Rewio Privacy Policy
1. Who we are
Rewio is an Android app. It gives you rewards in the games you link. In return, while internet sharing is on, Rewio lets business clients send web requests through your internet connection.
Rewio is operated by Clearbridge Technologies Ltd, a company registered in England and Wales under number 17214108, with its registered office at Building Unit 8, Olympic Park, Warrington, Cheshire, WA2 0YL, United Kingdom ("we", "us").
We are the controller of the personal data described in this policy. The network that our business clients use is run for us by our network infrastructure provider, a technology company based in the United Kingdom. It processes the data it receives (see section 7) only on our behalf and on our instructions, under a data processing agreement with us.
Privacy contact: team@rewio.io.
Representative in the EU: [EU REPRESENTATIVE NAME AND ADDRESS, if required].
2. Summary
- Rewio does not ask for your name, email or phone number. There is no Rewio account.
- When internet sharing is on, business clients send web requests through your internet connection. The websites they open see your IP address. Your IP address can show your country and city.
- We collect your IP address and what it shows (country, region, city and internet provider), Rewio's device IDs, Android version and device model, network type, how much traffic passes and when internet sharing is on, the games you link and your player ID in them.
- Rewio does not access your messages, files, photos, contacts, browsing history, passwords, precise location or what is on your screen.
- The linked game gets a link ID, the status of the link and your sharing time. It does not get your IP address.
- You can stop internet sharing at any time. You can withdraw consent in Settings. You can ask us to delete your data by email at team@rewio.io.
- Rewio is for people 18 or older.
3. How internet sharing works
When you turn on internet sharing, Rewio starts a network module inside the app. The module connects to servers run by our network infrastructure provider.
Our business clients send web requests to those servers. The servers pass some of the requests to your phone, and your phone sends them on to the website. The website sees the request as coming from your IP address. The answer comes back the same way.
Some things to know:
- Websites that clients open see your IP address. From an IP address, a website can usually tell your country, city and internet provider.
- Our network infrastructure provider uses your IP address and the location it shows, on our instructions, to choose which requests to send through your phone. Business clients can see the IP address and its location. They do not get your Rewio IDs, the game you linked or other data about you.
- Our network infrastructure provider keeps records of which client used your connection, when, and which websites were requested, for up to 12 months, to handle abuse complaints and legal requests.
- Rewio is not a VPN. Your own apps and browsing do not go through Rewio, and Rewio does not see them.
- Internet sharing uses your internet traffic. If you are not on Wi-Fi, it can use your mobile data.
- Internet sharing runs in the background, even when you are not using Rewio. While it runs, Rewio shows a notification. It keeps running after today's reward is ready, until you stop it.
Internet sharing starts only after you agree on the consent screen and tap Turn on internet sharing. Before that, the network module does not start and Rewio sends no data about your device.
4. What we collect
We do not use this data for ads, and we do not build a profile of your interests.
| Data | Where it comes from | Why we use it | Legal basis (GDPR and UK GDPR) | Who else gets it | How long we keep it |
|---|---|---|---|---|---|
| IP address and network details: IP address, IP version, internet provider, network number (ASN), connection type (Wi-Fi or mobile), connection checks (for example whether the connection looks like a VPN or a data centre) | Our network infrastructure provider's servers see it when the network module connects. Our server gets a copy about every 25 seconds while sharing is on | To run internet sharing, to route client requests, to count your reward time, to detect fraud | Consent for internet sharing and routing client requests. Performance of our agreement for reward accounting. Legitimate interests for necessary fraud prevention and security. | Websites and business clients see the IP address. Our network infrastructure provider. Not given to the linked game | 30 days |
| Approximate location: country, region and city worked out from your IP address | Worked out from your IP address. Rewio does not use GPS | To route requests by location, to detect fraud | Consent. Legitimate interests for fraud prevention | Websites and business clients can work it out from your IP address. Our network infrastructure provider | Same as IP address |
| Rewio device IDs: an installation ID, a node ID created by the network module, a public key created on your phone, a temporary access token | Created on your phone and on our server | To recognise your installation, to secure the connection to our server, to link your game | Performance of our agreement with you (Terms of Use) | Our network infrastructure provider (node ID only) | 90 days after your last activity |
| Device information: operating system and its version, version of the network module, device model | The network module, through our network infrastructure provider's servers | To operate the internet sharing you choose and to diagnose technical problems | Consent to operate internet sharing. Legitimate interests for necessary technical diagnostics. | Our network infrastructure provider | Same as IP address |
