Privacy Policy

1. The personal data we process and why

We process your personal data for the following general purposes:

• To create and administer your Earnly account;
• To build a basic profile so we can show offers that are relevant to you;
• To provide offerwall game offers and rewarded tasks;
• To provide third-party surveys;
• To run features such as the daily check-in, goal progress and the leaderboard;
• To administer your withdrawals of virtual coins via PayPal or, in Sweden, via Swish;
• To send you notifications and important service messages;
• To send you, if you have linked an email address, occasional emails about Earnly and about our other apps, for example new offers, features or app launches; you can opt out of these marketing emails at any time via the unsubscribe link in every such email;
• To reward you for referring friends to Earnly;
• To detect and prevent fraud, abuse and misuse of our service;
• To provide customer support; and
• To comply with our legal obligations and handle possible legal claims.

A detailed, purpose-by-purpose description (including exactly which data we use, our lawful basis and how long we keep it) is set out in the tables in Section 6.

2. The personal data we collect

Information you give us

• Account information. When you first open Earnly we create a guest account for you automatically, using only a device identifier and, where you have allowed tracking, your advertising identifier. You do not need to provide your name, email address or any other personal data to start using the app; your guest account is given an automatically generated display name (for example “Player1234”). If you later choose to link an account, which is required only if you want to withdraw rewards, you can use Sign in with Apple or Google Sign-In. With Sign in with Apple we receive a stable Apple user identifier and, only if you choose to share them, your name and email address, which may be an Apple private relay address. With Google Sign-In we receive your name, email address and your Google profile picture (as a link to the image) from Google. We never see or store a password.
• Payment information. Your PayPal email address, collected when you link PayPal or request a withdrawal, so we can send your payment. When you link PayPal we also receive from PayPal your name, your PayPal account verification status and, where PayPal provides it, your postal address. We use these to confirm your identity for payouts and to help prevent fraud. If you are in Sweden and choose a Swish payout, we collect the Swedish mobile number you have connected to Swish and your Swedish personal identity number (personnummer); Swish requires both so that the payment reaches the right person. We store them encrypted and use them only to send your payouts and to prevent fraud.
• Support messages. If you contact our in-app support, we keep the messages you send us and our replies, so we can help you and keep a record of the conversation. Support conversations that have been closed for more than 180 days are deleted automatically. If our support team enables photo attachments for your conversation, you can also choose to send screenshots; they are stored as part of the conversation and are deleted together with it. To help our support team read and answer messages in many languages, the text of support conversations may be processed by an AI service provider (see Section 4).
• Identity verification (KYC). If your account is selected for identity verification, either due to suspected fraud or as a random spot-check, you may be asked to provide a photo of a government-issued identity document and a selfie with a handwritten note. See Section 6.11 for full details, including what you may cover on the document and how long we keep these photos.

Information we collect automatically

• Device & technical data: a device identifier, your advertising identifier (IDFA) only if you allow tracking in the App Tracking Transparency prompt, IP address, approximate country, device model and operating system, the app version, your time zone, language and connection type.
• Anti-fraud device signals. To protect the rewards system for everyone, on iPhone we use two Apple services. DeviceCheck lets us record on Apple's servers, in two bits tied to your physical device, whether a welcome bonus has already been granted to that device, so the same device cannot claim it again after deleting and reinstalling the app. App Attest gives us a cryptographic confirmation from Apple that requests come from a genuine, unmodified copy of Earnly. Neither service identifies you to Apple or to us beyond your existing account. We also collect your device region and time zone, whether the device appears to be jailbroken, and basic connection information. These signals are used only to detect and prevent fraud.
• Playtime rewards: to operate our game based reward offers, our partner adjoe (Playtime) measures the time you spend in partner games that you install through the Playtime catalog, so your playtime rewards can be credited. On iPhone, Earnly does not read the list of apps installed on your device, and iOS does not allow apps to do so.
• Activity: the offers, surveys and tasks you complete, the coins you earn and spend, your daily check-ins, your leaderboard standing, and your withdrawal history.
• Notification token: a push token issued by your device, used to deliver notifications (only if you allow notifications).
• Diagnostics data: technical information about how the app runs on your device, such as device model, operating system and app version, session timestamps, time zone, mobile carrier and similar stability information. We collect this to keep the app working, reliable and secure, and our notification provider collects it to deliver notifications (see Section 4). Optional crash reporting and analytics are separate and run only if you consent (see Section 7).
• Advertising & analytics data (only if you consent): the ads you are shown and interact with (including rewarded ads you choose to watch for extra coins), and basic app usage and crash-diagnostic events. These are described in Section 7 and are switched off unless you allow them.

