Legal

Privacy Policy

Last updated: 22 September 2026

1. Who is responsible

The project owner and data controller is Alin Daniel Epure, EarnBack project. Privacy contact: info@lentita.com.

2. Data processed on this preview

This site is hosted by GitHub Pages. GitHub may process technical request data such as IP address, date and time, requested resource, user agent, referrer, and security events under its privacy statement. EarnBack does not receive visitor analytics from this build.

3. Data processed by the iPhone beta

EarnBack may process an account identifier, authentication session, email address, optional display name, identity provider, preferred locale, and accepted legal-document versions. Apple may provide a private relay address. EarnBack never receives an Apple or Google password.

Challenge type, distance, timing, state, test-credit result, location, motion, steps, battery state, interruption evidence, and opaque Family Controls selections are processed on the iPhone. Raw routes, motion samples, Family Controls selections, and challenge history are designed to remain on the device in the current beta and are not uploaded to Supabase.

4. Purposes and legal bases

• Delivering and securing the website: legitimate interests in providing a reliable and secure service.
• Complying with legal obligations: where records must be retained or disclosed by law.
• Optional future services: consent will be requested before newsletters, analytics, advertising, or other optional processing is activated where consent is required.

5. Cookies and similar technologies

The current site does not set cookies or use local storage, analytics, profiling, or advertising technology. See the Cookie Policy. Optional technologies will not be loaded before the required consent is obtained.

6. Providers, recipients, and transfers

Supabase, Inc. supplies authentication, the profile database, and the authenticated account-deletion function from an EU project region in Ireland. Apple Inc. processes Sign in with Apple, Family Controls, TestFlight, and platform services. Google LLC processes Google sign-in when selected. GitHub, Inc. hosts the public pages and may process technical request logs. Some providers may process data outside the EEA using their published transfer safeguards.

EarnBack does not sell personal data and does not share it for targeted advertising. No analytics, mailing-list, advertising, or embedded-media provider is integrated.

7. Retention and deletion

EarnBack stores no direct website visitor data. Account and profile data remain until the user deletes the account, unless limited retention is legally required. Authentication sessions expire or are invalidated under the configured security rules. Current challenge history and device evidence remain locally on the iPhone.

The app includes Delete account. The authenticated deletion function removes the Supabase authentication user and related profile; the app clears its authenticated session and local user data. If in-app deletion is unavailable, contact info@lentita.com.

8. Your rights

Where the GDPR applies, you may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent at any time without affecting earlier lawful processing. You may also complain to the competent supervisory authority; in Italy this is the Garante per la protezione dei dati personali.

9. Children

The beta is not directed to children. It must not be offered below the minimum applicable age until the age policy and any required parental-consent flow are completed.

10. Security and beta limitations

EarnBack uses provider-managed authentication, row-level database policies, protected deployment secrets, TLS, and an authenticated server-side deletion function. The current beta uses test credits only. Real-money balances and payment processing are disabled.

11. Changes

Material changes will be dated on this page. If a change requires consent, the relevant processing will remain disabled until consent is obtained.