Privacy Policy

Last updated: 1 October 2026

This policy explains how InfiniteArc Games ("we", "us") collects and uses personal information when you use the ArcGain app and this website. We are based in South Africa and handle personal information under the Protection of Personal Information Act (POPIA) and, where it applies to you, the GDPR and similar laws.

At a glance

• We collect what we need to run your account, credit your rewards, pay you, and keep ArcGain fair.
• We do not sell your personal information.
• Offer and survey partners get an ID for your account so they can credit your work. They have their own policies.
• Your data is stored with Google in the United States.
• You can ask to see, correct or delete your data at any time (see your rights).
• ArcGain is for adults only (18+).

1. Who is responsible

InfiniteArc Games is the "responsible party" (called the data controller in the GDPR) for your information. You can reach us, and our Information Officer, at arcgains@outlook.com.

2. What we collect and where it comes from

From you

• Account details: your name and email address. If you sign in with Google, we receive your name and email from Google. We never see your Google password, and we do not see your password for email sign-up either, because our login provider stores it.
• Payout details: the PayPal email, crypto wallet address, or email for a gift card that you give us when you request a cashout.
• Support messages: anything you write to us in the help form or by email.
• Verification documents: if we ask you to prove your identity or address before a cashout, the documents you send us.
• Referral code: a code you enter, which links your account to the friend who invited you.

Created as you use ArcGain

• Your coin balance, level, offers and tasks completed, daily streak, cashout requests and history, and referral activity (how many friends joined, how many finished a first offer, and the coins that earned you). We do not show you the names of the friends you referred.
• Technical data: device model, operating system, app version, IP address, crash information, and a timestamp of your actions.
• Fraud-prevention signals: one-way (hashed) versions of your device identifier, your IP address and your payout address, and the result of checks such as whether several accounts share a device or whether your connection looks like a VPN, proxy or Tor network. We store these results and hashes, not the raw device identifier.

From partners

• Offer and survey partners tell us when you complete (or have reversed) an offer, using the account ID we gave them, the offer type and the reward.

3. Why we use it, and our lawful basis

• To run your account and pay you: creating your account, crediting rewards, handling cashouts, referrals and support. Basis: needed to carry out our agreement with you.
• To prevent fraud and abuse: spotting duplicate accounts, fake completions, stolen or shared payout addresses, bots and abusive connections, and reviewing accounts. Basis: our legitimate interest in keeping the service fair and safe, which also protects honest users.
• To keep the service working and secure: confirming that requests come from the genuine app, fixing errors, and keeping backups. Basis: legitimate interest.
• To meet legal duties: tax and accounting records, responding to lawful requests from authorities. Basis: legal obligation.
• To answer you: replying to support messages and sending important service notices such as changes to these terms or a security problem. Basis: agreement and legitimate interest.

We do not use your information for advertising profiles, and we do not send marketing emails today. If we ever do, we will ask for your consent first and you will be able to opt out at any time.

4. Who we share it with

We share information only with the providers and partners we need, and only what each of them needs:

• Google (Firebase and Google Cloud), which hosts our servers and database, provides login (email and Google sign-in), runs our backups, and checks that requests come from the genuine app (App Check and Play Integrity). Google processes your data for us.
• IPQualityScore, an IP-reputation service in the United States. It receives your IP address so it can tell us whether it looks like a VPN, proxy, Tor or bot address. It returns a result and we do not store its raw response.
• Offer and survey partners. When you open or complete an offer, the partner receives an ID for your account and may collect its own data, such as device information, to confirm the task and prevent fraud. Each partner is an independent party with its own privacy policy, which we encourage you to read.
• Payment and reward providers (for example PayPal, a crypto exchange or a gift-card supplier) that receive your payout address and amount so they can send your reward.
• Advisers, auditors and authorities, where the law requires it, to protect our rights, or during a sale or merger of the business, under confidentiality duties.

We do not sell your personal information, and we do not allow our providers to use it for their own marketing.

5. Moving data to other countries

Our database and servers are run by Google in the United States, and our IP-reputation provider is also in the United States. That means your information is transferred out of South Africa (and out of the EEA, if you live there). We make these transfers only to providers that are bound by contract to protect the information to a standard like POPIA's, and where required we rely on recognised safeguards such as standard contractual clauses. Ask us if you would like more detail.

6. How long we keep it

• Your account and activity: for as long as your account is open.
• If you delete your account (see how): we remove your profile, balance, history and support messages, normally within 30 days.
• Records we must keep: cashout and payment records for the period the law requires for tax and accounting, which can be up to five years.
• Fraud-prevention records: hashed device, IP and payout-address values are kept for as long as needed to stop closed or banned accounts from returning and to prevent fraud.
• Verification documents: only as long as needed to complete the check and meet record-keeping duties, after which we delete them.
• Backups: our database keeps recent backups, so deleted data can remain in a backup for a limited time (up to about 12 weeks) before it expires.

7. How we protect it

This website and the app's connections to our servers are encrypted in transit with HTTPS. Your coin balance and cashouts can be changed only by our servers, never by the app itself, and the database is closed to direct access from outside. We verify offer-partner reports with signed requests before crediting anything, check that app requests come from the genuine app, and keep secret keys on our servers and out of the app. Access to cashout details is limited to the people who need it. No system is completely secure, so we cannot guarantee absolute security. If we become aware of a breach that affects you, we will tell you and the Information Regulator as the law requires. If you find a security problem, please tell us at the email address above.

8. Your rights

You may, free of charge for ordinary requests:

• See the personal information we hold about you and who we have shared it with.
• Correct information that is wrong or out of date.
• Delete your information (we may keep what the law requires, see section 6).
• Object to our use of your information for our legitimate interests, or ask us to restrict it.
• Withdraw consent where we rely on it. Doing so does not affect what we did before.
• Ask for a copy of the information you gave us in a common, machine-readable format, where the GDPR gives you that right.
• Complain to us, or to the regulator: in South Africa, the Information Regulator; if you live elsewhere, your local data protection authority.

To use any of these rights, email us from the address on your account (see section 1). We may need to confirm it is really you before we act.

9. Automated checks and decisions

Some of our fraud checks are automatic, for example flagging two accounts on one device or a cashout over a VPN. These checks can pause a cashout or put an account under review. They do not close an account on their own: a person reviews accounts before we remove coins permanently or ban someone. If an automated check affects you, you can ask for a person to look at it again and to explain the general reason (we keep the detailed rules confidential so they cannot be avoided).

10. Children

ArcGain is only for people aged 18 or over, and we do not knowingly collect information from anyone younger. If you believe a child has an account, contact us and we will delete it.

11. Cookies, ads and trackers

• This website does not use cookies, analytics or advertising trackers. See our Cookies page.
• The app does not currently show third-party ads or use analytics or advertising SDKs. If we add ads (for example through Google AdMob) or analytics, we will update this policy first, and where the law requires it we will ask for your consent.

12. Features we may add

Some future features need extra care, and we will update this policy and ask for your explicit consent before launching them. Examples are surveys that ask for sensitive information (such as health, ethnicity, religion, political opinions or sex life), identity checks through a verification service, or features that read which apps are on your device.

13. Changes to this policy

We may update this policy. If a change is significant we will tell you in the app or by email. The date at the top shows when it was last changed.

14. Contact

InfiniteArc Games, South Africa
Email: arcgains@outlook.com