Are you required to provide your data?

Some data is necessary to provide the service. A guest account only needs a device identifier, so you can start using Earnly without providing any personal details. However, depending on your country you may need to link an Apple or Google account before you can withdraw rewards, you cannot receive a PayPal payout without a PayPal email, and you cannot receive a Swish payout without the Swedish mobile number connected to your Swish account and your personnummer. Where data is required to perform our contract with you or to meet a legal obligation, this is indicated in the tables in Section 6.

3. Age requirement

Earnly is intended for adults. Users between 13 and 17 may use it only with the permission and supervision of a parent or legal guardian. We do not knowingly collect personal data from children under 13. If we learn that we have, we delete it and close the account. A parent or guardian who believes their child under 13 has used Earnly can contact us at support@blmapp.se.

4. Who we share your data with

We do not sell or rent your personal data. We share limited personal data with categories of service providers and partners so that the app can function. We share only what is necessary for each purpose.

Categories of recipients

We share your data with these recipients only when it is necessary for the purpose described, and our processors are bound by contracts that require them to protect your data and use it only on our instructions.

5. Where your data is processed and international transfers

We and our processors process your personal data primarily within the EU/EEA. However, some of our partners (in particular offerwall partners, survey providers, our AI service provider and certain hosting/infrastructure providers) may process data outside the EU/EEA, including in the United States.

When we transfer your personal data outside the EU/EEA, we do so on the basis of an adequacy decision from the European Commission, the European Commission’s Standard Contractual Clauses, or other appropriate safeguards required by applicable data protection law. You can contact us at support@blmapp.se for more information about these safeguards.

6. Detailed description of our processing

The tables below describe, for each purpose, why we process your personal data, which data we process, our lawful basis under the GDPR, and how long we keep the data.

6.1 To create and administer your account

6.2 To build your profile and show relevant offers

6.3 To provide offerwall offers, surveys and in-app reward features

6.4 To administer your withdrawals via PayPal or Swish

6.5 To send you notifications

6.6 To detect and prevent fraud

6.7 To handle legal claims and meet accounting obligations

6.8 To show ads and reward you for watching rewarded ads

6.9 To measure how the app is used

6.10 To operate the community feed

6.11 To verify your identity (KYC)

6.12 To keep the app working, reliable and secure (diagnostics)

6.13 To provide customer support

6.14 To run the referral programme

7. Advertising ID, tracking and automated decisions

Advertising identifier and third-party SDKs

We use third-party SDKs and services for specific features. These include an offerwall / rewarded-offer provider (which serves the in-app game offers), third-party survey providers, Apple and Google services for sign-in and security, and Google services for advertising. We show ads through Google AdMob (rewarded ads that you can choose to watch for extra coins). When you choose to watch a rewarded ad, we send Google a user identifier and a reward reference so the extra coins can be verified and credited server-side. Our offerwall partner measures the time you spend in partner games installed through its catalog, so it can credit your playtime rewards. The advertising-related identifier on iPhone is the advertising identifier (IDFA), which we and our partners can read only if you allow tracking when iOS asks. You can change that choice at any time under Settings → Privacy & Security → Tracking.

