Privacy policy in plain language.

We do not sell your data, and we do not share it for anyone else's advertising.

The only permission the app asks you for is permission to show notifications, and you can say no. Android also lists permissions the app and its Google ad and messaging libraries declare without asking you, such as internet access, the advertising ID, receiving push messages and restoring reminders after a restart. We do not use any of them to read your contacts, location, camera, microphone, files or clipboard.

We do not read your installed apps.

On this website we count visits without cookies. Microsoft Clarity loads only after you say yes if you are in the EU, EEA, UK or Switzerland, and you can switch it off anywhere. If you join the waitlist, we use your email address to write to you once, when LevelLark is on Google Play.

You can delete your account yourself, in the app. Your coin ledger and payout records are kept afterwards, because they are the accounting record behind money we paid out — but they are no longer attached to your name or email.

Every account has a random user ID. Everything else we hold is attached to that ID.

If you play as a guest, that is all there is. No name, no email, no password — a guest account is anonymous to us.

If you sign in with Google we store your name, email address and profile image from your Google account, along with your Google account identifier and the access and refresh tokens Google issues so you stay signed in. Google sign-in is the only sign-in method. We never ask for or store a password.

We store a record of each sign-in session, which includes the IP address and the app or browser user agent it was created from. Sessions expire, and they are deleted when you sign out or delete your account.

Your profile holds your coin balance, any amount held against a pending withdrawal, your XP and level, your referral code, who referred you if anyone, your time zone, a reward region tier, and whether the account is restricted and why.

When the app starts it registers your device. We store a device identifier, the device model, whether the device reports as an emulator, whether it reports as rooted, your language and region setting, your time zone, the IP address the request came from, and the time we last saw it.

On Android the device identifier is the Android ID your device already provides to apps. It is not your advertising ID, and we do not link the two. On any other platform it is a random ID generated on first launch that never leaves that install.

We record which accounts a device has been used on, and we keep the last IP address each device connected from. Both are used to detect one person running several accounts, and to rate-limit abuse. This is described in full under "Keeping it fair" below.

We derive a reward region tier from the country your connection reports, or failing that from your language setting. We store only the tier — a number from one to three. We do not store your country, your city, or any location.

Every coin that moves is a ledger entry recording the amount, what caused it, a short note, a reference to the game, ad or withdrawal behind it, and the time. Entries are linked by a hash chain so history cannot be edited after the fact. The ledger is how your balance is calculated, so it has to be complete.

We store your game sessions: which game, the seed it was generated from, when it started and finished, whether you won, your score, the coins awarded, and the result your device submitted. We store task progress, your daily streak, badges earned, how many free spins and scratch cards you have used today, your answers and votes on Feed posts and your Feed streak, and your referrals in both directions.

We record anti-fraud flags against an account — for example that a device reported as an emulator or as rooted, or that a referral was attempted between two accounts that share a device.

If you allow notifications, our server sends push notifications to your phone: reminders about your streak, daily draws and goals; notes on your progress, such as your level, goals and weekly play; news when a friend plays your challenge or reaches level 2; and new games and updates, only if you turn on What's new. Some reminders are instead scheduled on your phone itself and never reach our server.

To send them we store your device's push token (the address Google issues so a notification can reach this install), the app build that registered it, and when it was registered and last seen. We keep a record of each notification we decide to send: its type, which game, level or badge it was about, the day and time, whether Google accepted it, whether you opened it (by tapping it, or by opening the app soon after it arrived) or chose Later, and which wording and picture it used. We also store your notification settings and the time you last opened the app.

We choose when to send and what to say from your own play: your streak, level, goals, daily draws, badge progress, recent scores, the games you played most or last, the hour you usually play, your time zone, how long you have had the account, when you last opened the app, and whether you opened or ignored earlier notifications. There is a daily limit, a minimum gap between most notifications, and none at night (currently 10 pm to 8 am in your time zone, or India time until the app has reported your time zone).

Notifications are delivered by Google Firebase Cloud Messaging, which receives the push token, the notification's title and text, the address of its picture if it has one, and routing details: which screen or game it opens, its type, and a reference number our server uses to record that you opened it. Pictures are loaded by your phone from our image hosting on Cloudflare.

