Privacy Policy
On this page
1. Who we are
This Privacy Policy describes how ColbyCo Labs LLC, operating as EarnWhile, collects, uses, and protects information.
ColbyCo Labs LLC is a Texas limited liability company, and is the data controller for personal information described in this policy.
You can reach us about anything in this policy at support@earnwhile.app.
2. This website
This site is a static informational website. It has no accounts, no sign-up form, no comment system and no shopping cart.
- We set no cookies. There is no analytics script, no advertising pixel and no third-party tracker on this site.
- We do not ask you for personal information. There is no form to fill in. The only contact route is an email link, and emailing us is entirely your choice.
- Server logs. The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes standard request data — including IP address, user agent, and the page requested — in order to serve the site and protect it from abuse. We do not use this data to build profiles of visitors.
If you email us, we receive whatever you put in that email, and we keep the correspondence for as long as needed to deal with your query and to keep a record of it.
3. The EarnWhile app
EarnWhile is in development and has not been released. It is not available to the public yet, so this section describes what the app does for anyone using a pre-release build today. No earning provider is enabled, and no opportunities are available. We will update it before release if anything changes.
Information you give us
- Email address — to create and sign in to your account. If you sign in with Apple or Google, we receive the identifier and email address that service returns.
- Display name — optional, and shown only to you.
- Preferences — the amount of time you usually have, the opportunity categories you're interested in, your preferred payout method and any weekly goal you set. A stored payout preference does nothing today: cash out is unavailable, and no payout has been processed.
- Your confirmation that you are 18 or older — when you sign in, the app asks whether you are 18 or older. If you answer yes, we store that confirmation, the time you gave it and the version of the wording you saw. We do not ask for or store your date of birth, and we do not verify your age; we rely on your answer. If you answer that you are under 18, nothing is stored and earning is unavailable for that session. Your answer is never sent to an opportunity provider.
Information collected automatically
- Device model and operating system version — to support the app and detect abuse.
- A device identifier we generate — see the next section.
- Activity within the app — which opportunities you view, start and complete, so we can show your progress, credit rewards correctly, and improve how opportunities are ranked. No earning provider is enabled, and no opportunities are available, so there is nothing to view, start or complete today. We do not send this activity record to opportunity providers; section 7 describes what a provider does receive.
Information used only on your device
Your country and language are read from your device settings and used locally to work out which opportunities you're eligible for. Your cached opportunity list is stored on your device. This information is not transmitted to us as part of that process, and we do not send it to opportunity providers; a provider works out your location from your IP address, as described in section 7. No earning provider is enabled, and no opportunities are available, so no such sharing happens today.
4. Device identifier
When the app first runs, it generates a random identifier for your device and stores it in the iOS Keychain. It is not Apple's advertising identifier, it is not the vendor identifier, and it cannot be used to link you across other companies' apps.
We use it to associate your account with the devices you sign in from, which is one of the signals that helps us detect fraudulent reward claims.
One thing worth knowing: because it lives in the Keychain, this identifier survives deleting the app. If you delete EarnWhile and reinstall it, the same device identifier is used. That is deliberate — it is part of what makes it useful against repeat abuse — but most people assume deleting an app resets everything, so we would rather say it plainly. Deleting your account clears it from your device and removes our record of it — see section 8.
5. Advertising and tracking
The app does not track you across other companies' apps or websites. It does not use Apple's advertising identifier (IDFA), and it contains no advertising SDK, no analytics SDK and no attribution SDK.
If that ever changes — for example if an opportunity provider requires attribution to credit you correctly — we will update this policy, and iOS will ask for your permission through the standard App Tracking Transparency prompt before anything of that kind happens.
6. Service providers
We keep this list short on purpose. At present it is:
- Supabase — authentication, database and backend hosting for the app.
- Cloudflare — hosting and protection for this website.
- Apple — App Store distribution, and Sign in with Apple if you use it.
- Google — only if you choose to sign in with a Google account.
These providers process information on our instructions in order to deliver their service. We do not sell personal information, and we do not share it for cross-context behavioral advertising.
7. Opportunity providers
No earning provider is enabled, and no opportunities are available. Provider integrations are built into EarnWhile, but each one is switched off on our servers, so no opportunity, survey or reward activity is sent to any opportunity provider today. This section describes what happens when a provider is switched on. We will name each provider here before we enable it; that list is empty today.
