Pre-launch draft · not yet reviewed by a lawyer. Questions: contact@plytzo.com
Plytzo — Privacy Policy
Version: 2026-09-28 · Status: PRE-LAUNCH DRAFT. This policy was written to match how the Plytzo app and servers actually work today. It has not been reviewed by a lawyer and is not legal advice. It will be reviewed before Plytzo is opened to the public.
1. Who we are
Plytzo is a rewards app for gamers, developed under the working brand Zafreya. Zafreya is not yet a registered company; until it is, "we", "us" and "Plytzo" mean the individual developer who runs Plytzo.
Contact for anything in this policy: contact@plytzo.com (see section 15).
Plytzo is an independent product. It is not made, endorsed, sponsored or affiliated with Roblox Corporation or any other brand mentioned in the app.
2. Who can use Plytzo
Plytzo is only for people 13 years old or older. It is not designed for or directed at children under 13, and we do not knowingly let anyone under 13 create an account. When you sign up we ask you to confirm that you are 13 or older. We do not ask for your date of birth.
If you are between 13 and 17, please read this policy with a parent or guardian and only use Plytzo if that is allowed where you live.
Some sponsored-activity providers set their own minimum age, which can be higher than ours (see section 7). If we learn that an account belongs to someone under 13, we will close it and delete or de-identify the personal data linked to it as described in section 10.
3. Information you give us
- Email address and password — used to create your account and sign in. Your password is handled by Firebase Authentication (Google); we never see or store it.
- Username — a name you choose to show in the app. Please do not use your real name.
- Confirmation that you are 13 or older — a yes/no answer, not your birth date.
- Creator / referral code (optional) — if you type one during sign-up we store it. Referral rewards are not active yet.
- Your acceptance of our documents — we store which version of the Terms and this policy you accepted and when (not the document text).
We do not ask for your real name, address, phone number, school, date of birth, ID documents, payment card or bank details, photos, contacts or location. Plytzo never asks for your Roblox password, Roblox cookies, or the password of any game or other account, and you never need to sign in to Roblox inside Plytzo.
4. Information created when you use Plytzo
- Account identifier — Firebase creates an internal user ID (UID) for your account. It identifies your account in our database.
- Points and history — your balance (available and pending points, and any points debt from reversed activities) and every transaction: points earned, confirmations, reversals, redemptions and refunds. For each sponsored activity we also store how its points were calculated (the provider's reported revenue and the points policy version used).
- Sponsored-activity records — when a provider reports an activity you completed, we store the provider's transaction ID, the status (pending, approved, rejected), the offer name and ID, the time, the provider's reported revenue for that activity, the country code the provider reports, and technical IDs of the report. We use these to credit, confirm or reverse your points.
- Redemption records — which reward you requested, its cost, status and delivery details.
- Account status — for example whether a deletion was requested.
5. Information collected automatically
- Network address (IP) — our servers receive your IP address when the app talks to them. For fraud prevention we keep only a salted hash of a shortened version of it (the network prefix), not your full IP. Our cloud provider's request logs may also record the IP address and the app's user agent for a limited time (see section 9).
- App installation ID — when you request a redemption, the app sends a Firebase installation ID (a random ID for this install of the app, reset if you reinstall). We store only a salted hash of it.
- Security signals — derived from the above, for example whether many accounts share one device or network, account age, and unusual redemption patterns.
- App integrity check — Firebase App Check with Google Play Integrity tells our servers whether a request came from a genuine copy of the app. We keep only aggregate counts.
- Technical data processed by Google to operate sign-in, the database and our server functions.
Plytzo does not include advertising, analytics or crash-reporting SDKs, and the Plytzo app does not use your device's advertising ID.
6. How we use information
- To run your account — sign-in, your balance and your history.
- To credit sponsored activities — match a provider's report to your account and add, confirm or reverse points.
- To process redemptions — check your balance and eligibility and handle the reward.
- To prevent fraud and abuse and keep Plytzo secure — for example detecting multiple accounts, automated activity, tampered apps or abnormal patterns.
- To keep records we need — for disputes with providers, reversals, accounting and security investigations.
- To contact you about your account if necessary. We do not send marketing.
We do not sell your personal information and we do not use it to show you ads.
7. Sponsored-activity providers
Points come from activities (offers, games, surveys) run by independent third-party providers. Each provider is responsible for its own service and has its own privacy policy.