You control this in the app, under Profile: the Reminders switch turns notifications off, and Daily reminders, Your progress, What's new and Friends switch each kind separately. You can also block them in your Android settings. Turning Reminders off, or signing out, asks our server to remove your push token; blocking notifications in Android settings does the same the next time you open the app.

When you request a withdrawal we store the method, the coin amount, the payout amount at the conversion rate at the time, the status, and the payout identifier you entered. That identifier is whatever the method needs — a UPI ID, a Paytm number, a PayPal email, or a wallet address.

We store who reviewed the request, when, and any note attached to the decision.

A person reviews every request. During review, staff can see your balance and ledger history, your devices and their last IP addresses, your fraud flags, your past withdrawals, and the name and email on the account. Every action staff take on an account is recorded.

Ads are served by Google AdMob and operate under Google's privacy policy, not this one. AdMob uses your device's advertising ID and ad interaction data and may personalise the ads you see. This is why the app declares the advertising ID permission.

When you start a rewarded ad, we send Google your user ID and a one-time ad session ID so the view can be verified. Google signs a confirmation and sends it back to our server, and only then is the view recorded. Watching an ad never gives coins; rewarded ads give in-app boosts only. We store the ad session, the ad unit, its status and Google's transaction ID.

We do not build advertising profiles, and we never pass your activity, balance or payout details to any ad network.

In the EU, the EEA, the UK and Switzerland the app shows Google's consent message before any ad loads, and you can change your answer at any time under Profile, Ad privacy choices. Wherever you are, we limit ads to Google's T (teen) content rating or milder.

The Android app sends product analytics to Google Firebase Analytics — which screens are opened, which games are finished, when a withdrawal is submitted. The app does not send anything to PostHog or Clarity. What this website collects is described under "Website visitors" below.

These events are drawn from a fixed list defined in the app, and they are not tied to your account: we never set a user identifier on the analytics sink. Before an event is sent, any field whose name suggests personal data — email, name, phone, IP, address, payout identifier, token, cookie, password, referral code or device ID — is stripped.

There is no other analytics, crash-reporting or attribution service in the app. The app has no PostHog, no Sentry and no advertising SDK other than AdMob.

This section covers the website, levellark.app, not the app. When you open a page we record its address without anything after a ? or #, the website you came from (also without a query string), any campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content), your operating system, browser, screen size, language and time zone, and an approximate location (country, region and city). We also record which buttons you press, such as Get notified or Email support. A referral code in an invite link is replaced with an asterisk before anything is sent to PostHog.

We use PostHog, on its US cloud, to count visits and to see which pages and buttons people use. PostHog sets no cookies and stores nothing in your browser: it keeps its identifier in memory only, so it cannot recognise you from one visit to the next, and reloading a page starts a new anonymous visit. We do not use session recording, autocapture, heatmaps or advertising profiles. We read the results in aggregate, to improve the site and to understand where visitors come from. Our basis is legitimate interest.

Your IP address reaches PostHog in the request, as it does for any website. PostHog uses your IP address to work out an approximate location and does not keep it.

Microsoft Clarity is off unless we switch it on. When it is on, visitors in the EU, the EEA, the UK and Switzerland, and visitors whose country we cannot tell, see a small banner and Clarity loads only after they press Accept; if they press No thanks or ignore the banner, it does not load. Visitors elsewhere get Clarity without a banner, and can turn it off at any time with the Cookie choices link in the footer. We work out the country from Cloudflare's country header for the visit, once per session, and do not store it. Clarity does not load on invite pages, and the invite code there is masked. Clarity sets cookies and records anonymised screen activity, such as clicks and scrolling, so we can see where people get stuck. The email box is masked. We keep a saved choice in your browser's local storage under the name levellark-consent, and a saved No thanks always wins. Choosing No thanks in Cookie choices takes effect on the next page you open; cookies Clarity has already set stay until you clear them in your browser. Clarity operates under Microsoft's privacy statement.

If your browser sends Do Not Track or Global Privacy Control, the website loads neither PostHog nor Clarity and shows no banner.

For the length of one visit, the website keeps the campaign tags and the page you came from in your browser's session storage, so they can be attached to a waitlist sign-up if you make one. It is cleared when you close the tab and is never sent anywhere otherwise. The only other thing the website keeps in your browser is your light or dark choice.

