Privacy Policy

This Privacy Policy explains how FloxEarner ("we", "us", "our") collects, uses, discloses, and safeguards your information when you use our website and services. Please read this policy carefully to understand our practices regarding your personal data.

1. Information We Collect

1.1 Information you provide

We collect the following information when you create an account or use our services:

• Phone number: Used as your unique account identifier and for login.
• Full name: Must match the name on your bank account for withdrawals to process. Used for identity verification and payment processing.
• Password: Stored as a one-way bcrypt hash — we cannot see your plaintext password.
• Security question and answer: Used for account recovery if you forget your password. The answer is stored as a one-way hash.
• Bank account details: Bank name, account number, and resolved account name — collected only when you request a withdrawal.
• Referral code: If you were referred by another user, the referral code you entered at signup is recorded to credit the referrer.

1.2 Information collected automatically

• IP address: Collected at signup, login, activation, task completion, and withdrawal requests. Used for fraud detection and account security.
• User agent: Browser and device type, collected for session tracking.
• Usage data: Login times, task completion records, transaction history, and withdrawal requests.

1.3 Information from payment processors

When you activate a plan, Paystack processes your payment and shares the transaction reference, amount, and status with us. When you request a withdrawal, Flutterwave processes the transfer and shares the transfer reference and status with us. We do not see or store your card details — those are handled entirely by Paystack's PCI-DSS compliant infrastructure.

2. How We Use Your Information

We use your information for the following purposes:

• Account management: Creating and maintaining your account, authenticating your login, and recovering access when you forget your password.
• Processing payments: Collecting activation fees via Paystack and sending withdrawals via Flutterwave.
• Fraud prevention: Tracking IP addresses to detect multi-accounting, referral farming, and other abusive behavior.
• Payout verification: Resolving your bank account name via Flutterwave and confirming it matches your registered name before processing withdrawals.
• Service delivery: Crediting daily login bonuses, task payouts, and referral bonuses to your wallet balance.
• Communication: In-app notifications about your account, transactions, and platform updates.
• Legal compliance: Responding to lawful requests from Nigerian authorities and complying with applicable regulations.

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contractual necessity: To provide the account and earning services you requested.
• Legal obligation: To comply with Nigerian financial regulations and lawful government requests.
• Legitimate interest: To prevent fraud, secure our platform, and maintain the integrity of our referral and payout systems.
• Consent: You consent to this data processing when you create an account and use our services.

4. Data Sharing and Disclosure

We do not sell your personal information. We share data only with the following parties:

• Paystack: Receives your phone number (as email placeholder), activation amount, and payment reference when you pay an activation fee.
• Flutterwave: Receives your bank account number, bank code, payout amount, and reference when you request a withdrawal. Flutterwave resolves your account name and returns it to us for verification.
• Hosting provider (Vercel): Hosts our website and may log standard request metadata (IP, user agent) for security and performance.
• Database provider (Turso): Stores your account and transaction data in encrypted form.
• Law enforcement: We may disclose information in response to lawful requests from Nigerian authorities, or where we believe it is necessary to prevent fraud, protect our users, or comply with legal obligations.

5. Data Retention

We retain your personal data for as long as your account is active. Specifically:

• Account data: Retained until you request account deletion.
• Transaction records: Retained for 7 years for accounting and regulatory purposes, even after account deletion.
• IP logs: Retained for 12 months for fraud analysis, then automatically deleted.
• Session data: Deleted automatically 30 days after last login (user sessions) or 7 days (admin sessions).

To request account deletion, contact FloxEarner Support through the support portal. We will delete your personal data within 30 days, except where retention is required by law.

6. Cookies and Session Tracking

We use only essential cookies. We do not use advertising or third-party tracking cookies.

• flox_session: Identifies your logged-in session. Expires after 30 days of inactivity. HttpOnly, Secure, SameSite=Lax.
• flox_admin_session: Identifies admin sessions (only set on the admin portal). Expires after 7 days. HttpOnly, Secure, SameSite=Lax.

We do not use cookies for advertising, analytics, or third-party tracking. Your browsing activity on FloxEarner is not shared with advertisers.

7. Data Security

We implement industry-standard security measures to protect your data:

• Password hashing: All passwords are hashed with bcrypt (10 rounds) before storage. We cannot see your plaintext password.
• HTTPS encryption: All traffic between your browser and our servers is encrypted with TLS.
• PCI-DSS compliance: Card payments are processed by Paystack, which is PCI-DSS Level 1 certified. We never see or store your card details.
• IP-based fraud detection: We limit account creation to 3 per IP address and flag suspicious referral patterns for review.
• Bank name verification: Withdrawals are only processed to bank accounts whose resolved name matches your registered name.
• Session security: Sessions are tied to opaque tokens (32 random bytes) and stored as HttpOnly cookies to prevent XSS-based theft.

Despite our safeguards, no system is 100% secure. If a data breach occurs, we will notify affected users within 72 hours via in-app notification and email (where available), in accordance with applicable law.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure: Request deletion of your account and personal data.
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interest.
• Right to withdraw consent: Withdraw consent at any time, though this may prevent you from using certain features.

To exercise any of these rights, contact FloxEarner Support through the support portal. We respond to all valid requests within 30 days.

9. Children's Privacy

FloxEarner is not directed to individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected data from a minor, we will delete it promptly. If you believe we have collected data from your child, please contact us immediately.

10. International Data Transfers

FloxEarner operates in Nigeria. Your data may be processed on servers located outside Nigeria (including Vercel's global CDN and Turso's database infrastructure). By using FloxEarner, you consent to the transfer of your data to these countries, which may have different data protection laws than Nigeria. We take reasonable steps to ensure your data is protected in accordance with this policy regardless of where it is processed.

11. Third-Party Links and Services

Our services may contain links to third-party websites or integrate with third-party services (such as CPA task providers, ad networks, and the payment processors mentioned above). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing them with any personal information.

When you complete a CPA task, you may be redirected to a third-party website (such as an app store, survey provider, or advertiser). Any information you provide to those parties is governed by their privacy policies, not this one.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes that affect your rights, we will provide notice through the app or by other reasonable means before the changes take effect. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact FloxEarner Support through the support portal. Select "Privacy Policy Inquiry" as the category when submitting your ticket.

We are committed to resolving any privacy-related concerns promptly and transparently.