GooseUp Android App and Connected Portfolio Games
Version: 2.0 | Effective date: 11 November 2026 | Last updated: 11 November 2026
This Privacy Policy is available at: https://everplay.gs/PrivacyGooseUp.html
This Privacy Policy explains how Everplay Games Ltd. ("Everplay,” "we,” "us,” or "our") collects, uses, discloses, retains, and protects personal information through the GooseUp Android application and the rewards features that connect GooseUp with certain Portfolio Games (together, the “Services").
1. Scope
This Policy covers the GooseUp Android application and Everplay’s receipt and use of qualifying Portfolio Game events and related app, device, and network information when a Portfolio Game participates in the GooseUp rewards program.
GooseUp is a free Android rewards app funded by advertising and intended for adults. You do not need to buy anything or subscribe to use GooseUp or earn Coins.
Everplay Games Ltd. is the controller for the processing described in this Policy. Each Portfolio Game has its own privacy notice for its standalone features and data practices, whether or not GooseUp is installed. That notice governs the Portfolio Game’s standalone collection and use of information; this Policy governs only the GooseUp rewards-related processing described here.
2. Information We Collect
The information we collect depends on how you use GooseUp, whether you join the rewards program, whether you request a Cashout, and the settings and permissions available on your device.
Identifiers and device information. We collect an internal user ID assigned by Everplay; Google Advertising ID (GAID); Android ID (ANDROID_ID); App Set ID; other device and security identifiers; device model and manufacturer; operating system and app version; network type; and signals about device or app security, integrity, or possible compromise. The identifier we use depends on the feature and purpose described below.
Everplay uses the internal user ID to maintain your rewards profile, recognize you when you return, administer Coins and Cashouts, support internal analytics and operations, and perform separate fraud and security checks. We may link it to device identifiers and related activity to keep rewards consistent, analyze and secure the Services, prevent fraud, and process deletion requests. A regular GAID reset is an advertising choice; it does not, by itself, cancel valid Coins or delete your rewards profile.
App and gameplay activity. We collect how you use the App and connected games, including app interactions, sessions, timestamps, gameplay progress, completed qualifying activities, eligible advertising events, and other events identified in the Rewards Program Rules. For the rewards program, a connected Portfolio Game may send qualifying events and related app, device, and network information to Everplay even if GooseUp is not installed, is closed, or is running in the background. GooseUp must be installed on the same device only for us to credit Coins for a qualifying event; it does not need to be open or running in the foreground.
We may also keep records of incomplete, abandoned, failed, or reversed qualifying activity to administer rewards, answer support questions, and protect the Services. Verification attempts are described in Section 8.
Rewards and transaction information. We collect Coin balances, credits, debits, expirations, earning history, reward eligibility, Cashout requests, Cashout status, amounts, dates, and records of your interactions with the rewards program.
A Cashout uses 100% of the balance in your wallet at the moment you start it. You cannot choose a smaller amount or make a partial Cashout. We collect the balance used for the request and related records to calculate, review, and complete the Cashout.
Advertising and attribution information. We collect or receive ad impressions, completed ads, ad interactions, campaign and install information, attribution events, and related app, device, network, and measurement information.
AppLovin and Adjust may collect through their services GAID, when available; identifiers they create; IP and network information; device and app information; campaign, install, and attribution information; and app or ad interaction data. Everplay does not send its internal user ID to AppLovin or Adjust and configures those services not to receive it. Beyond the advertising and measurement information described above, Everplay does not intentionally provide other device or security identifiers to AppLovin or Adjust for advertising or attribution purposes.
Approximate location and network information. We collect your IP address, an approximate location or region inferred from it, network type, connection information, and related information. We use this information for service operation, analytics, advertising delivery and measurement, security, fraud prevention, and regional eligibility or other regional controls.
Communications. If you contact us through a support or privacy channel, we collect the name and contact details you provide, the contents of your message, attachments or supporting information, and our correspondence with you.
Cashout and payout information. When you request a Cashout, we collect the identifier for your payout or payment account and other information needed for the payout method shown in the App. The information depends on the method and provider selected for the transaction.
We may also collect records about transactions, matching payments, payout status, and communications with payment providers. We may collect state or other tax information when required by law.
Verification, identity, and tax information. Face Liveness or Full KYC starts only after you actively start a Cashout. Everplay may use Cashout and rewards records, payout activity, and security, fraud, and eligibility checks to determine whether a Cashout may proceed without verification or requires Face Liveness or Full KYC.
