Privacy Policy

Last updated: 5 November 2026
Effective date: 14 May 2026

This Privacy Policy explains how ooblee Alpine GmbH (the operator of the Oobyte service) handles personal data when you use the Oobyte website at oobyte.ai, the Oobyte mobile applications for iOS and Android, and any related services (collectively, the "Service").

This policy is written to comply with Regulation (EU) 2016/679 (the "GDPR"), the Austrian Data Protection Act (Datenschutzgesetz, "DSG"), and, in respect of users in the United Kingdom, the UK General Data Protection Regulation and the Data Protection Act 2018.

1. Controller and contact

The data controller responsible for the processing of your personal data is:

ooblee Alpine GmbH
Registered office: Am Tabor 36, 1020 Vienna, Austria
UK office: 15 Rathbone Place, London W1T 1HU, United Kingdom
VAT: ATU80851534
Commercial Register (Firmenbuchnummer): FN 628468v
Commercial Court: Handelsgericht Wien

Privacy contact: privacy@oobyte.ai
General contact: support@oobyte.ai

Our lead supervisory authority under the GDPR one-stop-shop is the Austrian Datenschutzbehörde. We respond to verified data-subject requests within one month of receipt and, where requests are complex or numerous, may extend that period by up to two further months as permitted by Article 12(3) GDPR.

2. Scope

This policy applies to personal data we collect when you create an account, subscribe to a paid plan, complete actions, offers, or surveys, communicate with us, visit our website, or interact with our advertising on third-party sites and apps. It does not cover the practices of the third-party offer, survey, and advertiser providers you choose to engage with through the Service. Those third parties are independent controllers for the data they collect from you, and their own privacy notices apply to that processing.

3. Categories of personal data we process

Account and identity data. Email address, password (stored as a salted cryptographic hash), display name, country of residence, date of birth or age confirmation, profile picture if you upload one.

Identity verification (KYC) data. When you request a withdrawal or where we deem verification necessary to prevent fraud or comply with applicable law, we (or a third-party verification provider acting on our written instructions) process a copy of a government-issued ID, a selfie image, liveness-check data, and the matching results returned by the verification provider.

Subscription and payment data. Subscription tier, start and renewal dates, billing country, payment-method type, and transaction identifiers returned by our payment processor. We do not store full payment-card numbers. Card data is processed directly by our PCI-DSS-compliant payment provider acting as an independent controller for that processing.

Earning and activity data. Actions completed, offers attempted, surveys started or finished, screenouts, time-on-task, tokens earned, coin balance, cash balance, withdrawal history, and similar Service-usage records.

Device and technical data. IP address, mobile advertising identifier (IDFA on iOS, GAID on Android, where you have permitted tracking), device model and identifiers, operating system and version, browser type, language, time zone, app version, network type, mobile carrier, crash logs, and behavioural signals used for fraud and bot detection.

Location data. Approximate location derived from your IP address. We do not collect precise GPS location unless you explicitly grant location permission in the app for a feature that requires it.

Step data. We treat step data as health data, a special category of personal data under Article 9 GDPR. If you choose to take part in the daily walking task in the mobile app, the app first asks for your explicit consent to process your step data for this purpose. Only if you give that consent and also allow access in Apple Health (iOS) or Health Connect (Android) does the app read your step count. The operating-system permission alone is not treated as your consent. Access is read-only. We do not write to Apple Health or Health Connect, and we do not read any other health or fitness data. For each day you take part, we receive your step total for that day, the source app or device that recorded it, how it was recorded (we exclude manually entered steps), the time window of the reading, your platform, and the device identifier and model it was sent from. We receive daily totals only: never individual step records, and never your location. We use step data only to check and pay the walking task. We do not use it for advertising, analytics, profiling, or to draw conclusions about your health. Step data is never passed to Meta, AppsFlyer, Unity, or any other advertising, attribution, or analytics tool; the rules of Apple HealthKit and Google Health Connect forbid this.

Communications data. Messages and attachments you send to support, in-app chat content, dispute submissions, and any screenshots or evidence you provide.

Marketing and engagement data. Email open and click events, in-app notification engagement, campaign attribution data, A/B test variant assignment.

Apart from step data, which we process only with your explicit consent as described above, we do not ask for and do not intend to process special categories of personal data within the meaning of Article 9 GDPR. Do not provide other special-category data to us through the Service.

