Privacy policy
in plain language.

We do not sell your data, and we do not share it for anyone else's advertising.

The app asks Android for exactly two permissions: the advertising ID, and permission to show notifications. Nothing else.

We do not read your contacts, your installed apps, your location, your camera, your microphone, your files or your clipboard.

You can delete your account yourself, in the app. Your coin ledger and payout records are kept afterwards, because they are the accounting record behind money we paid out — but they are no longer attached to your name or email.

Every account has a random user ID. Everything else we hold is attached to that ID.

If you play as a guest, that is all there is. No name, no email, no password — a guest account is anonymous to us.

If you sign in with Google we store your name, email address and profile image from your Google account, along with your Google account identifier and the access and refresh tokens Google issues so you stay signed in. Google sign-in is the only sign-in method. We never ask for or store a password.

We store a record of each sign-in session, which includes the IP address and the app or browser user agent it was created from. Sessions expire, and they are deleted when you sign out or delete your account.

Your profile holds your coin balance, any amount held against a pending withdrawal, your XP and level, your referral code, who referred you if anyone, your time zone, a reward region tier, and whether the account is restricted and why.

When the app starts it registers your device. We store a device identifier, the device model, whether the device reports as an emulator, whether it reports as rooted, your language and region setting, your time zone, the IP address the request came from, and the time we last saw it.

On Android the device identifier is the Android ID your device already provides to apps. It is not your advertising ID, and we do not link the two. On any other platform it is a random ID generated on first launch that never leaves that install.

We record which accounts a device has been used on, and we keep the last IP address each device connected from. Both are used to detect one person running several accounts, and to rate-limit abuse. This is described in full under "Keeping it fair" below.

We derive a reward region tier from the country your connection reports, or failing that from your language setting. We store only the tier — a number from one to three. We do not store your country, your city, or any location.

Every coin that moves is a ledger entry recording the amount, what caused it, a short note, a reference to the game, ad or withdrawal behind it, and the time. Entries are linked by a hash chain so history cannot be edited after the fact. The ledger is how your balance is calculated, so it has to be complete.

We store your game sessions: which game, the seed it was generated from, when it started and finished, whether you won, your score, the coins awarded, and the result your device submitted. We store task progress, your daily streak, badges earned, how many free spins and scratch cards you have used today, and your referrals in both directions.

We record anti-fraud flags against an account — for example that a device reported as an emulator or as rooted, or that a referral was attempted between two accounts that share a device.

When you request a withdrawal we store the method, the coin amount, the cash value at the time, the status, and the payout identifier you entered. That identifier is whatever the method needs — a UPI ID, a Paytm number, a PayPal email, or a wallet address.

We store who reviewed the request, when, and any note attached to the decision.

A person reviews every request. During review, staff can see your balance and ledger history, your devices and their last IP addresses, your fraud flags, your past withdrawals, and the name and email on the account. Every action staff take on an account is recorded.

Ads are served by Google AdMob and operate under Google's privacy policy, not this one. AdMob uses your device's advertising ID and ad interaction data and may personalise the ads you see. This is why the app declares the advertising ID permission.

When you start a rewarded ad, we send Google your user ID and a one-time ad session ID so the view can be verified. Google signs a confirmation and sends it back to our server, and only then are coins credited. We store the ad session, the ad unit, its status, Google's transaction ID and the coins awarded.

We do not build advertising profiles, and we never pass your activity, balance or payout details to any ad network.

The Android app sends product analytics to Google Firebase Analytics — which screens are opened, which games are finished, when a withdrawal is submitted. The web version sends nothing.

These events are drawn from a fixed list defined in the app, and they are not tied to your account: we never set a user identifier on the analytics sink. Before an event is sent, any field whose name suggests personal data — email, name, phone, IP, address, payout identifier, token, cookie, password, referral code or device ID — is stripped.

There is no other analytics, crash-reporting or attribution service in the app. No PostHog, no Sentry, no advertising SDK other than AdMob.

We do not read your contacts. We do not read the list of apps installed on your device. We do not collect your location. We do not use your camera or microphone, and we do not read your files, photos or messages.

We do not read your clipboard. The app only ever writes to it, when you tap to copy your referral code.

We do not ask for your phone number, your date of birth, or any identity document.

We do not send push notifications and we hold no push token for you. The daily reminder is scheduled on your own device and never reaches our server. You can turn it off in the app or in your Android settings at any time.

The weekly leaderboard shows the top fifty earners of the week to every signed-in player. If you have linked a Google account, that means your display name and Google profile image are visible to other players when you are in the top fifty.

Guest accounts and accounts without a name appear anonymously.

If you would rather not appear, do not link a Google account, or write to us.

To run your account and pay you. The ledger, your balance and your withdrawal records exist so we can track what you earned and send the payout to the identifier you gave us. Without them the app cannot work and we cannot pay you.

