Privacy Policy

01Who We Are and What This Policy Covers

This Privacy Policy explains how Leaps Gaming Ltd. ("Leaps", "we", "us", "our") collects, uses, shares and protects personal information when you use SpeedCash, including the SpeedCash apps, website and Rewards Program (the "Services"). Words with capital letters that are not defined here have the meaning given in our Terms of Service.

• Controller. Leaps Gaming Ltd., company no. 517070504, Carlebach 1, Tel Aviv, Israel, is responsible for your personal information.
• Contact. Email support@leaps.io with the subject "Privacy Request".
• EU and UK users. Contact us at privacy@leaps.io.
• Data Protection Officer. privacy@leaps.io
• Age. The Services are only for people 18 or older.

02Information We Collect

2.1 Information you give us

• Account details: email address, and the name and email shared by Apple, Google or another sign-in service if you use one.
• Payout details: your name, the email or account you choose for a payout (for example PayPal or a gift card), and the amount and method of each cashout.
• Verification details: your face scan and photo, a scan of your photo ID and the details on it if we ask for an ID check, the name you type to sign your consent, and the photo ID you send us by email if you verify manually (Section 3).
• Tax details: if you redeem above the Annual Redemption Limit, the information on IRS Form W-9, W-8BEN or a local equivalent, such as your name, address and taxpayer ID.
• Profile picture: if you choose to add one, the photo you select from your photo library.
• Messages: what you send to support, and your answers to surveys if you choose to take part.
• Referrals: the referral link you joined through, and the friends who join through yours.

2.2 Information we collect automatically

• Device information: device model, operating system, language, time zone and app version.
• Identifiers: our SpeedCash user ID, the Apple IDFV, and, if you allow it, the Apple advertising ID (IDFA); on Android, the Google advertising ID and App Set ID; and the push notification token.
• Network and location: IP address and the approximate location (country, region, city) we derive from it.
• Activity: games played, tasks and offers started and completed, ads viewed, Rewards credited, Tickets, Speed Spin results, Weekly Challenges, cashouts and referral bonuses.
• Security signals: signs of VPNs, proxies, emulators, rooted or jailbroken devices and automation, and links between Accounts or devices.
• Diagnostics: crash reports and performance data.

2.3 Information from partners

• Ad and offer partners: confirmation that you viewed an ad or completed an offer, its value, and any later reversal by the advertiser.
• Attribution partners: the ad campaign or source that led you to install SpeedCash.
• Payout partners: the status of your cashouts.
• Fraud prevention providers: risk scores for IP addresses, emails and devices.
• App stores: records of in-App purchases.

2.4 What we do not collect

We access your photo library only when you choose to upload a profile picture, and we use only the photo you select. We do not access your contacts, and we do not collect precise GPS location.

03Biometric Data and ID Verification

This section is our public biometric data policy and retention schedule. It applies to every user who verifies with a face scan, an ID scan or manual verification, in every US state.

3.1 What we collect. When you verify with a face scan, we capture a short selfie video and create a face map (a mathematical template of your face geometry) and a photo taken from the scan. In some cases we also ask you to scan a photo ID, such as an ID card, passport or driver's license. We then store an image of the document and the details read from it, such as your name, date of birth, document number and expiry date, and compare the face on the document with your face scan. The face map and the face on your ID are biometric data. We protect the ID image and its details in the same way.

3.2 Why we collect it. Only to confirm that you are a real, live person, that any ID you scan belongs to you, and that you are unique, by comparing your face map with the face maps of other users collected in the last four (4) months. This helps us detect duplicate and fraudulent Accounts and protect the Rewards Program. We do not use biometric data or ID information for advertising, profiling or any other purpose.

3.3 Your written consent. We never collect biometric data before you give express written consent. Before the scan, the App shows you this notice: what we collect, why, how long we keep it and where it is stored. You consent by ticking a box and typing your full name, and we email you a copy. We keep a record of your consent (date, time, notice version and the name you typed), which contains no biometric data.

3.4 Where it is stored and who handles it. Face and ID scans are processed with FaceTec software that runs on our own servers, hosted on Google Cloud in the United States. Only Leaps processes your biometric data and ID information. FaceTec does not receive your face map, photos, ID image or ID details. It receives only technical usage logs that contain no images, face maps or user identifiers. Access inside Leaps is limited to the staff and systems that need it.

3.5 Retention schedule. We permanently delete your photos, face map, ID image and ID details at the earliest of:

• four (4) months after the scan;
• when the purpose in Section 3.2 has been met;
• within thirty (30) days after you withdraw consent or close your Account; or
• any earlier date required by the law where you live.

In no case do we keep biometric data longer than the law allows, including three (3) years after your last interaction with us. After deletion we keep only a record that your Account is verified, so you do not need to verify again.

