Privacy Policy

OttiLoot (“we”, “us”, “our”) operates a rewards platform where users complete game offers to earn points redeemable for digital gift cards. This policy explains what personal information we collect, how we use it, who we share it with, and the choices and rights you have. By creating an account or using OttiLoot, you agree to this policy.

Information you provide

When you create an account we collect your email address. Your password is handled by our authentication provider and is stored only in encrypted (hashed) form — we never see or store it in readable form. We also store the reward goal you choose.

Information we collect automatically

As you use the service we generate activity data — offers you click, completions credited to you, and points earned, held, and redeemed (your transaction history). For security and fraud prevention we also collect limited technical data when you sign in, click an offer, or redeem a reward: your IP address, browser/device information (user-agent), and a device identifier (“fingerprint”) generated by a third-party library. We use the device fingerprint solely to detect duplicate accounts, bots, and fraudulent redemptions — not for advertising or analytics.

How we use your information

We use your information to operate the service, credit your rewards, process and deliver redemptions, prevent fraud and abuse, secure accounts, comply with legal obligations, and send you service-related emails. We do not use it for behavioral advertising.

Cookies, analytics & Do Not Track

We use essential cookies needed to keep you signed in and to operate the service. We do not use third-party analytics, advertising, or behavioral-tracking tools, and we do not use remarketing or retargeting services. Because we do not track users across third-party websites, we do not respond to browser “Do Not Track” signals differently — there is no cross-site tracking to disable. We use Cloudflare Turnstile to tell humans from bots at sign-in; it processes limited technical signals for that purpose only.

No ads, no sale of data, no payments

We do not display third-party advertising networks on OttiLoot. We do not sell or rent your personal information to anyone, and we do not share it for cross-context behavioral advertising. OttiLoot does not sell products or services to users and does not collect payment-card or banking information from you — you never pay us.

Emails we send

We send transactional, service-related emails only — for example, account confirmation, password reset, and reward delivery. We do not send marketing or promotional email unless you separately opt in.

Advertising & offer partners

We work with offerwall and advertising networks (such as AyetStudios) to provide game offers. When you engage an offer, we share the data needed to attribute and credit your completion — this includes a unique identifier for your account, your IP address, browser/device information, and similar technical signals — so the partner can match offers to you and confirm completions. These partners process data under their own privacy policies.

Reward fulfillment

Gift-card redemptions are fulfilled by third-party providers (such as Reloadly). We share the minimum data required to deliver your reward — typically your email address and the reward you selected.

Service providers

We rely on infrastructure providers to run OttiLoot, including hosting, database and authentication, email delivery, and bot/fraud protection (for example Supabase, Vercel, Resend, and Cloudflare). These providers process data on our behalf under contractual confidentiality and security obligations.

Data retention

We retain your information for as long as your account is active and as needed to provide the service, resolve disputes, prevent fraud, and meet legal and record-keeping obligations. You may request deletion as described below.

Your privacy rights (GDPR / EEA & UK)

If you are in the European Economic Area or the United Kingdom, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. Our lawful bases for processing are: performance of our contract with you (operating your account and rewards), our legitimate interests (security and fraud prevention), and compliance with legal obligations. You may withdraw consent where processing is based on consent, and you may lodge a complaint with your local supervisory authority. To exercise these rights, contact us at the address below.

California privacy rights (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access to and deletion of your personal information, to correct inaccurate information, and to not be discriminated against for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioral advertising. The categories of personal information we collect are described above (identifiers such as email and IP address, internet/usage activity, and a device identifier used for fraud prevention). To exercise your rights, contact us at the address below; we may need to verify your identity before responding.

Children’s privacy (COPPA)

OttiLoot is intended only for users aged 18 or older (or the age of majority where they live) and is not directed to children. We do not knowingly collect personal information from children under 13, or from anyone under 18. If we learn that we have collected information from a child, we will delete it and close the account. If you believe a child has provided us information, please contact us immediately.

Security

We use technical and organizational measures to protect your information, including encrypted credentials, access controls, and server-side enforcement of all balance and reward operations. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

International users

We operate primarily in the United States, and your information may be processed in the United States and other countries where our service providers operate. By using OttiLoot you understand your information may be transferred to and processed in those locations.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “updated” date above, and continued use after changes constitutes acceptance.

Contact us

For any questions about this policy or to exercise your privacy rights, email us at support@ottiloot.com.