The admin console that we use to run the service loads no analytics.

LevelLark is not on Google Play yet, and the website has a waitlist. If you leave your email address we store it with the part of the site you signed up from (the header, home page, games page or an invite page), the campaign tags and the page you came from on that visit (the website and path only), the page you landed on, an approximate country, and the time. We do not store your IP address or your browser details with it. Invite pages are recorded only as /r, without the code.

We use it for one thing: to send you one email, on the day LevelLark is on Google Play. We do not add you to any other list, we do not share the address with anyone, and we do not sell it.

You give us the address so that we can tell you about the launch. We do not check that an address belongs to the person who typed it, so we send only that one email. You can remove yourself at any time by writing to support@levellark.app, and we will delete it.

We keep it until you ask us to remove it, or until we delete the list after launch.

If website analytics is on when you sign up, the sign-up is given a random ID, and that ID is attached to your visit in PostHog so the visit can be matched to your sign-up record. That makes the history pseudonymous, not anonymous. Removing a sign-up does not remove that analytics history. We do not currently set a deletion schedule for analytics events. The email address itself is never sent to PostHog or Clarity.

The list is stored in our database with the rest of our server data, on Render, and is reached through Cloudflare. Both act on our behalf.

We do not read your contacts. We do not read the list of apps installed on your device. We do not collect your location. We do not use your camera or microphone, and we do not read your files, photos or messages.

We do not read your clipboard. The app only ever writes to it, when you tap to copy your referral code.

We do not ask for your phone number, your date of birth, or any identity document.

The weekly leaderboard shows the fifty players who collected the most coins this week to every signed-in player. If you have linked a Google account, that means your display name and Google profile image are visible to other players when you are in the top fifty.

Guest accounts and accounts without a name appear anonymously.

If you would rather not appear, do not link a Google account, or write to us.

To run your account and send your payouts. The ledger, your balance and your withdrawal records exist so we can track the coins you collected and send a payout to the identifier you gave us. Without them the app cannot work and we cannot send a payout.

To send the notifications you allowed, and to choose their timing and wording.

To keep it fair. Device records, IP addresses, emulator and root flags, region tiers and fraud flags exist to stop one person farming many accounts, to stop automation, and to protect the reward pool for everyone playing normally.

To show ads, which is what funds the rewards.

To count visits to this website, and to email you once about the launch if you joined the waitlist.

To meet our accounting and legal obligations and to resolve disputes about a payout.

Where the law gives you a choice we rely on your consent — notifications are the clearest example, and you can withdraw it at any time. Everything else is either necessary to provide the service you asked for, necessary for our legitimate interest in preventing fraud, or required by law.

Two accounts that have used the same device, or that last connected from the same IP address, are visible to us as linked. When a withdrawal is reviewed, that link is part of what a reviewer sees, along with the other account's name and email.

This is the single most invasive thing we do with your data, so we would rather state it plainly than bury it. It exists because multi-accounting is the main way a rewards app is drained, and because the alternative — paying out fraud — ends the payouts for everyone else.

Shared IP addresses are treated as a weak signal, not proof. Carrier networks put thousands of people behind one address, and a reviewer sees it as one factor among several rather than a reason to decline.

Your IP address is also used to rate-limit requests. It is stored against your device record; it is not written to our request logs.

Google, for sign-in. If you link a Google account, Google performs the authentication and tells us your name, email and profile image.

PostHog, on its US cloud, for website analytics, and Microsoft Clarity, which in the EU, EEA, UK and Switzerland loads only if you press Accept. Neither receives your waitlist email address.

Google AdMob, for ads, Google Firebase Analytics, for the product analytics described above, and Google Firebase Cloud Messaging, which delivers our notifications. All operate under Google's own policies.

The payout provider for the method you chose, and only when you request a withdrawal. We pass the payout identifier and the amount needed to send that specific payout, and nothing else. Payouts are currently processed manually rather than through an automated provider integration.

Cloudflare, which runs our server and serves this website, the pictures in our notifications, and our DNS, and Render, which hosts our database. Both store data on our behalf and do not use it for anything else.