Face Liveness and Full KYC are different checks. Face Liveness involves a camera-based check to confirm that a live person is present. Full KYC involves a Face Liveness Check and verification of a government-issued identity document. As part of Full KYC, our identity-verification provider, Bureau, extracts information from your identity document and performs checks relating to the document’s validity, authenticity and quality. The facial image captured during the Face Liveness Check is also compared with a photograph appearing on your identity document to verify that they relate to the same person.
Where Full KYC is completed, we may receive and store your name, date of birth, nationality, issuing country, document expiry date and document status; a keyed hash of your identity document number; document forgery, AI-generation and quality flags; Bureau request identifiers; liveness scores and related flags; and face-match similarity and confidence scores. We also temporarily store the selfie and identity-document images used for Full KYC. These images are automatically deleted from our cloud storage after seven days.
We do not store your identity document number in plain text or other information that Bureau's document-verification process may extract but which is not required by us for the verification process. This information is collected and processed directly by Bureau and is not retained by Everplay.
Biometric and liveness information. Section 8 describes the biometric and liveness information that may be collected during an active Cashout, including the purposes, Bureau’s role, consent, retention, and consequences of declining or failing verification.
Risk and security assessments. Everplay and Bureau may create security and fraud assessments from device and network information, usage patterns, verification information, and transaction information. These assessments help protect rewards, make Cashout decisions, secure the Services, and prevent fraud.
Bureau may conduct separate device-security and fraud checks during use of the Services. In limited-purpose security, authentication, fraud-prevention, Face Liveness, and Full KYC flows, Bureau may receive the internal user ID and only relevant device, network, usage, security, verification, and fraud signals. Bureau does not receive the internal user ID for advertising or attribution and is not used for advertising.
Whether you must provide information, and the consequences of not providing it. Information collected automatically from the App, your device, and connected Portfolio Games is used as described in this Policy to operate, secure, and administer the Services and rewards program. Information requested for a Cashout, payout, Face Liveness Check, or Full KYC is required only where the relevant process requires it; if you do not provide or complete the required information, that Cashout or verification process cannot proceed. Information you provide when contacting support or exercising a privacy right is voluntary, but we may be unable to respond to or verify the request without sufficient information.
3. Sources of Information
We collect information from the following sources, depending on how you use the Services:
• From you: information you provide in the App, during Cashout or verification, or in a support or privacy request.
• From your device and the App: identifiers, device and app information, app interactions, sessions, security signals, and the permissions or choices available on the device.
• From connected Portfolio Games: qualifying game events, ad events, campaign or install information, and related information used for the GooseUp rewards integration.
• From advertising and measurement providers: information collected through AppLovin and Adjust, including identifiers they create and information about ads, campaigns, and installs.
• From Bureau: identity and verification information, including information extracted from an identity document, selfie and identity-document images, liveness and face-match information, verification results, and device security, authentication and fraud signals or results from the relevant Bureau service.
• From internal systems and other providers: rewards, analytics, operations, payout, security, and service records created or maintained in connection with the Services.
4. How We Use Information
We use information for the following purposes, as applicable to the feature or activity involved:
• Operate, provide, maintain, troubleshoot, and secure GooseUp and its connected rewards features, including receiving qualifying Portfolio Game events and related information and deciding whether activity qualifies for Coins.
• Maintain your rewards profile, recognize you when you return, calculate and credit Coins, administer Cashouts, and apply the Terms.
• Perform internal analysis and reporting, improve data quality and the Services, and monitor operations.
• Deliver, measure, and attribute advertising and app campaigns and support related ad operations, subject to the choices and opt-outs described below.
• Detect, investigate, prevent, and respond to fraud, abuse, manipulation, unauthorized access, security incidents, and other threats to the Services.
• Authenticate users, conduct Cashout verification, perform Face Liveness or Full KYC when required, confirm eligibility, and support payout processing.
• Answer questions, provide support, handle privacy requests, investigate disputes, and keep appropriate records.
• Comply with legal obligations, respond to lawful requests, protect rights and property, and establish, exercise, or defend legal claims.
• Create aggregated or de-identified information and use it for service analytics, security, reporting, and other lawful business purposes when it cannot reasonably be used to identify you.