3.6 No sale or disclosure. We never sell, lease, trade or otherwise profit from biometric data or ID information. We do not disclose them to anyone unless you consent, or the law, a court order or a subpoena requires it.

3.7 Security. We protect biometric data and ID information with encryption in transit and at rest and strict access controls, using at least the same care we use for our other confidential information.

3.8 Your choices. You can see when your data will be deleted, ask for a copy, delete it, or withdraw consent at any time in Settings or by emailing support@leaps.io. If you can't or don't want to do a face scan, email support@leaps.io and we will verify you manually without biometrics (Section 3.9). Withdrawing consent does not affect your balance.

3.9 Manual verification. If you ask to verify manually, you email us a photo of an ID document that shows your photo, such as an ID card, passport or driver's license. Our team checks it by eye, without biometrics. We use it only to verify you, keep it with restricted access in our support inbox (run by our email provider under contract), and permanently delete it from email and all our systems within four (4) months. After deletion we keep only a record that your Account is verified.

3.10 State laws. This policy is designed to meet the biometric privacy laws of Illinois, Texas, Washington, Colorado and other states.

04How We Use Information

The last column applies to users in the EEA, the UK and Switzerland, where the law requires a legal basis for each use.

Automated fraud decisions. Our systems check activity for fraud signals automatically. They may hold a cashout, reject a redemption or apply a Redemption Block. You can ask for a review by a person under Section 20.3 of our Terms by emailing support@leaps.io with the subject "Account Review".

05Advertising, Offers and Analytics

5.1 How SpeedCash is funded. SpeedCash is free because advertisers pay us when you view ads or complete offers. Part of that revenue funds your Rewards.

5.2 Ad and offer partners. Ad networks, offerwall providers and attribution partners run software (SDKs) in the App. These partners collect your IP address, device information, how you interact with their ads and offers and, where you have given consent, your advertising ID. When you start an offer, the offer provider and the advertiser receive your advertising ID and device data so they can confirm completion and pay us. We do not share your SpeedCash user ID with them. They use the data under their own privacy policies. Our current partners are:

• Google (AdMob, Firebase and Google Analytics): https://policies.google.com/privacy
• Meta (Facebook SDK and Audience Network): https://www.facebook.com/privacy/policy/
• Unity (Unity Ads and ironSource): https://unity.com/legal/game-player-and-app-user-privacy-policy
• AppLovin: https://www.applovin.com/privacy/
• InMobi: https://www.inmobi.com/privacy-policy/
• Liftoff (Vungle): https://liftoff.ai/privacy-policy/
• Mintegral: https://www.mintegral.com/en/privacy/
• Adjust: https://www.adjust.com/terms/privacy-policy/
• GameAnalytics: https://gameanalytics.com/privacy/
• Tapjoy (offerwall, now part of Unity): https://unity.com/legal/game-player-and-app-user-privacy-policy

We update this list when our partners change.

5.3 Your choices.

• iPhone: we access your advertising ID only if you allow tracking when the App asks. You can change this in Settings > Privacy & Security > Tracking.
• Android: you can reset or delete your advertising ID in your device settings.
• US users: you can opt out of the sale or sharing of your personal information for targeted ads as described in Section 9.
• Opting out means fewer personalized ads. Some offers depend on tracking to confirm completion, so they may not credit Rewards if tracking is off.

5.4 Website. Our website uses cookies and similar tools to run the site, measure visits and, with your consent where required, for advertising. You can manage cookies in your browser and in our cookie settings. We honor Global Privacy Control signals.

06How We Share Information

We share personal information only as described here:

• Service providers that work for us under contract and may use the data only to provide their service: cloud hosting (Google Cloud, United States), customer support, email delivery, analytics and fraud prevention.
• Payout partners, such as Tremendous, Giftogram and PayPal, receive your name, payout email or account, and the amount, so they can deliver your cashout.
• Ad, offer and attribution partners, as described in Section 5.
• Your referrer. If you joined through a referral link, your referrer can see that you joined and the referral bonuses they earn from your activity, not your activity itself.
• Tax authorities, such as the IRS, when the law requires us to report payments.
• Legal and safety. Courts, regulators and law enforcement when the law requires it, and others when needed to prevent fraud, protect users or enforce our Terms.
• Group companies and business transfers. Companies in our group, and a buyer or successor if all or part of our business is sold or merged. They must protect your information as this policy says.
• With your consent, in any other case.

Biometric data and ID information are never shared, except as Section 3.6 allows.

07How Long We Keep Information

We keep personal information while your Account is open and as long as we need it for the purposes in this policy. After that we delete or de-identify it, unless the law requires us to keep it longer, for example payout records for tax, or we need it to prevent fraud or resolve a dispute. Biometric data and ID documents, including those sent by email, are deleted as Sections 3.5 and 3.9 say. After that we keep only a record that your Account is verified.