| Sharing activity: when internet sharing was on or off, whether your phone was online, connection time, traffic in and out, reward time counted per day | Rewio and our network infrastructure provider's servers | To count your reward progress, to show you "Internet used", to pay the game publisher, to detect fraud | Performance of our agreement. Legitimate interests for fraud prevention | The linked game gets your counted time and whether the link is active and online. Our network infrastructure provider | 90 days |
| Game link data: the game and its publisher, your player ID in that game, link ID, link status, dates of linking and of the end of the link, one-time link codes (each works for 1 hour) | You and the linked game | To send your rewards to the right player in the right game | Performance of our agreement | The linked game | While the link is active, then 90 days after it ends |
| Consent record: whether you agreed or withdrew, consent text version, your phone's language setting, date and time, confirmation that you are 18 or older, history of changes | You, on the consent screen and in Settings | To prove that you agreed and when, to stop internet sharing after you withdraw | Legal obligation to demonstrate consent. Legitimate interests for establishing, exercising or defending legal claims. | Service providers and other recipients in section 7, only where necessary and lawful | While you use Rewio, then 3 years |
| Server logs: IP address of your phone when it contacts our server, time, the address requested, request ID | Our server | To keep the service secure and working, to stop abuse of our server | Legitimate interests | Our hosting provider | 30 days |
| Fraud review records: signals, notes and decisions about an installation | Our staff and automated checks | To prevent and investigate fraud, to correct reward time | Legitimate interests | The linked game gets the time correction and a short reason | 90 days. If we find fraud, until the case is closed and any related claims are resolved |
| Game publisher payment records: link ID, node ID, counted time per month | Our server | To calculate and pay game publishers, for accounting | Legal obligation (accounting). Legitimate interests | The linked game gets a monthly total for all its players, without node IDs | 6 years from the end of the financial year they relate to, as required by UK tax law |
| Support messages: your email address and what you write to us | You | To answer you and handle your requests | Performance of our agreement. Legitimate interests | Our hosting provider | 1 year after your last message |
5. What Rewio does not access
Rewio does not ask for and does not access:
- your messages, emails or call history;
- your files, photos or videos;
- your contacts or calendar;
- your browsing history, or what you do in other apps;
- your passwords or payment details;
- your precise location (GPS);
- your camera or microphone;
- what is on your screen;
- your advertising ID, phone number or IMEI.
6. Why we use your data and on what legal basis
- To run internet sharing. Legal basis: your consent (Article 6(1)(a) GDPR and UK GDPR). Internet sharing uses your device and its connection, and for that we also rely on your consent.
- Your consent covers the use and disclosure of your IP address and IP-based location needed to route business clients' requests as explained in sections 3 and 7. It does not authorise unrelated advertising or other separate uses. Withdrawing consent stops these consent-based operations; we do not continue them by replacing consent with another legal basis.
- To count your reward progress and send it to your game. Legal basis: performance of our agreement with you under the Terms of Use (Article 6(1)(b)).
- To calculate and pay game publishers. Legal basis: our legitimate interest in administering the reward programme (Article 6(1)(f)). To keep records required by applicable accounting or tax law. Legal basis: legal obligation (Article 6(1)(c)).
- To prevent fraud and abuse and keep Rewio secure. For example, to find emulators, device farms, VPNs and repeated IP addresses, and to correct reward time. Legal basis: our legitimate interests and those of game publishers in a fair reward system (Article 6(1)(f)).
- To demonstrate your consent and record its withdrawal. Legal basis: compliance with our legal obligations (Article 6(1)(c), including Article 7(1)). Where necessary, we retain limited records to establish, exercise or defend legal claims on the basis of our legitimate interests (Article 6(1)(f)).
- To answer service-related messages and resolve reward issues. Legal basis: performance of our agreement (Article 6(1)(b)) where necessary to provide the service, and our legitimate interest in responding to other enquiries (Article 6(1)(f)). To handle requests about your data protection rights. Legal basis: compliance with our legal obligations (Article 6(1)(c)).
- To comply with binding legal obligations and lawful requests that we are required to fulfil under applicable law. Legal basis: legal obligation (Article 6(1)(c)). To investigate abuse complaints and establish, exercise or defend legal claims where necessary. Legal basis: our legitimate interests and those of affected persons (Article 6(1)(f)). We assess the legal basis for each disclosure.
Rewio stores its IDs and keys on your phone and reads the network status. Without this, the service you asked for can't work.
Participation in internet sharing is voluntary. Data necessary to operate sharing and to count and arrange rewards is required if you choose to take part. Withdrawing consent stops the processing that relies on that consent; it does not change the legal basis for separate processing that remains necessary and lawful.