GDPR legal bases. Where the GDPR applies, the legal basis depends on the purpose of the processing. We rely on Article 6(1)(b) GDPR where processing is necessary to operate GooseUp, maintain your rewards profile, calculate and credit Coins, administer Cashouts and provide the Services you request. We rely on Article 6(1)(c) GDPR where processing is necessary to comply with tax, regulatory, record-keeping or other legal obligations. We rely on Article 6(1)(f) GDPR for security, fraud prevention, identity-verification, service operations, support, internal analytics and establishing, exercising, or defending legal claims, where our interests are not overridden by your rights and freedoms. We rely on Article 6(1)(a) GDPR where you have given consent for a specific purpose, including certain non-essential advertising or measurement processing. Where facial features or mapping information constitute biometric data used to uniquely identify you, the additional condition described in Section 8 applies.
Legitimate interests. Where we rely on Article 6(1)(f) GDPR, our legitimate interests include keeping the Services secure and reliable, preventing fraud and abuse, supporting internal analytics and operations, handling support matters, and establishing, exercising, or defending legal claims. We balance those interests against your rights and freedoms and use this basis only where the processing is necessary and proportionate.
5. Disclosures and Recipients
We disclose information to the recipients described below when reasonably needed for the purposes in this notice, at your direction, or as permitted or required by law.
Advertising and measurement disclosures. Section 2 describes the information AppLovin and Adjust may collect through their services. We disclose certain identifiers, app activity, information about ad interactions, approximate location, and attribution information to advertising and measurement providers for ad delivery, measurement, attribution, and related operations. Depending on the arrangement and applicable law, these disclosures may be treated as a sale, sharing, or targeted advertising.
• AppLovin Corporation: helps select and deliver ads and measure advertising and provides related app technology. AppLovin may receive the advertising information described in Section 2 for its services and may disclose information to network partners through its services.
• Adjust: measures installs, sessions, and campaign events and provides mobile attribution and related measurement.
• Bureau, Inc.: provides device security, fraud prevention, authentication, Face Liveness, Full KYC, verification, and related security processing. Bureau’s limited-purpose role and identifier disclosures are described in Section 2. Bureau is not an advertising provider.
• Internal analytics and operational providers: Snowflake, Bruin, and Domo help us store and organize information, prepare it for analysis, check data quality, and create internal reports and dashboards. They support internal analytics and operations and are not advertising providers.
• Google LLC (Firebase Analytics): in-app analytics and usage reporting, and to inform advertising campaign measurement. Firebase is not used for ad delivery or ad personalization.
• BugSnag: crash reporting, diagnostics, app stability, and release-health monitoring when used by a connected Portfolio Game.
• Payout, hosting, security, and communications providers: we disclose the information needed for the Cashout method shown in the App to its payout provider and to providers supporting hosting, infrastructure, security, support, or communications.
• Authorities and other recipients: courts, law enforcement, regulators, tax authorities, professional advisers, insurers, or other persons when required or permitted by law, to protect rights and safety, or in connection with a corporate transaction.
A provider or other recipient may have its own privacy notice describing information it collects directly and how it uses that information independently of Everplay.
Some recipients or providers may be located outside the European Economic Area. Where the GDPR applies, Everplay transfers personal data outside the EEA only where the transfer is permitted under Chapter V GDPR. Depending on the recipient and destination, Everplay may rely on an adequacy decision, appropriate safeguards such as the European Commission’s standard contractual clauses, or another transfer mechanism permitted by the GDPR. You may request further information about the applicable transfer mechanism and, where available, a copy of the relevant safeguards by contacting the privacy contact in Section 17.
6. Advertising Choices and Statutory Opt-Outs
GooseUp is funded by advertising. You may still see ads after opting out of targeted or personalized advertising, but they may be less relevant to your interests.
Some advertising and measurement disclosures may be treated as a sale, sharing, or targeted advertising under applicable state law. An Android device setting is separate from a statutory opt-out. Changing that setting does not, by itself, submit a statutory opt-out request to Everplay or require Everplay or a recipient to stop all other processing.
• Submit a statutory opt-out request using the statutory opt-out and privacy-choice method listed in Section 17.
• Use Android’s available advertising settings to reset GAID or turn off ad personalization. These settings change advertising on your device; they are not, by themselves, Everplay’s complete statutory opt-out.
