Privacy Policy

Last updated 9 October 2026 · ColbyCo Labs LLC

1. Who we are

This Privacy Policy describes how ColbyCo Labs LLC, operating as EarnWhile, collects, uses, and protects information.

ColbyCo Labs LLC is a Texas limited liability company, and is the data controller for personal information described in this policy.

You can reach us about anything in this policy at support@earnwhile.app.

2. This website

This site is a static informational website. It has no accounts, no sign-up form, no comment system and no shopping cart.

• We set no cookies. There is no analytics script, no advertising pixel and no third-party tracker on this site.
• We do not ask you for personal information. There is no form to fill in. The only contact route is an email link, and emailing us is entirely your choice.
• Server logs. The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes standard request data — including IP address, user agent, and the page requested — in order to serve the site and protect it from abuse. We do not use this data to build profiles of visitors.

If you email us, we receive whatever you put in that email, and we keep the correspondence for as long as needed to deal with your query and to keep a record of it.

3. The EarnWhile app

EarnWhile is in development and has not been released. It is not available to the public yet, so this section describes what the app does for anyone using a pre-release build today. Earning providers and cash out remain disabled for public access. We will update it before release if anything changes.

Information you give us

• Email address — to create and sign in to your account. If you sign in with Apple or Google, we receive the identifier and email address that service returns.
• Display name — optional, and shown only to you.
• Preferences — the amount of time you usually have, the opportunity categories you're interested in and your preferred payout method. A stored payout preference does not initiate a payout. Public cash out is unavailable.
• PayPal payout account — eligible accounts can use PayPal's sign-in and ownership-verification flow to connect a payout account when PayPal approval and the server rollout permit it. EarnWhile does not collect your PayPal password or card/bank credentials. When connected, the verified payout destination is stored encrypted on the server with a keyed digest and an account-linked reference. Connecting creates no payout.
• Your confirmation that you are 18 or older — when you sign in, the app asks whether you are 18 or older. If you answer yes, we store that confirmation, the time you gave it and the version of the wording you saw. We do not ask for or store your date of birth, and we do not verify your age; we rely on your answer. If you answer that you are under 18, nothing is stored and earning is unavailable for that session. Your answer is never sent to an opportunity provider.

Information collected automatically

• Device model and operating system version — to support the app and detect abuse.
• A device identifier we generate — see the next section.
• Activity within the app — which opportunities you view, start and complete, so we can show your progress, credit rewards correctly, and improve how opportunities are ranked. Provider activity has occurred during controlled pre-release tests. We do not send this activity record to opportunity providers; section 7 describes what a provider does receive.
• Authentication and technical records — our Supabase service stores authentication events, session information and request logs. These can include account or session identifiers, IP address, User-Agent/device/browser information, timestamps, request paths and status, errors and performance timing. Hosted request logs can also contain coarse location derived from network traffic, such as country, region or city. Some records are linked to your account directly or through session/request identifiers. We use them to operate and secure the service, prevent fraud and diagnose failures; not for advertising or cross-company tracking.

Information used only on your device

Your country and language are read from your device settings and used locally to work out which opportunities you're eligible for. Your cached opportunity list is stored on your device. This information is not transmitted to us as part of that process, and we do not send it to opportunity providers; a provider works out your location from your IP address, as described in section 7. This local use is separate from the hosted network-derived location records described above.

4. Device identifier

When the app first runs, it generates a random identifier for your device and stores it in the iOS Keychain. It is not Apple's advertising identifier, it is not the vendor identifier, and it cannot be used to link you across other companies' apps.

We use it to associate your account with the devices you sign in from, which is one of the signals that helps us detect fraudulent reward claims.

One thing worth knowing: because it lives in the Keychain, this identifier survives deleting the app. If you delete EarnWhile and reinstall it, the same device identifier is used. That is deliberate — it is part of what makes it useful against repeat abuse — but most people assume deleting an app resets everything, so we would rather say it plainly. Deleting your account clears it from your device and removes our record of it — see section 8.

5. Advertising and tracking

The app does not use Apple's advertising identifier (IDFA), and it contains no advertising SDK, no analytics SDK and no attribution SDK.

Those facts alone do not establish how survey providers use information they collect. Section 7 describes provider collection and links to their policies. CPX's integration-specific advertising, cross-publisher linking and data-broker practices remain unverified. Public provider access remains disabled while we complete that assessment. We will not enable public access that requires Apple's App Tracking Transparency permission without requesting that permission before the tracking occurs.

6. Service providers

We keep this list short on purpose. At present it is:

• Supabase — authentication, database and backend hosting for the app.
• Cloudflare — hosting and protection for this website.
• Apple — App Store distribution, and Sign in with Apple if you use it.
• Google — only if you choose to sign in with a Google account.
• PayPal — payout-account ownership verification when available to an eligible account, and payout processing when separately enabled and authorized. Public cash out is currently unavailable.

These providers process information on our instructions in order to deliver their service. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

7. Opportunity providers

Earning providers are disabled for public access. The current App Store submission uses TheoremReach only; CPX Research is excluded from its inventory and background requests. Earlier pre-release builds have used CPX Research and TheoremReach in controlled testing. These tests do not enable public earning or cash out. The following describes provider data flows when access is enabled for an eligible account.

What a provider receives from us. To ask a provider which opportunities are open to you, and so that it can credit you when you finish, our servers send it:

• a reference identifier we generate for you, specific to that provider. It is a random value, not your name, email address or account ID;
• your IP address, which providers use to work out your location, decide eligibility and detect fraud. We do not send a country or language setting;
• for TheoremReach, a session identifier we generate to match its report to the session. CPX Research uses the provider-specific user reference and its transaction identifier for reward and reversal attribution; we do not send CPX an EarnWhile session identifier.

