Privacy Policy

This policy applies to all users of the Service. By using the Service, you acknowledge the practices described here.

We collect the following categories of personal data:

• Account data: your email address; and, if you sign in with Google, the name and profile picture Google provides. Passwords (for email sign-up) are stored only as secure cryptographic hashes — we never see or store your plaintext password.
• Profile & profiling data: answers you give to self-improvement questions, your chosen language, and the segments derived from your answers. Profile answers can include your phone number, where a profile question asks for it.
• Tasks & evidence: the tasks assigned to you, your submissions, and any evidence you upload to prove completion (photos, screenshots, links, or short text).
• Gamification data: experience points, levels, streaks, your wCoin balance and transaction history, and your Impact Circle progress.
• Referral data: your referral code and who referred you (if anyone).
• IP address and browser user agent, collected when you use certain features (such as submitting contributions or tasks, claiming a referral, reviewing, completing onboarding, or changing your marketing preferences), to prevent fraud and abuse and to record your marketing choices.
• Device & security data: a device fingerprint computed in your browser from hardware and browser characteristics, plus technical signals (IP address, browser user-agent, event type) recorded for security and fraud prevention.
• Usage data: the dates on which you are active, used to measure engagement and retention.
• Communications: feedback, bug reports, and suggestions you submit, including any optional screenshots.
• Legal acceptance records: your confirmation that you are 18 or older, and which version of our Terms of Service and this Privacy Policy you accepted, and when.

• Directly from you — when you sign up, answer profiling questions, submit task evidence, or send feedback.
• Automatically — your device fingerprint, IP address, browser details, and activity dates.
• From Google — if you choose Google sign-in (your email, name, and profile picture).

We process your data to create and manage your account; assign and verify tasks; operate the rewards system; personalize tasks to your profile; prevent fraud and abuse; secure the Service; communicate with you; and improve the Service.

Age confirmation and legal acceptance records: to keep the service for adults only and to show that you accepted our Terms and this Policy (compliance with legal obligations and our legitimate interests).

We4Max is a global service. We apply the protections of the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK) to all users, wherever you are located, as our baseline standard.

Our legal bases for processing are: performance of our contract with you (providing the Service); our legitimate interests (security, fraud prevention, and service improvement); your consent where specifically requested; and compliance with applicable legal obligations.

When you submit a photo or screenshot as task evidence — and, for some tasks, short text submissions — it is sent to Anthropic’s Claude API for an automated pre-screening check that helps verify your submission matches the task. This automated check assists human review; it does not, by itself, finally approve or reject your task. Please do not include sensitive personal information in the evidence you upload.

We use the following providers to run the Service. Each processes data only as needed to provide its function:

• Vercel (United States) — application hosting.
• Hetzner (United States) — server hosting for our database, authentication, and file storage.
• Cloudflare (United States / global) — DNS, content delivery, bot protection, and encrypted backups.
• Anthropic (United States) — AI pre-screening of task evidence (see Section 5).
• Resend (United States) — delivery of transactional emails such as password resets and the weekly digest.
• Google (United States) — authentication, only if you choose Google sign-in.
• Sentry (United States) — application error monitoring (diagnostic error reports only; configured to exclude personal data and session recordings).

Your device fingerprint is computed in your own browser using open-source software and stored by us; it is not sold or shared with any fingerprinting vendor.

Our infrastructure and several providers are located in the United States. If you access the Service from outside the United States, your data is transferred to and stored there. Where required, we rely on appropriate safeguards (such as standard contractual clauses) together with your consent or the necessity of the transfer to perform our contract with you.

We use only essential cookies needed to operate the Service: a session cookie to keep you signed in, a cookie to remember your language preference, and a security cookie used by our bot-protection check. We do not currently use advertising or third-party tracking cookies. If we add any in the future, we will update this policy and request consent where required.