A regular GAID reset is not prohibited and does not, by itself, cancel valid Coins or delete your rewards profile. It may affect how advertising or attribution recognizes your device. Resetting, spoofing, or manipulating an identifier to obtain additional rewards or evade controls, especially together with other evidence of manipulation, may violate the Terms and support fraud enforcement.
An advertising opt-out does not automatically delete information needed for rewards administration, Cashout, security, fraud prevention, verification, support, or legal compliance. Use the privacy rights and deletion procedures below for those requests.
7. Retention
We keep information only as long as reasonably needed for the purposes described in this Policy. We consider your active rewards relationship, service operations, security and fraud risks, Cashout and payout needs, legal obligations, disputes, recordkeeping, and legal claims.
How long we keep information depends mainly on what it is and why we need it:
|
Category |
Retention |
|
Selfie and identity-document images (Everplay) |
7 days, then automatically deleted |
|
Verification records (identity data, verification results and scores) |
12 months after the user’s last Cashout, or earlier on account deletion. This applies even if the account is still active. If the user requests a Cashout after that, a new Full KYC is required. Where the account is linked to a fraud finding or ban: 3 years from the decision. |
|
Rewards profile and gameplay data (per-user processed data) |
Deleted or anonymised 24 months after the user’s last activity. A user returning after that starts as a new user. |
|
Raw analytics events, including ad revenue and attribution data |
24 months from the event date |
|
Consent records |
Lifetime of the account plus 3 years after closure, kept separately to demonstrate consent |
|
Cashout and payment records (amount, date, PayPal transaction ID) |
Retained for the period required by applicable accounting, tax and recordkeeping laws (10 years), and for any longer period necessary to comply with applicable legal obligations or resolve disputes. |
|
Support correspondence |
3 years after the ticket is closed, or longer where a dispute is ongoing |
|
Fraud, ban and appeal records |
3 years from the decision |
|
Banned device fingerprints |
Kept in a separate table not linked to any user, 3 years from the ban. The period restarts if a new fraud attempt comes from the same device. |
|
Internal ID mapping for advertising and attribution partners |
7 days |
If information is subject to a legal hold, dispute, fraud or security investigation, payment or tax obligation, or other preservation requirement, Everplay may retain it until that requirement ends. Backups may retain information for a limited period while they are overwritten or securely removed through ordinary processes.
When information is no longer needed, Everplay deletes it or anonymizes it so that it is no longer reasonably associated with an identifiable person, subject to the exceptions described in this notice.
8. Biometric and Liveness Notice
This section applies only when you actively start a Cashout that requires Face Liveness or Full KYC. Neither check starts outside an active Cashout.
For full details on how we collect, use, store, and delete biometric and liveness information, please review our standalone GooseUp Biometric and Liveness Notice, available at https://everplay.gs/BiometricNoticeGooseUp.html, before you initiate a Cashout that requires Face Liveness or Full KYC. This Section 8 summarises that processing and should be read in conjunction with that Notice.
Categories collected. Depending on the verification required, Bureau may collect a real-time selfie or liveness capture and process information derived from that capture to determine whether a live person is present. Where Full KYC is required, the user completes a Face Liveness Check and provides a government-issued identity document. Bureau processes the identity document, extracts information from it and performs checks relating to its validity, authenticity and quality. Bureau also compares the facial image captured during the Face Liveness Check with the photograph appearing on the identity document. The verification process generates liveness results and, for Full KYC, face-match similarity and confidence scores and document-verification results.
Everplay receives and stores certain information generated through the Full KYC process, including your name, date of birth, nationality, issuing country, document expiry date and document status; a keyed hash of your identity document number; document forgery, AI-generation and quality flags; Bureau request identifiers; liveness scores and related flags; and face-match similarity and confidence scores. Everplay also stores the selfie and identity-document images in its cloud storage for seven days, after which they are automatically deleted. Everplay does not receive or store biometric templates. For the avoidance of doubt, Everplay does not use one-to-many facial matching or face deduplication to compare your facial information against other users' records.
Purposes. We use identity-verification, liveness and facial-comparison information to verify your identity, determine whether a real person is completing the verification process, compare the person completing Full KYC with the person identified in the submitted identity document, prevent and detect fraud or misuse, protect the integrity of the Services and determine whether applicable Cashout requirements have been satisfied.
Bureau processing. Bureau processes the facial, liveness, identity, device-security, and fraud information needed for the Cashout verification and security flow in connection with Everplay’s Services. Bureau’s limited-purpose processing and identifier disclosures are described in Section 2. Bureau is not used for advertising.