08Your Choices and Rights

Wherever you live, you can:

• See and correct your Account details in the App, or ask us for a copy of your information.
• Delete your Account in the App under Settings, or by email. Any Rewards and Tickets left when the Account closes are lost, so cash out first (Section 20.1 of our Terms).
• Stop marketing: use the unsubscribe link in any marketing email, and turn off push notifications in your device settings. You will still get service messages, such as cashout updates and expiry notices.
• Limit ad tracking as described in Section 5.3.
• Manage biometric data as described in Section 3.8.

How to make a request. Email support@leaps.io from your Account email with the subject "Privacy Request", and tell us what you want. To protect your Account, we may ask you to confirm your identity before we act. We reply within the time the law sets where you live: 45 days in the US and one month in the EEA and UK, which we may extend where the law allows and will tell you if we do. Some data may be kept as Section 7 allows, for example payout records we must keep for tax.

09US State Privacy Notice

This section applies if you live in California or another US state with a comprehensive privacy law.

9.1 What we collect and who receives it. In the last 12 months we collected the categories below, from the sources in Section 2, for the purposes in Section 4, and kept them as Section 7 says.

9.2 Sensitive personal information. We use it only to verify you, keep the Services secure and meet legal duties. We do not use it to infer characteristics about you.

9.3 Your rights. Depending on your state, you can:

• know what personal information we collect, use and disclose, and get a copy in a portable format;
• correct inaccurate information;
• delete your information;
• opt out of the sale or sharing of your information and of targeted advertising;
• appeal our decision on your request; and
• not be treated differently for using these rights.

9.4 How to use them. To opt out of sale, sharing and targeted ads, email support@leaps.io with the subject "Do Not Sell or Share". On iPhone you can also turn off tracking in your device settings (Section 5.3). We also honor Global Privacy Control signals on our website. For other requests, email support@leaps.io with the subject "Privacy Request". An authorized agent can make a request for you with your signed permission. We verify requests by matching them to your Account email.

9.5 Appeals. If we deny your request, reply to our answer with the subject "Privacy Appeal" within 60 days. We will answer within 60 days. If you disagree with our answer, you can contact your state Attorney General.

9.6 Minors. The Services are for adults only. We do not knowingly sell or share the personal information of anyone under 18.

9.7 Shine the Light. California residents can ask once a year about disclosures to third parties for their direct marketing by emailing support@leaps.io with the subject "Shine the Light Request".

9.8 Notice of Financial Incentive. The Rewards Program may be considered a financial incentive under California law, because Rewards are linked to the collection and use of your personal information, such as advertising identifiers and app activity used to deliver ads and offers. The program's terms are in Section 11 of our Terms of Service. Taking part is completely voluntary. You join by creating an Account, and you can withdraw at any time by no longer taking part or by closing your Account. Cash out your Available Balance first. Based on the average Rewards we pay, we estimate the value of a user's personal information at about US$3 per active user per month. The Rewards you receive are reasonably related to that value.

10Users in the EEA, UK and Switzerland

10.1 Your rights. You have the right to:

• access your personal information and get a copy;
• correct it;
• delete it;
• restrict how we use it;
• receive it in a portable format;
• object to uses based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, without affecting earlier processing;
• ask for a person to review an automated decision (Section 4); and
• complain to your local data protection authority.

To use these rights, email support@leaps.io with the subject "Privacy Request".

10.2 Consent for tracking. Where the law requires it, we ask for your consent before we or our partners read or store information on your device for advertising or analytics. You can change your choice at any time in Settings > Privacy.

10.3 International transfers. We are based in Israel, which the European Commission recognizes as giving adequate protection. Your information is stored on Google Cloud in the United States, and some partners are in other countries. For transfers to the US and other countries without an adequacy decision, we rely on the EU-US Data Privacy Framework where the recipient is certified, or on the European Commission's Standard Contractual Clauses and the UK addendum, with extra safeguards where needed. You can ask us for a copy of these safeguards.

11Children, Security, Changes and Contact

11.1 Children. SpeedCash is only for people 18 or older. We do not knowingly collect information from anyone younger. If we learn that a user is under 18, we close the Account and delete their information, except what the law requires us to keep.

11.2 Security. We use encryption, access controls and monitoring to protect your information. No system is completely secure, so keep your login details private and tell us right away if you think your Account has been compromised. If a breach affects your information, we will notify you and the authorities as the law requires.

11.3 Changes. We may update this policy. We will post the new version here with a new date at the top, and tell you in the App or by email if we make a material change.

11.4 Contact us. Leaps Gaming Ltd., Carlebach 1, Tel Aviv, Israel. Email support@leaps.io with the subject "Privacy Request".

Contact us