Privacy policy
Which personal data we process, why, on what legal basis, who we share it with, how long we keep it and how you can exercise your rights. We apply Regulation (EU) 2016/679 (GDPR) to users in the European Union and the European Economic Area, and give everyone else the same safeguards.
Last updated:
This English version is a translation provided for convenience. The Spanish version is the reference text and prevails in case of any discrepancy. Leer en español
1. Data controller
The controller of your personal data is the company that operates FreeBTC:
- Company: Investments & Solutions B.V.
- Company registration no.: 156206 (Registro Mercantil de la Cámara de Comercio e Industria de Curaçao)
- Registered office: Fransche Bloemweg 4, Willemstad, Curaçao
- Jurisdiction: Curaçao
- Email: freebtc.app@gmail.com
- Gaming licence: application in progress
- Website: freebtc.app
We have not appointed a data protection officer because our activity does not require one. For any privacy question, write to freebtc.app@gmail.com.
2. Scope and EU representative
The company is established in Curaçao, outside the European Union. Because we offer FreeBTC to people in the European Union and the European Economic Area (EEA), the GDPR applies to the processing of their data (article 3(2) GDPR).
EU representative (article 27 GDPR): [Pending: EU representative]. If you are in the EU or the EEA, you can contact our representative, as well as us, about any matter relating to the processing of your data.
If you are outside the EU and the EEA, we give you, as our own commitment, the same rights and safeguards described in this policy, without prejudice to any rights the law of your country gives you.
3. What data we process
- Your Google account data. When you sign in with Google, we receive your Google account identifier, your email address and your name. We never receive your password.
- Profile. Your nickname (generated automatically, and you can change it) and your language.
- Game activity. The chips you receive and play, your plays and their results, your results in skill games, and your positions and prizes in the rankings.
- Balance and payments. Your satoshi balance and transaction history, the Bitcoin and Lightning addresses you give us for withdrawals, your withdrawals, and your orders and payments (for example when you sponsor a block or buy the season pass).
- Partner earnings. The records offer and survey companies send us when you complete something with them: transaction identifier, amount, status and, where applicable, reversal.
- Invitations. The invite code you arrived with and the link between the person who invites and the person invited.
- Fraud-prevention signals. Short, salted cryptographic digests (hashes) of your IP address and of your browser’s user agent. We do not store your IP address in clear text in our database.
- Automation-detection signals. Patterns derived from your activity on FreeBTC (for example, the pace and timing of your plays and chip claims, the number of offers per hour and the share of reversed offers) and the use of the same payout address on several accounts, to detect bots and multiple accounts.
- Human check. When you claim free chips or request a withdrawal, Cloudflare Turnstile checks that you are a person. We only receive the result of that check.
- Communications. The emails you send us and our replies.
- Technical data. Web server logs, which may include the IP address, date and page requested, used only for security and troubleshooting.
Public data. Any visitor can see your nickname, your ranking positions and prizes and, if you sponsor a block, the name and message you write for the dedication. Do not use your real name or personal data in your nickname or dedications if you do not want them published.
We do not process special categories of data. Our partners’ surveys may ask you personal questions: those answers are received and processed by each partner, not by FreeBTC.
4. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account and letting you sign in with Google. | Performance of a contract (art. 6(1)(b)): the Terms of use. |
| Providing the game: giving you chips, recording your plays, calculating the rankings and publishing them with your nickname. | Performance of a contract (art. 6(1)(b)) and of the Rankings rules. |
| Managing your balance, crediting prizes and partner earnings, processing your withdrawals, orders and payments. | Performance of a contract (art. 6(1)(b)). |
| Running the invitation programme. | Performance of a contract (art. 6(1)(b)). |
| Preventing fraud and protecting the service: checking that you are a person when you claim chips and withdraw (Cloudflare Turnstile), detecting multiple accounts, automation and abuse, and reviewing earnings and withdrawals. | Legitimate interest (art. 6(1)(f)) in protecting the service, players and partners against fraud (recital 47 GDPR). |
| Measuring how the site is used in aggregate (page views, traffic sources, device) with Google Analytics, to improve it. | Your consent (art. 6(1)(a) GDPR and, in the EU, art. 5(3) of Directive 2002/58/EC), which you can withdraw at any time. |
| Answering your questions and requests to exercise your rights. | Performance of a contract (art. 6(1)(b)) and compliance with legal obligations (art. 6(1)(c)). |
| Showing Google advertising on content pages. | Your consent (art. 6(1)(a) GDPR and, in the EU, art. 5(3) of Directive 2002/58/EC), which you can withdraw at any time. |
| Meeting accounting and tax obligations and responding to requests from authorities. | Compliance with legal obligations (art. 6(1)(c)). |
| Keeping the site secure through technical logs. | Legitimate interest (art. 6(1)(f)) in network and information security (recital 49 GDPR). |
Your Google account data is required to create an account: without it we cannot provide the service. We do not send you marketing emails; if we ever want to, we will first ask for your consent where the law requires it.
Where the basis is legitimate interest, we have assessed that our interest does not override your rights: we use the minimum data (for example, hashes instead of IP addresses) and you can object at any time, as explained in section 9.
5. Automated decisions
We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (art. 22 GDPR).
Our anti-fraud system automatically flags accounts that show risk signals, for example several accounts earning from the same connection. A flagged account is not blocked automatically: its partner earnings and withdrawals go to review by a person, who makes the decision. While under review, the account does not receive ranking prizes either. You can give us your point of view and contest the decision by writing to freebtc.app@gmail.com.
6. Recipients
We do not sell your data. We only share it with third parties in these cases:
- Hosting provider (processor). OVHcloud hosts our servers in data centres in the European Union, under a processing agreement in line with article 28 GDPR.
- Cloudflare (human check). When you claim free chips or request a withdrawal, Cloudflare Turnstile checks that you are a person and not a bot. To do so, Cloudflare processes your IP address and technical signals from your browser and device under its own privacy policy, and returns only the result to us.
- Google. For sign-in, Google Ireland Limited / Google LLC processes your Google account data under its own privacy policy. If you accept optional cookies, Google Analytics measures site usage on our behalf (with IP anonymisation and never linked to your account) and Google AdSense processes browsing data as an independent controller.
- Offer and survey partners (Offerwall.me, CPX Research, TheoremReach and Wannads). When you open the partners section on the Earn page (the first wall opens by itself, the others when you choose them), we send it your FreeBTC user identifier (and, for CPX Research, a verification code derived from it) so it can tell us what you complete. What you do on their service is processed by them as controllers, under their own policies.
- Payments. Lightning payments are handled with BTCPay Server, software we host ourselves, with no intermediary. Please note that Bitcoin network transactions are public by nature: a withdrawal to an address is recorded on the blockchain.
- Authorities and courts, when the law requires it.
Services that do not receive your data. Our server fetches public data from mempool.space (blocks and network) and from Coinbase (1-minute BTC-USD candles), and asks AI models (from OpenAI, DeepSeek, Moonshot AI, Google and Mistral AI, served by Ollama Cloud) for forecasts for the “Humans vs AI” game. In none of these cases do we send personal data. For affiliate links we only count clicks on our server; whatever you then provide on the third party’s site is processed by that third party.
7. International transfers
The controller is established in Curaçao, outside the European Economic Area (EEA). We collect the data you give us directly, as a controller subject to the GDPR (section 2), and host it in OVHcloud data centres in the European Union. Where the company accesses it from outside the EEA, we apply the appropriate safeguards provided for in Chapter V GDPR, such as the standard contractual clauses approved by the European Commission, and protect your data to the standard the GDPR requires.