Expo, which delivers app updates. Your device checks for updates against Expo's servers.

Anyone we are legally required to disclose to, and only to the extent required.

We do not sell your personal data.

Your account data is kept while your account exists.

Coin ledger entries and withdrawal records — including the payout identifier — are kept for eight years, the period for which we keep our books of account for any money paid out. They are kept whether or not you delete your account, but after deletion they are no longer attached to a name or an email address.

A waitlist email address is kept until you ask us to remove it, or until we delete the list after launch, as described under "Waitlist". We do not currently set a deletion schedule for website analytics events.

Sign-in sessions, Google tokens and device records — including stored IP addresses — are deleted when you delete your account. Sessions also expire on their own.

A push token is kept until you sign out, turn notifications off, delete your account, or Google reports it is no longer valid. We keep the five most recently used tokens per account and delete older ones. Your notification history and notification settings are kept while your account exists and are deleted when you delete it.

We are telling you the period we apply rather than saying "as long as necessary", because an open-ended answer is not really an answer.

You can delete your account yourself, in the app, from Profile. You do not need to contact us.

When you do: your name, email address, profile image and username are erased from your account record; every sign-in session is deleted; your linked Google account and its tokens are deleted; every device record, including stored IP addresses, is deleted; and your push tokens, notification history and notification settings are deleted. The account is then frozen so it cannot collect coins again.

What remains: your coin ledger, your withdrawal history and its payout identifiers, your game sessions, fraud flags and referral records, and the frozen profile record, which keeps the time you last opened the app. These are the accounting and fraud record, they are kept for the period above, and they are no longer linked to a name or an email address.

Deletion does not pay out your balance, and it does not cancel or refund a withdrawal that is already under review. Coins cannot be transferred to another account, so if your balance is above a method's minimum and you want a payout, request a withdrawal before you delete your account.

If you cannot reach the screen, write to support@levellark.app from the email address on the account.

You can see most of what we hold from inside the app: your balance, your full coin ledger, your withdrawals, your streak, badges, tasks and referrals are all on the Profile and Wallet screens.

You can delete your account at any time, from Profile, and you can turn notifications off at any time.

You can ask for a copy of your data, ask us to correct something wrong, ask us to delete something, or object to how we use it. Write to support@levellark.app from the email address on the account and we will respond within 30 days. If we cannot do what you ask — deleting the accounting record behind a payout, for example — we will tell you why.

You can also nominate someone to exercise these rights for you if you die or become unable to.

You can reset or delete your advertising ID, and opt out of ad personalisation, in your Android settings. That is a Google control and it applies to every app, including this one.

Your sign-in token is held in your device's secure storage rather than in ordinary app storage.

Balances are only ever changed by our server. The app cannot award itself coins, and a game result the server cannot verify against its own seed gets no coins.

A rewarded ad view is recorded only after a cryptographically signed confirmation from Google.

Ledger entries are linked by a hash chain, so an edit to history is detectable.

Staff access to accounts is restricted, and staff actions that change an account are recorded.

No service can promise perfect security, and we do not.

Rainstar Labs LLP is based in India. Our server and this website run on Cloudflare, our database runs on Render in Singapore, and our app analytics, notification delivery and ad services are Google's, and our website analytics run on PostHog's US cloud (and Microsoft Clarity, which runs in the United States too).

Wherever you use the app from, your data is processed in Singapore, in the United States and in the other regions where those providers operate, and our team in India can access it to run the service. For users in the EU, EEA or UK, those transfers rely on Standard Contractual Clauses or an equivalent safeguard.

LevelLark is for adults. It is not intended for anyone under 18, and we do not knowingly collect information from anyone under 18. Do not use the app if you are under 18.

If you believe someone under 18 has an account, write to support@levellark.app and we will remove it.

If we change what we collect, who we share it with, or how long we keep it, we will update this page and change the date at the top. Significant changes will be flagged in the app.

Rainstar Labs LLP (LLPIN AAY-3345), Moradabad, Uttar Pradesh, India.

Privacy and account questions: support@levellark.app

Grievance Officer: Mani Soni, support@levellark.app. We acknowledge a complaint within 48 hours and resolve it within one month. If you are not satisfied with our response, you can complain to the Data Protection Board of India.