Where we rely on legitimate interests, you can object (see section 11). You can ask us how we balanced our interests against yours.
Our system counts only time that meets the rules. For example, time when no traffic passed is not counted. If we correct time that was already counted, a person at Rewio makes that decision and records the reason. If you believe time has been wrongly excluded or a reward decision is incorrect, you can contact us to explain your position and request a review.
7. Who we share data with
Our network infrastructure provider. It runs the network that our business clients use, only on our behalf and on our instructions. Through the network module it receives your IP address, network details, device information, node ID and sharing activity.
Business clients and the websites they open. They do not get a file of your data from us. When their requests go out through your connection, websites see your IP address. Clients can see the IP address and its location. These websites can be in any country.
The linked game. When you link a game, the game sends us your player ID so we know who to reward. We send the game:
- a link ID;
- the status of the link, including whether internet sharing on your phone is online right now;
- your counted sharing time, and any time corrections with a short reason;
- a monthly total for all its players, for payment.
The game does not get your IP address, your Rewio device IDs, your location or your traffic data. The game gives you rewards under its own terms and privacy policy.
When your daily reward is ready, we send the game your player ID, a reward ID and a transaction ID.
Service providers (processors). They process data for us and only on our instructions:
- hosting, database and email: a cloud hosting provider in the European Union;
Rewio does not use analytics or crash reporting services.
Authorities and others where disclosure has a lawful basis. We assess requests and disclose only the data necessary to comply with applicable legal obligations or, where lawful and proportionate, to investigate abuse or establish, exercise or defend legal claims. A request alone does not automatically entitle the requester to your data.
Group companies and buyers. Where necessary and lawful, we may share relevant data with group companies that help run Rewio or with a buyer if Rewio or our business is sold. Access is limited to what is needed for that transaction or the stated service purpose and is subject to appropriate confidentiality and data protection safeguards. A change of owner does not by itself permit unrelated new uses of your data.
We do not sell your data to data brokers, and we do not share it for advertising.
8. International transfers
Our servers and email are hosted in the European Union. Your data may be processed outside the country where you live.
For transfers that require safeguards under EEA, UK or Swiss data protection law, we rely on adequacy decisions or on standard contractual clauses (the EU SCCs and the UK International Data Transfer Addendum). Where applicable, this includes an adequacy decision or appropriate contractual safeguards with any necessary supplementary measures. You can ask for details or a copy of the relevant safeguards at team@rewio.io, with confidential information redacted where permitted.
9. How long we keep data
We keep data only as long as we need it for the purposes in section 6. Then we delete it or make it anonymous.
| Data | How long |
|---|---|
| IP address, location and network details | 30 days |
| Sharing activity and reward time | 90 days |
| Reward time records offered to the linked game | 90 days after they are created |
| Game link data | While the link is active, then 90 days after it ends |
| One-time link codes | Until used, and no longer than 1 hour |
| Consent records | While Rewio is in use, then 3 years |
| Server logs | 30 days |
| Fraud review records | 90 days. If we find fraud, until the case is closed and any related claims are resolved |
| Game publisher payment records | 6 years from the end of the financial year they relate to, as required by UK tax law |
| Support messages | 1 year after your last message |
| Data on your phone | Until you uninstall Rewio. It is not included in Android backups |
We retain specific records for longer only where necessary to comply with an applicable legal obligation or to establish, exercise or defend legal claims. Access and use are restricted to that purpose, and the records are deleted when the reason for retention ends. A general possibility of future complaints or requests is not a reason to keep all data indefinitely.
10. How we protect your data
- Rewio talks to our server only over encrypted connections (HTTPS).
- The keys that identify your installation stay in the Android Keystore on your phone and are not included in backups.
- Game publishers use their own server credentials. No server secrets are stored in the app.
- Only staff who need personal data for their work can access it.
No system is fully secure. If a breach affects your data and puts you at risk, we will tell you and the authorities as the law requires.
11. Your rights
If you are in the EEA, the UK or Switzerland
Subject to the conditions and exceptions in applicable law, you have the right to:
- access your data and get a copy;
- correct inaccurate data;
- delete your data;
- restrict how we use it;
- object to processing based on legitimate interests;
- data portability, where processing is automated and based on consent or contract, subject to the conditions of applicable law;
- withdraw consent at any time. This does not affect the lawfulness of processing based on your consent before you withdrew it;
- complain to a competent data protection authority, including the authority where you live or work or where the alleged infringement occurred.
If you are in California
This policy and the consent screen are our notice at collection.