Consent where required. Before collecting biometric or liveness information, Everplay will provide the notice required by applicable law and obtain affirmative consent where applicable law requires it. Where facial features or mapping information are processed as biometric data under the GDPR, Everplay relies on explicit consent under Article 9(2)(a) GDPR together with Article 6(1)(b) (performance of a contract) and Article 6(1)(f) (legitimate interest) as the legal basis for such processing. You may withdraw consent at any time either through the withdrawal route (Profile > Data Controls > Withdraw Biometric Consent) or by contacting privacy@everplay.gs. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal and may mean that a Cashout requiring verification cannot be processed.
Everplay does not sell biometric or liveness information and does not use it for advertising or targeted advertising. We do not use it to build advertising profiles.
Retention and destruction. Everplay stores the selfie and identity-document images used for Full KYC for seven days, after which they are automatically deleted from Everplay's cloud storage. Everplay retains the other verification information described above in accordance with the retention periods set out in Section 7.
Bureau retains selfie and liveness captures and identity-document images for no more than 30 days from collection, after which they are deleted.
If you decline or do not complete verification. You may choose not to complete a Face Liveness Check or Full KYC. However, where the Cashout you request requires that verification, the Cashout cannot proceed unless the required verification is successfully completed.
A failed or abandoned KYC check does not, by itself, result in a ban from the Services.
Residents of states with biometric privacy laws may have additional rights regarding notice, consent, access, deletion, destruction, retention information, or other biometric processing. Requests may be submitted using the privacy contact in Section 17 and the procedures in Section 14; applicable state law controls the scope of those rights.
9. Security and Automated Fraud Assessment
Automated fraud and security assessments. Everplay uses automated systems to identify and respond to potential fraud, misuse and threats to the integrity of the Services, in GooseUp and in the connected Portfolio Games. These systems may analyse information such as (i) device and app-integrity signals, for example the use of an emulator, a rooted or tampered device, or a modified or cloned version of the App; (ii) network, attribution and traffic information, for example anonymous traffic from VPNs, TOR exit nodes or data-centre IP addresses, or an invalid app signature; and (iii) gameplay and ad-activity patterns that may indicate automation, for example uninterrupted ad activity over many hours, abnormally frequent app launches, or ads that are started but rarely completed. These systems may also take into account identifiers such as verification results and Cashout activity and other fraud or risk indicators.
Certain decisions may be made solely through automated processing, without human involvement before the decision takes effect. The automated systems assess whether the signals described above indicate that a device or app environment, network connection or account activity may be compromised, manipulated or automated. Where a high-risk signal, or a combination of signals, meets Everplay’s fraud or integrity criteria, your account may be restricted automatically, at install or at any later time. While an account is restricted, access to GooseUp and the connected Portfolio Games is blocked except for contacting support, no new Coins can be earned, Cashouts cannot be requested, pending Cashouts are stopped and accrued Coins are frozen. The App will show a notice when your account is restricted. Frozen Coins and pending Cashouts are cancelled only if a review confirms prohibited conduct, or if you do not request a review within 6 months from the date of the restriction being imposed. If the restriction is lifted after review, your access, Coins and pending Cashouts are restored. Because all Everplay apps use the same fraud-prevention setup, a restriction applies across GooseUp and all connected Portfolio Games. Everplay’s team may review a restriction on its own initiative, but this is not guaranteed. You may contest an automated restriction and request human review as described below.
Where Everplay’s internal rules detect a single risk signal in your in-App activity, your account may be flagged for review by Everplay’s team. While an account is flagged, you can continue to play, earn Coins and request Cashouts under the standard verification requirements, and your Coins are not reduced or cancelled, but Everplay may limit the advertising partners that serve ads to your account. If the review confirms a violation, or an advertising partner reports invalid activity on the account, the account may be restricted as described above.
A regular GAID reset is not, by itself, a fraud signal.
Based on security, eligibility, fraud, and other applicable checks, a Cashout may proceed, require verification (such as face liveness check or full identity verification, depending on the amount and risk), remain pending while an issue is addressed, or be denied. These checks may also support restrictions, suspension, or termination under the Terms.