In addition, some of the third parties mentioned may process data outside the EEA:
- Google and Cloudflare may process data in the United States. Google LLC and Cloudflare, Inc. participate in the EU-U.S. Data Privacy Framework, covered by the European Commission’s adequacy decision of 10 July 2023, and also apply standard contractual clauses approved by the Commission where relevant.
- Offer and survey partners. Some may be established or process data outside the EEA. Sending your user identifier when you open their wall relies on the safeguards each partner provides (such as standard contractual clauses) or, failing that, on it being necessary to provide the service you ask for (art. 49(1)(b) GDPR).
8. How long we keep your data
| Data | Period |
|---|---|
| Account and profile (Google, nickname, language) | While your account is active. After closure, blocked for the limitation period of any claims that may arise under applicable law (generally 5 years), then deleted. |
| Balance, transactions, prizes, partner earnings, withdrawals, orders and payments | As long as required by applicable accounting and tax law (generally 6 years). |
| Chip plays and game results | While your account is active. Closed rankings are kept as the public record of the contest; if you close your account, you can ask us to stop showing your nickname in them. |
| Withdrawal addresses (Bitcoin and Lightning) | While your account is active; addresses used for a withdrawal are kept with that transaction (same period). |
| Fraud signals (IP and user-agent hashes) | Up to 12 months from collection, or longer if linked to an open review or claim, until it is concluded. |
| Support emails | As long as needed to handle your request and up to 2 years afterwards, unless needed for a claim. |
| Server technical logs | A maximum of 30 days, unless needed to investigate a security incident. |
| Your cookie choice | In your browser, 12 months; then we ask again. |
9. Your rights
If you are in the EU or the EEA, the GDPR gives you the rights below. Wherever else you are, we give you the same rights as our own commitment. You may exercise them at any time, free of charge:
- access: to know what data we process about you and get a copy;
- rectification: to correct inaccurate data (you can change your nickname directly in your profile);
- erasure: to ask us to delete your data, except data we must keep by law, which will be blocked;
- objection: to object, on grounds relating to your particular situation, to processing based on legitimate interest;
- restriction: to ask us to suspend processing in the cases provided for in the GDPR;
- portability: to receive the data you gave us in a structured, commonly used format;
- withdrawal of consent at any time, without affecting the lawfulness of prior processing (for advertising, from “Cookie preferences” at the bottom of every page);
- not to be subject to decisions based solely on automated processing (section 5).
How to exercise them. Write to freebtc.app@gmail.com from the email address linked to your account, or by post to our registered office (Fransche Bloemweg 4, Willemstad, Curaçao), stating the right you want to exercise. If you are in the EU or the EEA, you can also contact our EU representative (section 2). If we cannot verify your identity, we will ask for the minimum information needed. We will reply within one month, extendable by two further months for complex requests, in which case we will let you know.
If erasure affects data the account needs, it will mean closing the account. Before that, we recommend withdrawing your balance if it reaches the withdrawal minimum.
Complaints. If you believe we have not handled your rights properly and you are in the EU or the EEA, you can lodge a complaint with the data protection authority of the country where you live, work or where the alleged infringement took place (the list of authorities is on the European Data Protection Board website). If you are elsewhere, you can contact the authority that is competent under the law of your country. We encourage you to write to us first so we can try to resolve it.
10. Minors
FreeBTC is only for people aged 18 or over (or the age of majority in their country, if higher). We do not knowingly collect data from minors. If we find that an account belongs to a minor, we will close it and delete its data, except data we must keep by law. If you are a parent or guardian and believe a minor has created an account, write to freebtc.app@gmail.com.
11. Security
We apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), restricted access to data, sign-in with Google (we store no passwords) and pseudonymisation of fraud signals. If a security breach poses a risk to your rights, we will notify the competent data protection authorities and, where required, you, as the GDPR provides.
12. Changes to this policy
We may update this policy to reflect legal or service changes. We will publish the new version on this page with its date. If the change is significant, we will tell you prominently on the site or by email before it applies.