Privacy Policy

Foxxlo is operated from France and is the data controller for the data described here. Because we are established in the EU, we apply the GDPR to every member, wherever you live.

You can reach us at privacy@foxxlo.com. If email does not work for you, you can also write to us through the application form — say in the message that it is a privacy request and we will answer there.

We collect as little as we can. Here is the full list.

Apart from the name or nickname you choose to give on the application form, we do not collect identity data: no date of birth, no ID documents, no precise location, and no special category data (health, religion, political views). We do not track you across other websites.

We do not sell your data, and we do not use it to send you marketing from other companies.

The offers and surveys are not ours. When you open an offerwall, you are opening a third-party service inside our site, and that partner receives:

• a user identifier — the number of your Foxxlo account, so your reward can be tracked back to you;
• technical data their own systems collect: your IP address, device and browser information, and your country.

We do not send them your email address, your password, your Discord handle or your payment details.

Once you are on their wall, that partner is responsible for the data it collects, under its own privacy policy — and so is the advertiser whose offer or survey you choose to complete. If an offer asks you for personal information (an email, a phone number, a card for a free trial), that is a decision you make with that advertiser, not with us. Read what you are signing up for, and never give payment details to an offer you do not trust.

They send back to us: the offer name, the amount, a transaction ID, and whether the completion is valid or cancelled. We store that message as we received it.

• Our hosting provider — the site and its database run on a server we rent from OVH, a European hosting company. OVH stores the data on our behalf and is not allowed to use it for anything else.
• Our email and domain provider — it carries the messages sent to and from our addresses.
• Payment providers — GCash, PayPal, crypto networks or gift-card suppliers receive what is needed to send your payout, and nothing more.
• Offerwall networks — as described in section 4.
• Discord and Telegram — if you talk to us there, those platforms process the conversation under their own policies.
• Authorities — only if the law requires it.

That is the complete list. Nobody else gets your data, and we never sell it.

We use one cookie: a signed session cookie that keeps you logged in. It is strictly necessary for the site to work, so it does not need your consent, and it is emptied when you log out.

We use no advertising cookies, no tracking pixels and no third-party analytics on our own pages. The offerwall partners may set their own cookies once you open their wall — that is their service and their policy.

Two things are automatic: crediting a reward when a network's callback arrives and passes its signature check, and moving it from pending to confirmed once the verification window has passed. A cancellation sent by a network is also applied automatically, because the money has already been taken back from us.

Everything that really affects you is decided by a person: accepting or refusing an application, suspending an account, and approving or refusing a payout. We do not profile you and we do not use any scoring system to decide who gets paid. If a decision looks wrong to you, ask us — you always get a human answer and the reason.

We keep data only while it is still doing a job. In practice:

• Applications we refused — deleted once the decision is made and you have been told, unless the application was itself an attempt to cheat (see below).
• Account data — while your account is open, then deleted within 30 days of closing it.
• IP addresses, network callback logs and invitation records — while they can still be needed to investigate fraud or a disputed reward, then deleted. That means at least as long as a reward can still be cancelled or claimed, and not indefinitely.
• Payout records — as long as French accounting law requires (currently ten years). Only the amount, date and method are kept, not your whole profile.
• Support messages — while the question or dispute is open, and for a reasonable time afterwards in case it comes back.
• Accounts closed for fraud — we keep a minimal record (email, IP, reason) so the same person cannot simply come back with a new invitation.

We are still a young site and we have not fixed a number of months for every category. Rather than print a figure we would not respect, we tell you the rule we follow. Ask us at any time what we still hold about you, and we will tell you and delete what no longer has a reason to exist.

You can ask us, at any time, to:

• Access — get a copy of everything we hold about you.
• Rectify — correct anything that is wrong (email, country, Discord handle).
• Erase — delete your account and your data.
• Object — object to the processing we base on our legitimate interest.
• Restrict — ask us to pause processing while a dispute is being sorted out.
• Portability — receive your account and earnings data in a machine-readable file.

Write to privacy@foxxlo.com, or use the application form if you cannot email us. We answer within 30 days, and it is free. We may ask you to confirm your identity from your registered email address, so that nobody else can request your data.

Two honest limits: we cannot delete the accounting records the law makes us keep, and if you ask for deletion while you still have a balance, withdraw it first — deleting the account also deletes the balance.

If you are unhappy with how we handled your request, you can complain to the data protection authority of the country where you live or work. In France this is the CNIL (www.cnil.fr). You can do that even if you never wrote to us first — but we would rather fix it ourselves.

Our database runs on a server rented from OVH, a European hosting company. If you want to know the exact data centre and country for the server in use today, ask us and we will tell you.

Our members are worldwide, and several of our partners — offerwall networks, payment providers, Discord, Telegram — are based in the United States or elsewhere. When data goes to them, it leaves the EU.

For those transfers we rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision where one exists for that country. You can ask us which mechanism applies to a specific partner.

• Passwords are hashed with bcrypt. Even we cannot read them — if you lose your password, we reset it, we cannot tell you what it was.
• The site is served over HTTPS, and your session cookie is signed so it cannot be forged.
• Reward callbacks from networks are signature-checked before anything is credited, and every callback is logged, accepted or not.
• The database is backed up daily, and access to it is limited to the people who run the site.

No system is perfect. If there is ever a data breach that puts you at risk, we will tell you and the CNIL, as the GDPR requires. Please help us: use a password you do not use anywhere else, and never share your login.

Foxxlo is for adults only — you must be 18 or older. The service is not directed at children, and we do not knowingly collect any data from a person under 18.

If we find out that a member is under 18, we close the account and delete the data. If you are a parent or guardian and think your child created an account, write to privacy@foxxlo.com and we will handle it quickly.

If we change what we collect or who we share it with, we update this page and change the date at the top. For an important change we also announce it in our community channels before it takes effect.

• Privacy questions and GDPR requests: privacy@foxxlo.com
• General support: support@foxxlo.com
• If you have no account and cannot email us: the application form reaches us too.

See also our Terms of Use.