agent | To send and check your phone verification code and screen out fraudulent requests |
| Brevo | Your email address and the content of service emails and daily summaries | To send those emails |
| Sentry (error monitoring, servers in the US) | Technical details when something breaks or runs slowly: the error message, the page or background job involved, where in our code it happened, timings, and your browser and device type. We remove email addresses, IP addresses, cookies, web-address query strings and anything typed into forms before a report is sent, and reports from your browser travel through our own website rather than straight to Sentry | To find and fix bugs and slowdowns, including ones that could affect your points or payouts |
| Cloudflare (Turnstile, and our network and security provider) | Your IP address and basic browser and device signals. Your connection to the Service may also pass through Cloudflare's network, which then handles the pages and files you load on their way to and from our servers | To protect sign-up, log-in and phone verification from bots, to deliver the Service quickly, and to protect it from attacks |
| IPQualityScore (when IP reputation checks are enabled) | Your IP address at signup | To assess VPN, proxy, data center and abuse risk |
| GoGift (Global Gift Card), PayPal or Venmo, whichever you choose | The name and email address (GoGift, PayPal) or phone number (Venmo) you give when you cash out, and the amount | To send you the cashout you request |
| Hosting and infrastructure providers, including Cloudflare R2 (encrypted backups) | Everything stored on the Service, processed on our behalf. Backups are encrypted on our server before they're sent, and Cloudflare can't read them | To host and run the Service, and to recover it after a failure |
| Authorities, courts and advisers | What the law or the situation requires | To comply with the law, respond to lawful requests, or protect users, the Service or others from fraud or harm |
| A buyer or successor | The information needed to continue the Service | If the Service is sold, merged or reorganized. We'll tell you before your information becomes subject to a different privacy policy |
When you open an offer or survey, you go to the partner's own site or app, which collects information directly (for example, your survey answers) under its own privacy policy.
We don't sell your personal information and we don't share it for cross-context behavioral advertising, as those terms are defined under California law, and haven't done so in the past 12 months.
6. Text messages
When you verify your phone number, we send a one-time verification code to that number by text message, only when you ask for one. We don't send marketing texts. Message and data rates may apply. Reply STOP to opt out or HELP for help, or contact support@volcanorewards.com.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties. Your number is shared only with our verification provider, and only to deliver the codes you request.
7. Cookies and similar technology
We use a cookie that keeps you signed in, and two that remember which kind of device (iPhone, Android or computer) to show offers for, including a choice you make yourself. Your browser's own storage also keeps a few small settings on your device, such as whether you chose dark mode, a notice you closed, and when we last suggested adding Volcano Rewards to your Home Screen; those settings are never sent to us. All of this is needed for the Service to work the way you've chosen, so it doesn't need your consent. We don't use advertising cookies or ad tracking, and we don't record your screen or sessions. Cloudflare Turnstile runs a brief browser check on some forms to tell people from bots. Partner sites and apps you open from the Service may set their own cookies under their own policies.
8. How long we keep it
| Information | How long |
|---|---|
| Account details, phone number and rewards activity | While your account is open. When it's deleted, we delete or anonymize it within 30 days, except for the records below |
| Encrypted backups of our database and of screenshots you send (kept so we can recover from a hardware failure or a mistake) | Up to 35 days, then deleted automatically. If we ever restore a backup, we repeat any account deletions made after it was taken |
| Points, cashout and payout records | 7 years after the transaction, for accounting and tax law |
| Tax forms | 4 years after the tax year they relate to, as US tax law requires |
| Fraud-prevention records (device identifier, IP addresses and risk checks) for accounts closed for fraud or abuse | Up to 2 years after closure, to stop the same person signing up again |
| Phone verification requests (number, IP address and time) | 12 months |
| Community chat messages | 12 months, or 90 days after a message is removed |
| Where you signed in from (the kind of device, the country and the IP address), to warn you about sign-ins you don't recognize | 6 months, except your most recent sign-in, kept while your account is open |
| Which emails we sent you and when, so none is sent twice | 13 months |
| Failed log-in attempts (the email typed and the IP address) | 1 day, to stop password guessing |
| Partner reports we rejected (for example, a bad signature), including the sender's IP address | 90 days |
| Other answers when we ask whether an offer opened properly | 90 days |
| Wrong-destination reports linked to your account, offer and click, including country, device and link version; aggregate link-resolution counts by offer, outcome, country, device and link version | 30 days |
| Screenshots you send as proof for featured offers | 12 months after your claim is reviewed, or until your account is deleted if that's sooner |
| Error reports and performance timings sent to Sentry (see section 5) | Up to 90 days, then Sentry deletes them |
| Support emails | 3 years after the conversation ends |
9. Your rights and how to use them
Wherever you live, you can ask us to give you a copy of your information, correct it, or delete your account and information, and you can ask questions about how it's used. Email support@volcanorewards.com from the address on your account and tell us what you'd like. We'll confirm the request came from you (usually by replying to that address, and for sensitive requests by asking you to confirm details only you would know), and reply within 30 days, or within 45 days where California law applies. If we need more time, we'll tell you why. Using your rights is free and won't affect how we treat you, although deleting your account means any remaining points can no longer be redeemed.