4. Sources of personal data

We collect personal data directly from you when you provide it, automatically when you use the Service, and from third parties, including:

our offerwall, survey, and advertising partners, who send postbacks confirming that you completed an action and the corresponding payout;
our payment processor, fraud-prevention provider, and identity-verification provider, which return verification, risk-scoring, and transaction-status data;
analytics, attribution, and SDK partners, which return device and event signals;
third-party login providers, where you choose to connect a social or other account.

5. Purposes and legal bases

We process personal data only where we have a lawful basis under Article 6 GDPR. The table below sets out our processing purposes and the corresponding legal bases.

Purpose	Legal basis
Creating and managing your account; providing access to the Service	Performance of a contract (Art. 6(1)(b))
Tracking and crediting completed Actions; converting tokens; managing balances	Performance of a contract (Art. 6(1)(b))
If you take part in the daily walking task, reading your daily step count from Apple Health or Health Connect to check the task and credit its reward	Your explicit consent, given in the app before any step data is read (Art. 9(2)(a) and Art. 6(1)(a)). You can withdraw it at any time. Crediting the reward to your balance once the task is checked is performance of a contract (Art. 6(1)(b))
Processing subscription payments, renewals, and withdrawals	Performance of a contract (Art. 6(1)(b))
Verifying your identity and eligibility, including KYC and age checks	Legal obligation (Art. 6(1)(c)) and our legitimate interests in preventing fraud (Art. 6(1)(f))
Detecting, investigating, and preventing fraud, abuse, multi-accounting, bot activity, money laundering, and breach of our Terms	Legitimate interests in protecting the Service and other users (Art. 6(1)(f)); legal obligation where AML or similar rules apply (Art. 6(1)(c))
Sending essential service notifications (transaction confirmations, security alerts, policy updates)	Performance of a contract (Art. 6(1)(b))
If you sign up through one of our campaign links, sending you one email about finishing your account setup in the oobyte app, if you have not opened the app yet (sent once, contains no offers)	Performance of a contract (Art. 6(1)(b))
Sending marketing communications, including by email and push notifications	Consent (Art. 6(1)(a)), or our legitimate interests in direct marketing of similar services to existing users where this is compatible with applicable law (Art. 6(1)(f))
Personalising the Service, including recommending Actions, offers, and rewards	Legitimate interests in providing a useful product (Art. 6(1)(f))
Analytics, performance measurement, A/B testing, and product improvement	Legitimate interests (Art. 6(1)(f)); consent for non-essential cookies and trackers
Tax and accounting record-keeping	Legal obligation (Art. 6(1)(c))
Establishing, exercising, or defending legal claims	Legitimate interests (Art. 6(1)(f))
Responding to law-enforcement and regulatory requests	Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f))
Corporate transactions (mergers, acquisitions, financings, reorganisations)	Legitimate interests (Art. 6(1)(f))

Where we rely on legitimate interests, we have carried out a balancing test and have concluded that our interests are not overridden by your interests, rights, or freedoms. You can request more information on this balancing exercise by writing to privacy@oobyte.ai.

6. Recipients of personal data

We share personal data only with categories of recipients that need it for the purposes set out above. These include:

offerwall, survey, advertising, and attribution partners that deliver the Actions you complete and that we rely on for validation and reward calculation;
payment service providers and gift-card issuers, for subscription billing and payout processing;
identity-verification and fraud-prevention providers, for KYC, device fingerprinting, IP risk scoring, and anti-bot checks;
cloud-hosting and infrastructure providers running our servers, databases, and storage;
email, push, and in-app messaging providers;
analytics and product-intelligence providers;
customer-support tooling providers;
professional advisors (legal, accounting, audit, tax) under duties of confidentiality;
public authorities and courts, where we are legally required to disclose, or where disclosure is necessary to protect our rights, property, or safety, or that of users or the public;
acquirers, investors, and successors in the context of a merger, acquisition, financing, or reorganisation, subject to confidentiality and continued protection.

Step data is the exception to this list. It goes only to the hosting and infrastructure providers in item 4 that run our servers and database, and to authorities under item 9 where the law requires it. It is never shared with the partners in items 1 or 6, or with Meta, AppsFlyer, Unity, or any other advertising, attribution, or analytics tool.

Each recipient acts either as a processor on our written instructions or as an independent controller. We do not sell personal data, and we do not use your data for purposes incompatible with those described in this policy.

7. International data transfers

Some of our service providers process personal data outside the European Economic Area, including in the United States and the United Kingdom. Where we transfer personal data to a country that has not received an adequacy decision from the European Commission, we rely on appropriate safeguards under Chapter V GDPR, including the Standard Contractual Clauses adopted by the European Commission, supplementary technical and organisational measures where required following our transfer-impact assessment, and certification under the EU-US Data Privacy Framework where the recipient is certified.