We keep your account and related data for as long as your account is active. In-app notifications are automatically deleted after 30 days, and backups are retained for 30 days. Security and fraud-prevention records, including your IP address, browser user agent and a hash of your device fingerprint, are kept for up to 12 months from the date they were collected, including after you delete your account, and are then deleted. Records of the administrative decisions we take to prevent fraud, such as the review of a fraud flag or a change to the risk status of an account, are kept for the life of your account, to prevent fraud and to document those decisions. These records hold no identifier of another user in their descriptive data, and your user identifier is removed from them when your account is erased. The identifier of the administrator who took a decision, and any note or reason an administrator typed, are kept with the record for the life of the record. Some earlier security records may contain the identifier of another user involved in the same action (for example, the inviting user when a referral code is used). These identifiers are not removed when an account is deleted and are deleted at the end of the 12-month retention period described above. When you delete your account, it is locked immediately and your personal data is permanently erased by an automated process within 30 days at the latest from the end of a 7-day cancellation window. Diagnostic logs of a failed erasure attempt can contain your account identifier and are deleted automatically within 14 days. The exceptions are the security and fraud-prevention records described above, which after deletion are kept with your user identifier removed until 12 months after they were collected, and any limited information we must retain to comply with legal obligations or resolve disputes. Legal acceptance records, including your age confirmation, are kept after account deletion with your account identifier removed, as evidence that the required confirmations were given. Records of individual wCoin transactions are kept after account deletion: the account field is cleared, but some of these records still contain your user identifier, or the identifier of another user involved, inside an internal reference value. We keep them to keep our wCoin records accurate, to prevent fraud and abuse, and to establish or defend legal claims. Records of role changes and of quality audits of review decisions are kept with your user identifier removed. A record that the erasure was carried out is also kept, identified only by a keyed hash of your former account identifier, as evidence that the deletion was completed. We have not set a fixed end date for these records or for the legal acceptance records. Details are at we4max.com/data-deletion. Erased data may remain in encrypted backups until those backups expire, within 30 days. You can delete your account yourself at any time — see Section 11.

Short-lived security logs. When our servers reject a request because it exceeds a rate limit, we log the IP address it came from, the request path and the time of the request. We use these logs only to detect and prevent abuse, on the basis of our legitimate interest in the security of the Service. They are not linked to your account, and each entry is deleted automatically after at most 24 hours.

We protect your data with encryption in transit (HTTPS/TLS), hashed passwords, database-level access controls, and our fraud-prevention system. No system is perfectly secure, but we take measures reasonable for a service of our size.

We extend the following rights to all users, wherever you are located: to access your data, correct it, delete it, restrict or object to its processing, and request a copy in a portable format. These mirror the rights granted under the GDPR and the KVKK (Article 11), including the right to learn whether your data is processed and to request information about it.

You can exercise the main rights yourself, inside the app:

• Export your data: in Settings > Data & privacy, choose Download my data to download a copy of your profile, activity, submissions and rewards in a portable format. Links to evidence files in the export expire after 7 days, so download them within that time.
• Delete your account: in Settings > Data & privacy, choose Delete my account. Your account is locked immediately and permanently erased after a 7-day grace period; you can cancel at any time during those 7 days by signing in again. See we4max.com/data-deletion for exactly what is deleted and what is kept.
• Deactivate your account temporarily: from your account settings you can deactivate your account instead of deleting it. Your data is kept, you stop receiving the weekly digest email, and you can reactivate at any time by signing in again. Reactivation is not available while an account deletion is pending.

For any other request, or if you cannot sign in, email privacy@we4max.com from the address registered to your account and we will respond within a reasonable time. You also have the right to lodge a complaint with the data protection authority that applies to you.

The Service is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us their data, contact privacy@we4max.com and we will delete it. When you create an account, you must confirm that you are 18 or older; without this confirmation, an account cannot be created.

We may update this policy from time to time. We will update the "Last updated" date shown above. If we make a material change, we will ask you to review and accept the updated Policy before you continue using the service, and we keep a record of the version you accepted.

For any privacy question or to exercise your rights, email privacy@we4max.com.