Your advertising and analytics choices (consent)

Advertising is not personalised until you allow it. The first time you open Earnly on iPhone, we briefly explain why we ask, and then iOS shows its own App Tracking Transparency prompt. If you choose “Ask App Not to Track”, we and our partners do not receive your advertising identifier, and ads are shown without personalisation. Your choice has no effect on the coins you can earn or withdraw. You can change it at any time under Settings → Privacy & Security → Tracking.

Referral attribution

On iPhone there is no install-referrer mechanism. A friend who invited you is credited only if you enter their invite code in the app after installing.

Automated decision-making

We use automated processing to match offers and surveys to your profile; this only affects which offers you are shown and does not have legal or similarly significant effects on you. We also use automated checks for fraud prevention (for example checking your IP address against known VPN/proxy sources and verifying device integrity), which in some cases may restrict your account. Under GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you. If you believe such a decision has affected you, you may contact us at support@blmapp.se to obtain human review, express your view and contest the decision.

8. Your rights

Under applicable data protection law you have a number of rights in relation to our processing of your personal data. To exercise any of them, contact us at support@blmapp.se.

• Access and information: to obtain confirmation of whether we process your data and to receive a copy of it.
• Rectification: to have inaccurate data corrected and incomplete data completed.
• Erasure (“right to be forgotten”): to have your data deleted in certain cases.
• Restriction: to ask us to restrict our processing in certain cases.
• Data portability: to receive the data you provided to us in a structured, commonly used, machine-readable format, and to have it transferred to another controller where technically feasible.
• Object: to object to processing based on our legitimate interest, and to object at any time to processing for direct marketing.
• Withdraw consent: where processing is based on your consent, you may withdraw it at any time, without affecting processing carried out before the withdrawal.
• Complaint: to lodge a complaint with a supervisory authority. In Sweden, this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

9. Account deletion and data retention

You can delete your account at any time from within the app (Profile → Delete Account). When you delete your account, your identifying account data is retired so that you can no longer sign in with the same email, and your data cannot be restored.

Please note that certain records are retained even after account deletion: records of the payments we have made to you are kept for up to 7 years to comply with Swedish bookkeeping and accounting legislation, and limited security records may be retained to prevent fraud. Where possible, retained records are kept in a form that cannot be linked back to you as an identifiable person.

10. Data security and breach notification

We use industry-standard measures, including encrypted connections, access controls and secured databases, to protect your personal data. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Swedish Authority for Privacy Protection (IMY) without undue delay and, where feasible, within 72 hours of becoming aware of it, in accordance with GDPR Article 33. Where the breach is likely to result in a high risk to you, we will also inform you directly, in accordance with GDPR Article 34.

11. Your right to know about the personal information we share

In addition to the rights described in Section 8, you have the right to know about the personal information we disclose or share with third parties. Depending on where you live, this right is provided under laws such as the California Consumer Privacy Act and the California Privacy Rights Act in the United States, the Personal Information Protection Act in South Korea, and the Protection of Personal Information Act in South Africa, as well as the GDPR right of access in the EU/EEA.

This means you may ask us to confirm, and to tell you in a clear and understandable form:

• the categories of personal information we have collected about you;
• the categories of personal information we have disclosed or shared with third parties for a business purpose;
• the categories of third parties and recipients to whom that personal information was disclosed or shared, and the business purpose for each disclosure; and
• the categories of sources from which the personal information was collected.

The categories of personal information we share, the categories of recipients we share it with, and the business purpose of each disclosure are set out in the table in Section 4 of this policy. We disclose or share each category of personal information described in that table for the business purpose stated alongside it. We do not sell or rent your personal information, and we do not share it for cross-context behavioural advertising in the sense of a sale.

How to exercise this right

To request this information, contact us at support@blmapp.se. You may make a request free of charge. We will verify your request, normally by confirming control of the email address linked to your account, before we respond. We will respond within the period required by the law that applies to you, and we will not discriminate against you for making a request.