To keep it fair. Device records, IP addresses, emulator and root flags, region tiers and fraud flags exist to stop one person farming many accounts, to stop automation, and to protect the reward pool for everyone playing normally.

To show ads, which is what funds the rewards.

To meet our accounting and legal obligations and to resolve disputes about a payout.

Where the law gives you a choice we rely on your consent — the daily reminder is the clearest example, and you can withdraw it at any time. Everything else is either necessary to provide the service you asked for, necessary for our legitimate interest in preventing fraud, or required by law.

Two accounts that have used the same device, or that last connected from the same IP address, are visible to us as linked. When a withdrawal is reviewed, that link is part of what a reviewer sees, along with the other account's name and email.

This is the single most invasive thing we do with your data, so we would rather state it plainly than bury it. It exists because multi-accounting is the main way a rewards app is drained, and because the alternative — paying out fraud — ends the payouts for everyone else.

Shared IP addresses are treated as a weak signal, not proof. Carrier networks put thousands of people behind one address, and a reviewer sees it as one factor among several rather than a reason to decline.

Your IP address is also used to rate-limit requests. It is stored against your device record; it is not written to our request logs.

Google, for sign-in. If you link a Google account, Google performs the authentication and tells us your name, email and profile image.

Google AdMob, for ads, and Google Firebase Analytics, for the product analytics described above. Both operate under Google's own policies.

The payout provider for the method you chose, and only when you request a withdrawal. We pass the payout identifier and the amount needed to send that specific payout, and nothing else. Payouts are currently processed manually rather than through an automated provider integration.

Railway, which hosts our server and database, and Cloudflare, which serves this website and our DNS. Both store data on our behalf and do not use it for anything else.

Expo, which delivers app updates. Your device checks for updates against Expo's servers.

Anyone we are legally required to disclose to, and only to the extent required.

We do not sell your personal data.

Your account data is kept while your account exists.

Coin ledger entries and withdrawal records — including the payout identifier — are kept for seven years, which is the accounting-record period the company applies to any record of money paid out. They are kept whether or not you delete your account, but after deletion they are no longer attached to a name or an email address.

Sign-in sessions, Google tokens and device records — including stored IP addresses — are deleted when you delete your account. Sessions also expire on their own.

We are telling you the period we apply rather than saying "as long as necessary", because an open-ended answer is not really an answer.

You can delete your account yourself, in the app, from Profile. You do not need to contact us.

When you do: your name, email address, profile image and username are erased from your account record; every sign-in session is deleted; your linked Google account and its tokens are deleted; and every device record, including stored IP addresses, is deleted. The account is then frozen so it cannot earn again.

What remains: your coin ledger, your withdrawal history and its payout identifiers, your game sessions, fraud flags and referral records. These are the accounting and fraud record, they are kept for the period above, and they are no longer linked to a name or an email address.

Deletion does not pay out your balance, and it does not cancel or refund a withdrawal that is already under review. Coins have no cash value on their own and cannot be transferred, so cash out first if your balance is above the minimum and you want to be paid.

If you cannot reach the screen, write to support@levellark.app from the email address on the account.

You can see most of what we hold from inside the app: your balance, your full coin ledger, your withdrawals, your streak, badges, tasks and referrals are all on the Profile and Wallet screens.

You can delete your account at any time, from Profile, and you can turn the daily reminder off at any time.

You can ask for a copy of your data, ask us to correct something wrong, ask us to delete something, or object to how we use it. Write to support@levellark.app from the email address on the account and we will respond within 30 days. If we cannot do what you ask — deleting the accounting record behind a payout, for example — we will tell you why.

You can reset or delete your advertising ID, and opt out of ad personalisation, in your Android settings. That is a Google control and it applies to every app, including this one.

Your sign-in token is held in your device's secure storage rather than in ordinary app storage.

Balances are only ever changed by our server. The app cannot award itself coins, and a game result the server cannot verify against its own seed earns nothing.

Rewarded ad credit requires a cryptographically signed confirmation from Google before any coins are added.

Ledger entries are linked by a hash chain, so an edit to history is detectable.

Staff access to accounts is restricted, and staff actions that change an account are recorded.

No service can promise perfect security, and we do not.

Factorx Inc is based in the United States. Our server and database run on Railway, this website runs on Cloudflare, and our analytics and ad services are Google's.

If you use the app from outside the United States, your data will be transferred to and processed in the United States and in the other regions where those providers operate. Where applicable, those transfers rely on Standard Contractual Clauses or an equivalent safeguard.

LevelLark is for adults. It is not intended for anyone under 18, and we do not knowingly collect information from anyone under 18. Do not use the app if you are under 18.

If you believe someone under 18 has an account, write to support@levellark.app and we will remove it.

If we change what we collect, who we share it with, or how long we keep it, we will update this page and change the date at the top. Significant changes will be flagged in the app.

Factorx Inc, a Delaware corporation, United States.

Privacy and account questions: support@levellark.app