Bonusboy Privacy Policy

Effective 2026-09-16 · Updated 2026-10-06 (referral data) · 2026-10-10 (activity records, notifications, cashback networks, nickname and notification choices) · 2026-10-15 (optional survey profile) · 2026-10-19 (web version) · TanzSoft Co., Ltd. (Seoul, Korea)

1. What we collect

• Account: when you sign in with Google we receive your Google account ID, email address and display name. We do not receive or store your Google password.
• Device: a hashed device identifier (derived from Android ID), device model, app version, language and country, and a Google Play Integrity verdict. These are used to enforce one account per device and to detect emulators, rooted or tampered devices and duplicate accounts.
• Network: your IP address at sign-in and at withdrawal, kept in security logs.
• Web version (app.bonusboy.com): If you use Bonusboy in a web browser, we use only strictly necessary cookies: a sign-in session cookie (ends after 7 days), a 10-minute sign-in security cookie that checks that the Google or Apple response belongs to the sign-in you started, and a random browser ID cookie (1 year) that keeps one account per browser. We store a one-way hash of that browser ID together with your browser and operating-system name and your IP address, and we check whether your IP address belongs to a data-centre or VPN network. We do not use advertising or analytics cookies, third-party trackers or fingerprinting scripts on the web version. If enabled, the sign-in page uses Cloudflare Turnstile to block bots, which processes your IP address and browser signals. Accounts created on the web have stricter cash-out rules (a longer holding period and limits), shown in the wallet.
• Rewards: survey and task completions reported by our research partners (transaction ID, reward amount, status), your reward ledger and withdrawal history.
• Payout email: the email of the Google account you signed in with. It is recorded with each withdrawal; we do not collect a separate address.
• Referrals: your invite code, the accounts that joined with it, and your friend-share stage. The amounts and status of your invited friends' rewards are used in aggregate to compute your friend bonus and friend earnings share; you see their nickname, progress toward the bonus and your own share amounts — never their real name, email or survey answers.
• Nickname: a nickname you choose in Profile, or one we generate for you if you do not (an adjective, an animal and a number). It is the only name another member can see: the friend who invited you sees it in their invite list. Your Google display name is not shown to other members, and there are no public profiles or rankings. Nicknames that imitate staff, contain contact details or are abusive are refused. You can change your nickname once every 30 days; it is erased together with your account.
• Survey profile (optional): only if you choose to fill it in — your year of birth (not your full date of birth), your gender (female or male; you can also leave it blank) and your postal code. For countries where a full postal code points to a few houses (for example the United Kingdom, Canada, Ireland, the Netherlands and Brazil) we keep only the first part. Every field is optional; you can change or delete it at any time in Profile → Survey profile. A year of birth showing that you are under 18 is not stored.
• Activity: which surveys, offers and cashback stores you open (partner, time and result), the days you were active, and the progress records built from them — streak, level, badges, the weekly goal and path colour you choose — plus your device time zone so that "today" matches your local day. Used to show your progress, pick your daily tasks and match rewards to you. These records are not rewards and have no cash value.
• Notifications: a push token issued by Firebase Cloud Messaging (Google), used to send you notifications about your rewards, waiting tasks and reminders. You choose which kinds you receive in the app's Notifications screen (rewards and cash-outs, new surveys, next game step, friend invites, announcements and new features) and can also turn each kind off in Android settings. We store your choices, the time you changed them, and whether notifications are enabled on your device, so that we send only what you asked for. Announcements and new-feature notifications are sent only after you switch them on where the law requires consent (the EEA, the United Kingdom, Switzerland and South Korea), and never at night.

2. Research partners

Surveys are provided by third-party partners such as CPX Research, TheoremReach and RapidoReach. When you open a survey, the partner receives a numeric user ID assigned by Bonusboy (not your email) and information you choose to provide inside the survey. Each partner processes that data under its own privacy policy. If you filled in the optional survey profile, we also pass those answers to the survey partners so they can offer surveys that match you, in the way each partner documents: CPX Research receives your year of birth, gender, postal code and country with the survey list request and survey links; TheoremReach receives your gender and postal code through its profile service; RapidoReach receives your gender and postal code with the survey list request. These partners are located outside Korea. If you delete your survey profile, we stop sending it; answers already sent are kept by each partner under its own policy. Game and app offers are provided by Lootably · NoTik · Monlix · Klink Labs · GemiAd: when you open an offer, that partner receives the same internal numeric user ID, and it reports offer completion and app-install events back to us through a server-to-server postback. We use those events only to attribute and credit your reward. Shopping cashback runs through the affiliate networks CJ · Awin · Admitad · Travelpayouts: when you open a store from Bonusboy, the link carries a click reference created by Bonusboy (not your email or name), and the network later reports the purchase amount, commission and status for that reference so we can credit you. The store itself handles your order under its own privacy policy. Gift cards and PayPal payouts are fulfilled through Tremendous, which receives your sign-in email address and the amount; for a PayPal payout that email and amount are passed on to PayPal. Notifications are delivered through Google's Firebase Cloud Messaging, and device integrity is checked with Google Play Integrity.

3. How we use data

• To credit rewards, show your balance and issue gift cards.
• To prevent fraud: duplicate accounts, emulators, reversed completions and abusive withdrawal patterns. Withdrawals are scored automatically; some are reviewed by a person.
• To send transactional emails only: 6-digit verification codes for withdrawals and account deletion. We do not send marketing email. Push notifications cover your own rewards and cash-outs, tasks waiting for you, friend-invite updates and — only if you allow them — announcements; every kind can be switched off in the app.

We do not sell personal data and we do not show third-party advertising inside Bonusboy.

4. Retention and deletion

• You can delete your account from Me → Delete account. Deletion is confirmed by email code and completed within 30 days; any unpaid balance is forfeited.
• After deletion, personal identifiers are anonymized. Reward and withdrawal records are kept in anonymized form for fraud prevention and accounting as required by law.
• Your survey profile is deleted right away when you delete it in the app or request account deletion.
• Security logs (IP, device) are kept for up to 12 months.

5. Permissions

Bonusboy uses the Internet and network-state permissions, and on Android 13 or later asks for the notification permission, which you can decline. It does not request location, contacts, camera, microphone or storage permissions.

6. Children

Bonusboy is for users aged 18 and over. We do not knowingly collect data from children.

7. Your rights

You may request access to, correction of, or deletion of your data at any time by email. Users in the EU/EEA and UK have the rights provided by the GDPR; users in California have the rights provided by the CCPA.

8. Contact

Account and data deletion: see Delete your account and data.

TanzSoft Co., Ltd. · support@bonusboy.com · 1501-Na51, 525 Gonghang-daero, Gangseo-gu, Seoul 07103, Korea