12. California residents (CCPA/CPRA)

This section applies to you if you are a California resident and supplements the rest of this policy. It is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”). Terms such as “personal information”, “sell”, “share” and “sensitive personal information” have the meanings given to them in the CCPA. The data controller responsible for your personal information is BL APPS MANAGEMENT AB (org.nr 559275-3932), Bagartorpsringen 78, 170 65 Solna, Sweden.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are defined under the CCPA. We have not sold or shared the personal information of California consumers in the preceding 12 months, including the personal information of consumers we know to be under 16 years of age (Earnly is intended for adults; see Section 3 for our age requirement).

Categories of personal information we collect

In the preceding 12 months we have collected the following CCPA categories of personal information. For the specific data points within each category, see Section 2.

Categories of sources

• Directly from you, such as when you sign in, link PayPal or enter your Swish details;
• Automatically from your device and your use of the app, such as device and technical data, usage data and activity;
• From third parties acting on our behalf or that you interact with through the app, such as Apple and Google (sign-in), PayPal (payout and verification details), our offerwall and survey partners, our advertising and analytics providers, and our notification provider.

Business or commercial purposes for collecting

We collect personal information for the business and commercial purposes described in Sections 1 and 6, which include: creating and administering your account; building a basic profile and recommending relevant offers and surveys; providing offerwall offers, rewarded tasks and surveys and crediting your coins; running in-app reward features such as the daily check-in, goal progress and the leaderboard; administering PayPal withdrawals; sending notifications and service messages; rewarding referrals; detecting and preventing fraud, abuse and misuse; providing customer support; and complying with our legal obligations. We use your personal information only for the purposes for which it was collected, or for a compatible purpose.

Categories of personal information disclosed for a business purpose, and to whom

The table below shows, for each CCPA category, the categories of third parties to which it was disclosed for a business purpose in the preceding 12 months, if any. This disclosure is not a “sale” or “share” under the CCPA. The categories of third parties are described in full in Section 4.

We disclose personal information to service providers and contractors that are bound by contract to use it only to perform services for us. We also disclose personal information to authorities, advisors or an acquirer where legally required or in a business transfer, as described in Sections 4 and 15.

Your California privacy rights

Subject to certain exceptions, California residents have the following rights:

• Right to know. To request the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting it, and the categories of third parties to whom we disclosed it.
• Right to delete. To request that we delete personal information we collected from you, subject to legal exceptions such as completing a transaction, security, fraud prevention and compliance with our legal obligations.
• Right to correct. To request that we correct inaccurate personal information we hold about you.
• Right to opt out of sale or sharing. You have the right to opt out of the sale of your personal information and of sharing for cross-context behavioral advertising. We do not sell or share your personal information, so there is nothing for you to opt out of, and we do not display a “Do Not Sell or Share My Personal Information” link because it does not apply.
• Right to limit the use of sensitive personal information. You have the right to limit our use and disclosure of sensitive personal information to what is necessary to provide the service. We only use sensitive personal information (your account log-in and, where applicable, an identity-verification photo) for permitted purposes such as authenticating you, securing your account and preventing fraud, so this right does not change how we handle it.
• Right to non-discrimination. We will not discriminate against you for exercising any of these rights.

How to submit a request and how we verify it

You can submit a request to know, delete or correct by emailing us at support@blmapp.se with the subject line “California Privacy Request”. You can also delete your account at any time from Profile → Delete Account in the app.

To protect your information, we will verify your identity before acting on a request. We do this by asking you to make the request from, or confirm, the email address associated with your Earnly account, and we may ask you to provide additional information that matches what we already hold so we can reasonably confirm that you are the person about whom we collected the personal information. We will not use information collected for verification for any other purpose. We will respond within the timeframes required by the CCPA.

Authorized agents

You may use an authorized agent to submit a request on your behalf. We may require the authorized agent to provide proof that you gave them signed permission to act for you, and we may still require you to verify your own identity directly with us or to confirm that you gave the agent permission, as allowed by the CCPA.