If you believe a rewards, Cashout, or fraud-enforcement action was wrong, including an automated restriction and/or ban, you may contest the decision and request human review through support@everplay.gs. A member of our team will review the relevant circumstances and may uphold or reverse the decision. This address is only for rewards, Cashout, and fraud-enforcement reviews, including review of an automated assessment; it is not a privacy-rights channel. Everplay will review the request in good faith and notify you of the outcome within 30 days after receiving it. Where the GDPR applies, if a decision is based solely on automated processing and produces legal or similarly significant effects, you may request human intervention, express your point of view, and contest the decision through this process, subject to applicable law. Everplay may keep confidential security methods and other abuse-prevention information private, and a review request does not guarantee a particular outcome.
Everplay uses administrative, technical, and physical safeguards reasonably designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Access to information is limited to personnel, systems, and providers that need it for the purposes described in this notice or as otherwise permitted by law.
10. Deletion and Rewards-Profile Consequences
Uninstalling GooseUp or a Portfolio Game is not a deletion request. Uninstalling an app may stop that app from collecting new information. If you uninstall GooseUp, Everplay cannot credit Coins for qualifying events while it is uninstalled, but a separately installed connected Portfolio Game may still send qualifying events or related information to Everplay. Uninstalling an app does not automatically delete information already held by Everplay or its providers. To request deletion, use the in-app self-service deletion control (Profile > Data Controls > Delete My Data). If that control is not available to you, use the process in Section 14.
Where verification records are held in connection with your rewards account, Everplay will delete those records as part of the account deletion process, except where continued retention is required for an ongoing fraud or security investigation, legal claim, or legal obligation. Everplay will also send a corresponding deletion instruction to Bureau in respect of verification materials associated with your account, subject to any independent legal or retention obligations applicable to Bureau.
After we verify a deletion request, we disconnect the device identifiers associated with your previous rewards profile from that profile, and delete or anonymize those identifiers, subject to the exceptions below.
We ask relevant providers to delete or anonymize information where appropriate, subject to their roles and lawful retention requirements. If you return after a verified deletion, Everplay creates a new rewards profile and internal user ID and does not reconnect you to the deleted profile.
Deletion does not require Everplay to delete information that must be retained for fraud prevention, security, payment or payout processing, tax obligations, disputes, legal claims, legal holds, or other legal obligations. Retained information remains subject to applicable protections and is deleted or anonymized when the retention need ends.
A verified deletion request closes your GooseUp rewards profile and cancels any unredeemed Coins. A pending Cashout is cancelled or otherwise handled as provided in the Terms and applicable law; review the Terms before requesting deletion.
To request deletion, use the in-app self-service deletion control (Profile > Data Controls > Delete My Data). If you cannot access that control, you may instead use the privacy contact listed in Section 17 with the subject line “Deletion Request”; the request process and verification requirements in Section 14 apply to that alternative method.
Following account deletion, personal data held within Everplay's backend systems and analytics environments is deleted or irreversibly anonymised so that it can no longer be associated with an identifiable user, subject to the retention exceptions described in this Policy.
11. Privacy Rights
11.1 U.S. Privacy Rights Available Nationally
Everplay makes the rights in this section available to U.S. residents nationwide, subject to applicable law, statutory exceptions, and verification requirements. This does not mean that a particular state law applies to every user or every processing activity.
Depending on where you live and what the law provides, you may request:
• Access or know: confirmation whether Everplay processes information about you and access to, or information about, the categories and specific pieces of information we maintain, where applicable.
• Correction: correction of inaccurate information Everplay maintains about you.
• Deletion: deletion of information Everplay maintains about you, subject to the exceptions described in this notice.
• Portability: a copy of information in a portable format where applicable and required by law.
• Opt-out: opting out of disclosures that constitute a sale or sharing, targeted or cross-context behavioral advertising, and other advertising uses where those rights apply.
• Sensitive information choices: limitation of the use or disclosure of sensitive information, or consent and withdrawal treatment, where applicable law provides that right or requires that treatment.
• Profiling choices: opting out of certain profiling in furtherance of decisions producing legal or similarly significant effects, where applicable law provides that right.
• Non-discrimination: not receiving discriminatory treatment for exercising a privacy right, subject to lawful differences connected with the value of a service or other applicable exception.
These rights are subject to exceptions, including information needed to complete a transaction, provide a requested service, protect security, detect or prevent fraud, comply with law, resolve disputes, or protect Everplay’s or another person’s rights.