We may keep some information after a deletion request when the law requires or allows it, for example payout records for tax purposes or information needed to prevent fraud; we'll tell you if that applies.
If you're in the EEA, UK or Switzerland
Under the GDPR, UK GDPR and Swiss data protection law, you have the right to:
- Access your personal information and get a copy of it.
- Rectification: have inaccurate information corrected.
- Erasure: have your information deleted, subject to the exceptions above.
- Restriction: ask us to limit how we use your information while a concern is resolved.
- Portability: receive the information you gave us in a common machine-readable format (such as JSON or CSV), or have it sent to another company.
- Object to our use of your information based on legitimate interests.
- Withdraw consent at any time, where we rely on it. This doesn't affect what we did before.
- Human review of decisions made by automated means (see section 4).
- Complain to a data protection authority, in particular where you live or work. We'd appreciate the chance to resolve your concern first.
International transfers
We're based in the United States, and our providers process information in the United States and other countries whose data protection laws may differ from yours. When we transfer personal information out of the EEA, UK or Switzerland, we rely on the provider's certification under the EU-US Data Privacy Framework (and its UK and Swiss extensions) where available, on the European Commission's Standard Contractual Clauses (with the UK addendum), or, where neither applies, on the transfer being necessary to provide the Service you asked for. Contact us for more detail on the safeguards used.
If you're a California resident
The California Consumer Privacy Act, as amended by the California Privacy Rights Act (the “CCPA”), gives you the rights below. This section also serves as our notice at collection.
In the past 12 months we have collected these categories of personal information:
| CCPA category | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Email, username, phone number, IP address, anonymous partner IDs, device identifier | Offer and survey partners (anonymous ID; IP for surveys and Offermaru offers), Prelude, Brevo, Cloudflare, IPQualityScore, payout providers, hosting providers |
| Customer records (Cal. Civ. Code § 1798.80) | Name, address and phone number, when a tax form is required | Hosting providers |
| Commercial information | Offers completed, points earned, rewards redeemed | Payout providers, hosting providers |
| Internet or electronic network activity | Offers and surveys opened, browser user agent, interactions with the Service | Offer and survey partners, Cloudflare, Sentry, hosting providers |
| Geolocation data | Approximate location from your IP address (not precise location) | Survey partners, hosting providers |
| Inferences | Fraud risk checks | Not disclosed |
| Sensitive personal information | Account log-in (email with password) and, only when tax law requires it, your taxpayer identification number | Hosting providers |
The sources, purposes and retention periods are described in sections 2, 3 and 8. We use sensitive personal information only to run your account and meet legal obligations, not to infer characteristics about you, so the right to limit its use doesn't apply.
You have the right to:
- Know what personal information we collect, use and disclose, and get a copy of it.
- Delete your personal information, subject to legal exceptions.
- Correct inaccurate personal information.
- Opt out of sale or sharing. We don't sell or share personal information, so there is nothing to opt out of. We still treat a Global Privacy Control signal from your browser as a valid opt-out request.
- Non-discrimination: we won't treat you differently for using these rights.
To make a request, email support@volcanorewards.com. You can use an authorized agent; we'll ask the agent for proof of your written permission and may ask you to confirm your identity with us directly. We don't knowingly sell or share the personal information of anyone under 16, and the Service is only for adults.
Notice of financial incentive. Points reward you for completing offers, surveys and other activities, and for referring friends who join and become active. They aren't payment for your personal information: we collect only what's needed to run those activities and credit you, and completing any particular offer is always optional. The value of a reward is the value shown for it on the Service, which reflects what the partner pays for the completed activity. You can stop taking part at any time by not starting new offers, or by deleting your account.
California's “Shine the Light” law lets residents ask about disclosures to third parties for their direct marketing. We don't make such disclosures.
If you live in another US state with a privacy law
Residents of states such as Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others have similar rights: to confirm whether we process your information, access, correct and delete it, get a portable copy, and opt out of targeted advertising, sale and profiling with significant effects (we don't do these). Email support@volcanorewards.com to make a request. If we decline your request, you can appeal by replying with “Appeal” in the subject line; we'll answer within 45 days (60 days in Colorado), and if you're unhappy with the outcome you can contact your state attorney general.
10. Security
We protect information with measures such as encrypted connections, hashed passwords, restricted access to production systems and logs of administrative actions. No system is perfectly secure, so please use a strong, unique password. If a breach affects your information, we'll notify you and the authorities as the law requires.
11. Children
The Service is only for people 18 and older. We don't knowingly collect information from anyone younger. If you believe a minor has signed up, contact us and we'll close the account and delete their information.
12. Changes to this policy
We'll post any changes here and update the date at the top. If a change is significant, we'll tell you on the Service or by email before it takes effect.
13. Contact
Privacy questions and requests: support@volcanorewards.com.