If you have questions about your California privacy rights, contact us at support@blmapp.se.

13. Virginia residents (VCDPA)

If you are a resident of the Commonwealth of Virginia, the Virginia Consumer Data Protection Act (VCDPA) gives you the rights described in this section in relation to the personal data we process about you. This section supplements the rest of this policy and controls if there is any conflict with it for Virginia residents.

Categories of personal data we process, and our purposes

The categories of personal data we process, and the purposes for which we process them, are described in Section 1 (purposes), Section 2 (the data we collect) and the detailed tables in Section 6. In summary, we process identifiers such as your name, email address and a device identifier; your advertising identifier (IDFA, only if you allow tracking), IP address and approximate country; device and technical data; the time you spend in partner games installed through the Playtime catalog, reported to verify rewarded game offers; your PayPal email and related payment data; and your activity within the app, such as offers and surveys completed, coins earned and spent, check-ins, leaderboard standing and withdrawal history.

Categories of personal data we share, and the categories of third parties

The categories of personal data we share, and the categories of third parties we share them with, are set out in the table in Section 4. Those categories of third parties include hosting and IT infrastructure providers, a sign-in and identity provider, offerwall and rewarded-offer partners, survey providers, an advertising provider, an analytics and diagnostics provider, a payment provider, a notification provider, a device-integrity and anti-fraud provider, an AI service provider for customer support, and, where legally required or in a business transfer, authorities, advisors or acquirers.

Your VCDPA rights

Subject to the conditions and exceptions in the VCDPA, you have the right to:

• Confirm and access. Confirm whether we are processing your personal data and access that personal data.
• Correct. Correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of the processing.
• Delete. Delete personal data provided by or obtained about you.
• Obtain a copy. Obtain a copy of the personal data you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance.
• Opt out of the processing of your personal data for purposes of (a) targeted advertising, (b) the sale of personal data, and (c) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

Targeted advertising, sale and profiling

We do not sell your personal data for money or other valuable consideration, and we do not engage in profiling that produces legal or similarly significant effects concerning you. We use automated processing to match offers and surveys to your profile, but this only affects which offers you are shown and does not produce legal or similarly significant effects.

You can control processing used for targeted advertising at any time. On iPhone, advertising is personalised only if you allow tracking when iOS asks, and you can change that choice at any time under Settings → Privacy & Security → Tracking, as described in Section 7. To opt out of targeted advertising, the sale of personal data (should our practices ever change), or such profiling, you may also contact us at support@blmapp.se.

How to exercise your VCDPA rights

To submit a request to confirm, access, correct, delete or obtain a copy of your personal data, or to opt out, contact us at support@blmapp.se. You can delete your account and much of your data directly in the app from Profile → Delete Account, and manage your tracking choice under Settings → Privacy & Security → Tracking. We will take reasonable steps to verify your identity before acting on a request, generally by confirming control of the email address associated with your account, and we may ask for additional information where needed to authenticate the request.

We will respond to your request without undue delay and within 45 days of receipt. When reasonably necessary, we may extend that period by an additional 45 days, in which case we will inform you of the extension and the reason for it within the first 45 days. There is no charge for exercising your rights, unless your request is manifestly unfounded, excessive or repetitive, in which case we may charge a reasonable fee or decline to act and will explain our decision.

Your right to appeal

If we decline to take action on your request, we will inform you of the reasons for our decision. You have the right to appeal that decision. To appeal, reply to our decision message or email us at support@blmapp.se with the subject line “VCDPA Appeal”, and include your name, the email associated with your account, and the request and decision you are appealing.

Within 60 days of receiving your appeal, we will review it and inform you in writing of the outcome, together with a written explanation of the reasons for our decision. If we deny your appeal, we will also provide you with a method to contact the Virginia Attorney General to submit a complaint. You can reach the Office of the Virginia Attorney General at https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint.