We do not send a provider your name, your email address, your account ID, the device identifier described in section 4, or your confirmation that you are 18 or older.

What a provider sees directly. When you start an opportunity, it opens in a browser window inside the app, on the provider's site. From that point the provider receives what any website receives from a visitor — your IP address and information about your device and browser — along with anything you enter there. Their privacy policy governs what they collect. We will identify the provider before you start.

TheoremReach survey responses. TheoremReach collects voluntary demographic information and survey answers directly in its web experience for survey matching and market research. Depending on the survey, answers may include contact details, household income, education, preferences, health information or sensitive demographic information. Participation is optional; review the TheoremReach Privacy Policy and the survey notice before answering. Responses may be linked to the provider reference. TheoremReach and the market-research buyers handle raw answers; EarnWhile cannot access them through its API, callback, dashboard or export. EarnWhile receives completion and reward attribution instead. TheoremReach has confirmed that this integration does not perform Apple-defined tracking, use IDFA or require an ATT prompt. Its session cookies/storage support survey routing, session state and fraud/security checks, not advertising retargeting.

What a provider sends us. Providers report completions and reversals back to our servers, using the provider-specific identifiers described above, together with the reward amount and, for some providers, the IP address they recorded. We keep those reports to credit rewards, apply reversals and reconcile with the provider — see section 8.

CPX Research participation. Before controlled CPX access is enabled, we ask the participant to accept this notice and record that acceptance. CPX and its survey partners collect information you submit, including survey answers, and may collect IP address, device/browser information and identifiers, cookies and response metadata for survey matching, participation measurement and fraud checks. Review the CPX participant Terms and CPX Privacy Policy for their full practices and choices. Participation is optional. You can decline access or ask us to remove your controlled access through support@earnwhile.app. EarnWhile records eligible rewards as USD wallet amounts, subject to provider confirmation and reversals; public cash out remains unavailable.

8. Retention and deletion

We keep account information for as long as an account exists. Support emails are kept for as long as we need them to handle a query and keep a record of it.

You can delete your account in the app, from Profile. EarnWhile is in development and has not been released, so today this applies to anyone using a pre-release build. If you cannot use the app, email support@earnwhile.app.

Deleting your account cannot be undone. When you confirm, we:

• clear your profile — your display name, email address, location and avatar are removed from it;
• remove your saved preferences, including any retained legacy weekly-goal preference;
• remove active encrypted payout destinations and recipient-verification data; financial and reconciliation evidence described below remains linked to the internal account reference;
• remove the record of which opportunities you viewed, opened and started, and any personalized opportunity links prepared for you;
• remove the list of devices signed in to your account, and clear the device identifier described in section 4 from your device;
• remove your stored confirmation that you are 18 or older;
• disable sign-in. Your sign-in record is kept but blocked, its email address is replaced with a placeholder, its sessions are ended, and the link to your Apple or Google account is removed. If you signed in with Apple, the app asks you to confirm with Apple so that we can also ask Apple to disconnect EarnWhile from your Apple Account. If that step does not happen, your account is still deleted, and the app tells you how to remove EarnWhile from your Apple Account in Settings yourself.

What we keep. Some records stay after deletion, under the internal account reference — a random identifier — that your account used: records of rewards, reversals and payouts; the reports opportunity providers send us about your activity, which we need to match a late completion or reversal to the right account; the provider reference identifiers issued for your account, marked as revoked; fraud and security review records; and a record of the deletion itself, holding that reference, timestamps and counts of what was removed. These records are not anonymous: they remain linked to that internal reference, and the deletion record can be read from the account it belongs to. The sign-in record the reference points to is disabled and no longer carries your name or email address.

Authentication records and hosted logs. Account deletion does not erase historical authentication events or hosted request logs. Those records can retain earlier identifiers, IP/User-Agent information, coarse network location and technical diagnostics independently of the profile deletion. We have not established a verified purge deadline for every such record type; we do not claim that deleting an account immediately removes these records or that an automatic purge exists.

Retention periods. Our retention policy sets 7 years for financial records and 2 years for fraud and security evidence. Those are policy periods, not deadlines: nothing is deleted automatically when they end. What happens to these records after those periods, and the legal basis for keeping them, has not been settled, and we will update this section when it is.

Your balance. Deleting does not automatically cash out available or pending rewards, and deletion ends your normal access to any remaining balance. The app shows the amount before you confirm. If a payout request is in progress, we refuse the deletion until it has finished or failed, and the app says why. Cash out isn't available yet, so today no balance can be withdrawn before deleting.

9. Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected, to have it deleted, to receive a copy in a portable format, and to object to or restrict certain processing. Residents of California, and residents of the EU and UK, have specific rights under their own laws.

Email support@earnwhile.app and we will respond within the timeframe the applicable law requires. We will not discriminate against you for exercising any of these rights.

10. Children

EarnWhile is for adults. The app asks every user to confirm that they are 18 or older, as described in section 3; it does not verify that answer, and it does not collect a date of birth. Anyone who answers that they are under 18 cannot use earning features in that session, and that answer is not stored. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Security

Account data is held in a database with row-level access rules, so one account cannot read another account's data. Balances and reward records are written only by our backend — the app itself has no ability to alter them. Traffic between the app and our backend is encrypted in transit.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information, we will notify you as required by law.

12. Changes to this policy

We will update this page when our practices change, and always before the app is released. The “last updated” date at the top shows the current version. Material changes will be communicated in the app.

13. Contact

ColbyCo Labs LLC
United States
support@earnwhile.app