Lootably (offerwall, currently the provider available in the app)
- When you open Earn → Offers, Plytzo opens Lootably's offerwall website in a browser tab. The only Plytzo information we include is your account UID, so Lootably can tell us which account completed an activity.
- Once the offerwall is open you are using Lootably's website. Lootably and the advertisers behind each offer can collect information such as your IP address, device and browser details and cookies, and they may ask you for other information inside an offer. Lootably's privacy policy is at privacy.lootably.com. That policy says Lootably does not knowingly collect data from or market to children under 18, and that people who use its services represent that they are 18 or older, or the parent or guardian of a minor who consents to the minor's use.
- When you complete an activity, Lootably sends our server a report with your UID, a transaction ID, the offer, its status, the reported revenue, your country code and your IP address. We store the fields listed in section 4; we do not store the IP address from these reports.
Other providers — Plytzo currently works with Lootably only. If we add another provider in the future, we will update this policy before it is available in the app.
A provider can report that an activity was rejected, invalid or reversed. That can remove pending points or reverse points already credited (see the Terms).
8. Service providers and other sharing
- Google (Firebase and Google Cloud) — sign-in (Firebase Authentication), database (Cloud Firestore), server code (Cloud Functions), app integrity (App Check / Play Integrity) and app installation IDs (Firebase Installations). Data is processed on Google's infrastructure in the United States.
- Cloudflare — handles our domain and forwards emails sent to our contact address.
- Reward partners — no real reward is being delivered yet. Before we deliver one through a partner, we will update this policy.
- Legal reasons — we may disclose information if the law requires it or to protect users, Plytzo or others from fraud or harm.
9. How long we keep information
- Account data (email, username, referral code) — while your account exists. Removed when you delete your account (section 10).
- Points, transactions, redemptions and provider records — kept while your account exists and, after deletion, kept linked only to your internal UID for a limited period for fraud prevention, provider disputes and reversals, accounting and security. Our current internal target is 365 days; the final period is subject to legal and tax review.
- Security data — most security records carry expiry dates between 7 and 365 days (for example network links 7 days, device links 30 days, security events 90 days).
- Important: automatic deletion based on these expiry dates is not switched on yet, so records are currently deleted manually or when the automatic process is enabled. We will enable it before public launch.
- Cloud request logs kept by Google Cloud for our project are retained for the period set in our Google Cloud logging configuration.
10. Deleting your account
You can delete your account in the app: Profile → Delete account. You can also follow the instructions at plytzo.com/delete-account or email contact@plytzo.com from the email address on the account.
When you delete your account:
- earning and redeeming stop immediately;
- all your points (available and pending) are forfeited;
- your email, username and referral code are removed from our database, and your sign-in account is deleted from Firebase Authentication;
- your live security profile is deleted and your account is removed from our device and network links;
- we keep a minimal record: your internal UID with your transaction, redemption and provider records, security events that have not expired yet, your account creation date, your 13+ confirmation, and which document versions you accepted. These records are no longer connected to your email or username. We keep them only for the purposes and period in section 9.
Deleting your Plytzo account does not delete data held by Lootably or advertisers. To ask them, use the contacts in their privacy policies.
11. Security
We use Firebase Authentication, server-side checks, database rules that stop the app from reading other people's data or changing balances, rate limits and fraud checks. Your points are managed on our servers: changing the app cannot change your balance. No system is perfectly secure.
12. Your choices and rights
- You can see your balance and history in the app and delete your account at any time.
- To change your username or email, or for any other request (for example a copy of your data), email contact@plytzo.com. We will respond within a reasonable time and may need to confirm that the account is yours.
- Depending on where you live you may have additional legal rights. We do not claim that this draft meets the requirements of any specific privacy law (for example GDPR, UK GDPR, CCPA/CPRA or COPPA); that review will happen before public launch.
13. International processing
Our database and servers run on Google Cloud in the United States. If you use Plytzo from another country, your information is processed there. Lootably and advertisers process data under their own policies and locations.
14. Changes to this policy
When this policy changes, we update the version and date at the top. For important changes, the app asks you to review and accept the new version before you can keep using Plytzo.
15. Contact
- Product: Plytzo · Developer (working brand): Zafreya
- Email: contact@plytzo.com
- Website: plytzo.com