What a provider receives from us. To ask a provider which opportunities are open to you, and so that it can credit you when you finish, our servers send it:
- a reference identifier we generate for you, specific to that provider. It is a random value, not your name, email address or account ID;
- your IP address, which providers use to work out your location, decide eligibility and detect fraud. We do not send a country or language setting;
- a session identifier we generate, so the provider's report of a completion or a reversal can be matched to the right session.
We do not send a provider your name, your email address, your account ID, the device identifier described in section 4, or your confirmation that you are 18 or older.
What a provider sees directly. When you start an opportunity, it opens in a browser window inside the app, on the provider's site. From that point the provider receives what any website receives from a visitor — your IP address and information about your device and browser — along with anything you enter there. Their privacy policy governs what they collect. We will identify the provider before you start.
What a provider sends us. Providers report completions and reversals back to our servers, using the reference and session identifiers above, together with the reward amount and, for some providers, the IP address they recorded. We keep those reports to credit rewards, apply reversals and reconcile with the provider — see section 8.
8. Retention and deletion
We keep account information for as long as an account exists. Support emails are kept for as long as we need them to handle a query and keep a record of it.
You can delete your account in the app, from Profile. EarnWhile is in development and has not been released, so today this applies to anyone using a pre-release build. If you cannot use the app, email support@earnwhile.app.
Deleting your account cannot be undone. When you confirm, we:
- clear your profile — your display name, email address, location and avatar are removed from it;
- remove your saved preferences and any weekly goal;
- remove the record of which opportunities you viewed, opened and started, and any personalized opportunity links prepared for you;
- remove the list of devices signed in to your account, and clear the device identifier described in section 4 from your device;
- remove your stored confirmation that you are 18 or older;
- disable sign-in. Your sign-in record is kept but blocked, its email address is replaced with a placeholder, its sessions are ended, and the link to your Apple or Google account is removed. If you signed in with Apple, the app asks you to confirm with Apple so that we can also ask Apple to disconnect EarnWhile from your Apple Account. If that step does not happen, your account is still deleted, and the app tells you how to remove EarnWhile from your Apple Account in Settings yourself.
What we keep. Some records stay after deletion, under the internal account reference — a random identifier — that your account used: records of rewards, reversals and payouts; the reports opportunity providers send us about your activity, which we need to match a late completion or reversal to the right account; the provider reference identifiers issued for your account, marked as revoked; fraud and security review records; and a record of the deletion itself, holding that reference, timestamps and counts of what was removed. These records are not anonymous: they remain linked to that internal reference, and the deletion record can be read from the account it belongs to. The sign-in record the reference points to is disabled and no longer carries your name or email address.
Retention periods. Our retention policy sets 7 years for financial records and 2 years for fraud and security evidence. Those are policy periods, not deadlines: nothing is deleted automatically when they end. What happens to these records after those periods, and the legal basis for keeping them, has not been settled, and we will update this section when it is.
Your balance. Deleting does not automatically cash out available or pending rewards, and deletion ends your normal access to any remaining balance. The app shows the amount before you confirm. If a payout request is in progress, we refuse the deletion until it has finished or failed, and the app says why. Cash out isn't available yet, so today no balance can be withdrawn before deleting.
9. Your rights
Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected, to have it deleted, to receive a copy in a portable format, and to object to or restrict certain processing. Residents of California, and residents of the EU and UK, have specific rights under their own laws.
Email support@earnwhile.app and we will respond within the timeframe the applicable law requires. We will not discriminate against you for exercising any of these rights.
10. Children
EarnWhile is for adults. The app asks every user to confirm that they are 18 or older, as described in section 3; it does not verify that answer, and it does not collect a date of birth. Anyone who answers that they are under 18 cannot use earning features in that session, and that answer is not stored. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.
11. Security
Account data is held in a database with row-level access rules, so one account cannot read another account's data. Balances and reward records are written only by our backend — the app itself has no ability to alter them. Traffic between the app and our backend is encrypted in transit.
No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information, we will notify you as required by law.
12. Changes to this policy
We will update this page when our practices change, and always before the app is released. The “last updated” date at the top shows the current version. Material changes will be communicated in the app.
13. Contact
ColbyCo Labs LLC
United States
support@earnwhile.app