11.2 GDPR rights
Everplay is established in Malta, and the GDPR applies to the processing described in this Policy. You may request access to your personal data, rectification or erasure of it, or restriction of its processing, and may receive a portable copy of certain personal data processed by automated means where applicable. You may object to processing based on legitimate interests and may withdraw consent at any time where processing is based on consent; withdrawal does not affect the lawfulness of processing before withdrawal. You may object at any time to processing for direct marketing, including related profiling, and we will stop that processing. You may have rights regarding solely automated decisions that produce legal or similarly significant effects, including human intervention, the opportunity to express your point of view, and the ability to contest the decision. You also have the right to lodge a complaint with the competent data protection supervisory authority. Further information is provided in Section 17. These rights are subject to applicable limitations and exceptions. For an automated rewards, Cashout, or fraud-enforcement assessment, use the human-review process in Section 9; for other privacy-rights requests, use the privacy contact in Section 17.
12. California Disclosures
This section applies to California residents to the extent the CCPA, as amended by the CPRA, applies to Everplay’s processing. It supplements the other sections of this notice; it does not assert that the CCPA applies to every user or activity.
Categories collected. In the preceding 12 months and currently, Everplay may collect the following California categories, depending on your use of the Services:
• Identifiers: internal user ID, GAID, ANDROID_ID, App Set ID, other device and security identifiers, IP address, contact details (including a phone number when provided for contact or verification), and payout identifiers. We use these, as applicable, for rewards-profile administration, service operation, internal analytics, security and fraud prevention, advertising and measurement, Cashout, and support.
• Internet or other electronic network activity: app and game interactions, sessions, gameplay, qualifying Portfolio Game events and related information, ad impressions and interactions, campaign and install information, and Cashout activity. A connected Portfolio Game may send qualifying events and related information even when GooseUp is not installed or open; GooseUp must be installed only for Coin crediting. We use this information for service operation, rewards administration, advertising and measurement, attribution, security, and fraud prevention.
• Geolocation: approximate location inferred from your IP address and network information, used as applicable for service operation, regional eligibility, advertising and measurement, security, and fraud prevention.
• Commercial, financial, and transaction information: Coin balances, rewards activity, Cashout requests, payout information, transaction status, and related records, used to administer rewards, process Cashout, match transactions, provide support, and comply with law.
• Sensitive personal information: biometric or liveness information, information from a government-issued identity document, and tax information when collected in an active Cashout verification flow or as otherwise needed for Cashout, security, eligibility, or legal compliance. We do not use these categories for advertising.
• Inferences: rewards, eligibility, security, fraud-risk, and service-use inferences derived from the information above, used for rewards integrity, Cashout decisions, security, and fraud prevention.
The sources, purposes, and recipient categories for this information are described in Sections 3-5, subject to the limits below. A Portfolio Game’s separate privacy notice governs its standalone collection and use; this Policy covers Everplay’s rewards-related use of qualifying events and related information when the game participates in the GooseUp rewards program.
For California residents, Everplay’s advertising and measurement disclosures to AppLovin and Adjust, as described in Sections 2 and 5, may include GAID where available, provider-generated identifiers, IP address and approximate location, app and game activity, ad interactions, campaign, install, and attribution information. Everplay does not send its internal user ID to AppLovin or Adjust and configures those services not to receive it. Beyond the advertising and measurement information described in Sections 2 and 5, Everplay does not intentionally provide other device or security identifiers to those providers for advertising or attribution purposes. AppLovin may disclose information through its services to network partners, and Adjust provides mobile measurement and attribution. Depending on the facts and applicable law, these disclosures may be “sharing” for cross-context behavioral advertising and may be a “sale” under California law if the statutory definition is met. California residents may use the statutory opt-out and privacy-choice method identified in Section 17; Android advertising settings alone are not a complete statutory opt-out.
Everplay does not use sensitive personal information, including biometric or liveness information, for advertising or targeted advertising. We use it only for the Cashout, verification, security, fraud-prevention, eligibility, support, and legal purposes described in this Policy. Where California law provides a right to limit use or disclosure of sensitive personal information, submit that request through Section 14.
Rewards program; not a financial incentive for personal information. Everplay provides Coins and Cashout as compensation for qualifying activity under the Terms. The rewards program is not offered in exchange for your consent to collect, use, sell, or share personal information, and participation is not conditioned on consenting to a sale or sharing. We do not assign a value to personal information for this program. Participation is voluntary and subject to the Terms; the amount of Coins or Cashout depends on qualifying activity and applicable program rules.