Under the California Consumer Privacy Act, as amended by the CPRA, you have the right to:
- know what personal information we collect, use and disclose, and get a copy;
- delete it;
- correct it;
- opt out of the sale or sharing of your personal information;
- not be treated differently for using these rights.
We collect these categories of personal information: identifiers (IP address, Rewio device IDs, your player ID in the linked game); internet or other network activity (sharing activity and traffic amounts); approximate geolocation (country, region and city from your IP address); commercial information (reward time counted for your game). We do not collect sensitive personal information or precise geolocation. Sources, purposes and recipients are in sections 4 and 7. Retention is in section 9.
[OPTION A, if routing client requests through your IP address is a "sale": Our business clients pay to send requests through users' connections, and websites see your IP address. This may count as a "sale" of your IP address under California law. You can opt out at any time by turning off internet sharing or withdrawing consent in Settings. [Do Not Sell or Share My Personal Information link]]
[OPTION B, if it is not a "sale": We do not sell or share your personal information as California law defines these terms.]
[NOTICE OF FINANCIAL INCENTIVE, if required: Rewards in linked games are given for time with internet sharing on. [DESCRIPTION, HOW TO OPT IN AND OUT, VALUE OF DATA]]
We do not knowingly sell or share personal information of people under 16.
You can use an authorised agent. We will ask the agent for proof that you authorised them.
If you live in another US state
Depending on where you live and whether the relevant law applies to us and the processing, you may have rights to access, correct and delete your personal data, obtain a portable copy, and opt out of a sale of personal data, targeted advertising or certain profiling. Where applicable law provides an appeal, you can appeal a refusal by writing to team@rewio.io with "Appeal" in the subject line. We will explain the outcome and any available way to contact the relevant state authority.
How to use your rights
- By email: team@rewio.io. We will explain what information is reasonably needed to locate your data and handle your request.
Rewio has no accounts. We use information associated with your installation to locate relevant data and, where verification is needed, take proportionate steps to confirm that you are entitled to make the request. An identifier alone may not be enough. We ask only for information reasonably needed for that purpose. Under the GDPR and UK GDPR, we normally respond within one calendar month; for CCPA requests to know, delete or correct, normally within 45 days. Other requests, including opt-outs, follow their applicable deadlines. We explain any extension permitted by law.
12. Stopping internet sharing, withdrawing consent and deleting your data
Stop internet sharing. Tap the button on the main screen, or Stop in the Rewio notification. Internet sharing stops right away. Your consent stays on record, and you can turn internet sharing on again later.
Withdraw consent. Go to Settings and tap Withdraw consent. Internet sharing stops right away and does not start again until you agree again on the consent screen. Withdrawing consent does not unlink your game. Internet sharing and game linking are separate: sharing runs only while you keep it on, and linking or unlinking a game does not turn sharing on or off. Withdrawing consent does not cancel rewards you have already earned, including rewards awaiting delivery.
Unlink a game. Go to Settings, then Linked games, then Unlink. New sharing time stops going to that game.
Delete your data. Email team@rewio.io. We stop internet sharing, delete or anonymise your data without undue delay and within one month (we may extend this by two months for complex requests and will tell you if we do), and tell the linked game that the link has ended. We retain only specific records that are necessary under applicable law or to establish, exercise or defend legal claims, with access restricted to that purpose. The categories and applicable retention periods or criteria are in section 9. We explain any applicable exception to your deletion request.
Uninstall. Uninstalling Rewio deletes Rewio data on your phone and stops internet sharing. It does not delete data on our servers. To delete that, email us at team@rewio.io.
Rewards you already got are held by the game. To delete them, contact the game publisher.
13. Children
Rewio is for people 18 or older. Before internet sharing starts, you confirm that you are 18 or older and allowed to share the internet connection you use. We do not knowingly collect data from anyone under 18. If we learn that someone under 18 used Rewio, we stop internet sharing on that installation and delete their data, except what the law requires us to keep.
If you think a child is using Rewio, contact us at team@rewio.io.
14. Changes to this policy
When we change this policy, we update the version and date at the top. We notify you in the app before a material change takes effect. If a change requires consent beyond the consent you have already given, the affected processing does not begin until you give that consent. Editorial or contact-detail updates do not by themselves require new consent. This policy is a privacy notice; it does not replace the Terms of Use or your separate consent.
15. Contact
Clearbridge Technologies Ltd
Building Unit 8, Olympic Park, Warrington, Cheshire, WA2 0YL, United Kingdom
Email: team@rewio.io
[EU REPRESENTATIVE]