14. Brazil residents (LGPD)

If you are located in Brazil, the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, Lei No. 13.709/2018, the “LGPD”) applies to our processing of your personal data, in addition to the general information in this policy. BL APPS MANAGEMENT AB is the controller of your personal data for the purposes of the LGPD.

Legal bases for processing (LGPD Art. 7)

We process your personal data only where the LGPD allows it. Depending on the activity, we rely on one or more of the following legal bases: your consent; the performance of a contract or preliminary procedures related to a contract to which you are a party (your Earnly membership and the payment of your withdrawals); compliance with a legal or regulatory obligation; the regular exercise of rights in judicial, administrative or arbitration proceedings; and our legitimate interests, such as preventing fraud and securing the service, provided your fundamental rights and freedoms are respected. The specific basis for each purpose corresponds to the purpose tables in Section 6.

Your rights under the LGPD (Art. 18)

As a data subject under the LGPD, you may request, free of charge, that we:

• confirm whether we process your personal data;
• give you access to your personal data;
• correct incomplete, inaccurate or out-of-date data;
• anonymise, block or delete data that is unnecessary, excessive or processed in a way that does not comply with the LGPD;
• provide your data in a portable format so it can be transferred to another provider or service, subject to our commercial and industrial secrets;
• delete personal data that we process on the basis of your consent, except where the law allows us to keep it (for example to comply with accounting obligations or to defend legal claims);
• give you information about the public and private entities with which we have shared your data;
• give you information about the possibility of not providing consent and the consequences of refusing; and
• let you withdraw a consent you have given, at any time, without affecting processing carried out before the withdrawal.

You can also change your tracking choice at any time under Settings → Privacy & Security → Tracking, as described in Section 7.

How to exercise your rights and contact our person in charge

To exercise any of these rights, or to contact the person in charge of data processing (the encarregado / Data Protection Officer) for BL APPS MANAGEMENT AB, write to us at support@blmapp.se. We do not sell or rent your personal data.

If you believe our processing does not comply with the LGPD, you may also lodge a complaint with the Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD).

15. Business transfers

If BL APPS MANAGEMENT AB, or substantially all of its assets, is acquired by or merged with another company, or in the unlikely event of insolvency, your personal data may be among the assets transferred. In such a case you will be informed before your personal data becomes subject to a different privacy policy, and the acquiring party will be required to continue to process it in accordance with applicable data protection law.

16. Changes to this policy

We may update this privacy policy from time to time, for example to reflect new or changed services, partners or legal requirements. If we make a material change, such as using your personal data for a new purpose or sharing it with a new kind of recipient, we will tell you in the app before the change applies and, where the law requires it, ask for your consent again. Other changes apply from the date shown at the top of this page, so we recommend that you check it from time to time.

17. Contact us and data protection contact

Data protection contact

BL APPS MANAGEMENT AB is the controller responsible for your personal data and is your point of contact for all data protection and privacy matters. We are a small company and are not required under Article 37 of the GDPR to appoint a Data Protection Officer, and we have not appointed one. Instead, we have designated a dedicated data protection contact who is responsible for handling privacy questions, requests to exercise your rights and any other data protection matters.

You can reach our data protection contact at any time using the details below. We aim to respond to data protection enquiries without undue delay and, where the law sets a deadline, within the time required by applicable data protection law.

• Controller: BL APPS MANAGEMENT AB
• Data protection / privacy contact email: support@blmapp.se
• Postal address: Bagartorpsringen 78, 170 65 Solna, Sweden
• Company registration number (org.nr): 559275-3932

General contact

If you have any other questions about this policy, you can also contact us using the same details:

• BL APPS MANAGEMENT AB
• Bagartorpsringen 78, 170 65 Solna, Sweden
• Company registration number (org.nr): 559275-3932
• Email: support@blmapp.se

18. Language

This privacy policy is provided in several languages for your convenience. If there is any conflict or inconsistency between the English version and a translated version, the English version prevails.