California residents may exercise applicable rights through the request, verification, authorized-agent, and appeal procedures in Section 14.
California residents may also request information about disclosures of personal information to third parties for those parties’ direct-marketing purposes, to the extent that right applies. Submit the request through Section 14 with the subject line “California Direct Marketing Request”.
13. Rights Available Under Other U.S. State Laws
Residents of other states may have additional or different rights depending on the applicable law, including access, correction, deletion, portability, opt-out of sale or targeted advertising, limitation or consent treatment for sensitive data, and opt-out of certain profiling.
Where applicable law requires consent before processing sensitive data, Everplay will obtain the required consent or provide the treatment required by that law. State law may also provide additional biometric, appeal, complaint, or deletion protections.
The request, verification, authorized-agent, appeal, response, and non-discrimination procedures in Section 14 apply to requests under other state laws, except to the extent a state’s law requires a different procedure or deadline.
14. Requests, Verification, Appeals, and Authorized Agents
To submit a privacy request, use the privacy contact listed in Section 17 with the subject line “Privacy Rights Request.” Identify the right you wish to exercise, the country or state in which you reside, as applicable, and whether the request concerns GooseUp, a Portfolio Game, or both.
Please provide enough information for Everplay to understand and verify your request. Do not send a Social Security number, identity document, or other highly sensitive information by ordinary email unless Everplay provides a secure method and requests it.
We may verify your identity or authority before completing a request. The level of verification depends on the request, the sensitivity of the information, and the risk of unauthorized disclosure, deletion, or change. If we cannot verify a request, we may deny it or ask for additional information permitted by law.
You may use an authorized agent where applicable law permits. The agent must provide proof of authority, and Everplay may verify the agent’s identity and contact you directly to confirm the request.
If Everplay denies or limits a request, you may appeal under the procedures in this Section by using the privacy contact listed in Section 17 with the subject line “Privacy Rights Appeal” and including the original request and the reason for the appeal. Everplay will review the appeal and respond within the period required by applicable law.
Everplay will respond to requests and appeals within the time required by applicable law and may extend a response where the law permits. Everplay will not discriminate against you for exercising a privacy right.
The rewards, Cashout, and fraud-enforcement review process described in Section 9 is separate from privacy requests. Use support@everplay.gs only for those reviews, including human review of an automated assessment; use the privacy contact and process in this Section for privacy rights.
15. Age Requirement
GooseUp and its rewards program are intended only for people age 18 and older. People under 18 may not use GooseUp or participate in its rewards program. Everplay does not knowingly collect personal information through GooseUp from anyone under 18. If you believe this has occurred, use the privacy contact and request procedures in Section 14.
A separately distributed Portfolio Game may have different age requirements and its own privacy notice for standalone use. That notice and those requirements govern the Portfolio Game’s standalone experience; this Policy applies only to the GooseUp rewards-related processing described here.
16. Changes to This Policy
Everplay may update this notice to reflect changes to the Services, information practices, legal requirements, or user choices. The revised notice will show its effective or last-updated date. Where required by law, we will provide additional notice or obtain any required consent.
17. Contact
For privacy questions, privacy-rights requests, deletion requests, complaints, or questions about this notice, contact:
Everplay Games Ltd.
Registered address: Ewropa Business Centre Level 3-701, Triq Dun Karm, Birkirkara, BKR 9034, Malta
Registration number: C 116697
Privacy contact: privacy@everplay.gs
Data Protection Officer: dpo@everplay.gs
Policy URL: https://everplay.gs/PrivacyGooseUp.html
Statutory opt-out and privacy-choice method: in-app control at Profile > Privacy > Do not sell or share my personal information, or email privacy@everplay.gs with the subject line “Privacy Request.”
Universal opt-out signals, including Global Privacy Control (GPC): GooseUp is an Android application and does not receive browser-based opt-out preference signals such as GPC. To submit a statutory opt-out, use the in-app control or email address identified above.
For rewards, Cashout, or fraud-enforcement review, contact support@everplay.gs. This address is only for those reviews; it is not the general privacy contact.
If the GDPR applies to you, you may lodge a complaint with the Information and Data Protection Commissioner (IDPC) in Malta at https://idpc.org.mt, without limiting any right to complain to another supervisory authority available under applicable law.