You can request a copy of the safeguards we apply by writing to privacy@oobyte.ai.

8. Retention

We retain personal data only for as long as necessary for the purposes set out above and, after that, for the periods required by law or by our legitimate interests in defending legal claims. Indicative periods:

Account data: for the duration of the contractual relationship and up to 24 months after account closure, after which it is deleted or anonymised.
Earning, payment, and withdrawal records: at least seven years after the relevant transaction, in accordance with the Austrian Federal Fiscal Code (Bundesabgabenordnung, § 132 BAO) and the Austrian Commercial Code (Unternehmensgesetzbuch, § 212 UGB).
Step data: we store only the daily step totals the walking task needs, with the details listed in Section 3. We delete them 6 months after the reward for that day is paid; for a day that earned no reward, 6 months after that day ends. They are deleted sooner when you delete your account, and within 30 days when you withdraw your consent (see Section 9). We keep only the record of each walking-task reward (that the task was completed, the amount, and the date) as an earning record under item 2. That record contains no step data.
KYC records: at least five years from the end of the relationship, in line with applicable AML legislation, unless a longer period is required.
Marketing data: until you withdraw consent, after which it is deleted or anonymised within 30 days.
Support communications: up to 24 months after the issue is resolved.
Server, security, and fraud logs: typically up to 24 months, longer where necessary to investigate an incident or defend a claim.

Inactive accounts may be closed in accordance with our Terms. Backups are deleted on a rolling cycle and may persist for a limited period after corresponding live data has been deleted.

9. Your rights

Subject to the conditions and exceptions in the GDPR, you have the right to:

access the personal data we hold about you, and receive a copy;
rectification of inaccurate or incomplete data;
erasure ("right to be forgotten"), in particular where the data is no longer necessary;
restriction of processing in specific situations;
portability of the data you provided to us, in a structured, commonly used, machine-readable format, where technically feasible;
object to processing based on our legitimate interests, including profiling, and to processing for direct marketing at any time;
withdraw consent at any time, where we rely on consent; withdrawal does not affect the lawfulness of processing before withdrawal. For step data, you can withdraw your explicit consent at any time in the app or by writing to privacy@oobyte.ai. When you withdraw in the app, it stops reading your steps immediately; when you write to us, we stop accepting your step data as soon as we have handled your request. Either way, we delete the step data we hold within 30 days at the latest, including from our backups. A walking task in progress when you withdraw ends without a reward; rewards already credited are not affected. Removing oobyte's access in Apple Health or Health Connect also stops the app reading your steps. Apple Health does not let us see that you have done this, so if you want your stored step data deleted within 30 days, also withdraw in the app or write to us; otherwise it is deleted as described in Section 8;
not to be subject to a decision based solely on automated processing producing legal or similarly significant effects, except as permitted by Article 22 GDPR (see Section 10).

To exercise your rights, write to privacy@oobyte.ai. We may need to verify your identity before responding and may decline manifestly unfounded or excessive requests, or charge a reasonable fee, as permitted by Article 12(5) GDPR.

You have the right to lodge a complaint with a supervisory authority, in particular:

Austrian Datenschutzbehörde (dsb.gv.at), Barichgasse 40-42, 1030 Vienna, Austria, our lead authority;
the data protection authority of your EU country of residence; or
the UK Information Commissioner's Office (ico.org.uk) if you are in the United Kingdom.

10. Automated decision-making and fraud detection

Oobyte uses automated systems to recommend Actions, offers, and rewards we believe are relevant to you, to detect fraud, abuse, bot activity, multi-accounting, identity misrepresentation, and money laundering, and to validate completion of Actions.

For most users, this personalisation and screening does not produce legal or similarly significant effects within the meaning of Article 22 GDPR. However, automated checks may contribute to decisions to hold, reduce, or reverse a reward, refuse or delay a withdrawal, restrict access to specific Actions, or suspend or close an account where fraud or breach is suspected.

Where these decisions are automated and significant, you have the right to obtain human review, to express your point of view, and to contest the decision. To request a review, contact privacy@oobyte.ai with the relevant facts and any supporting evidence. Our review is final.

11. Children

The Service is not directed at children. You must be at least 16 years old to register a free account and at least 18 years old to subscribe to a paid plan, complete monetised Actions, or withdraw funds. We do not knowingly collect personal data from anyone under 16. If you become aware that a child has provided us with personal data, contact privacy@oobyte.ai and we will delete the data and close the account.

12. Cookies, SDKs, and similar technologies

We and our partners use cookies, software development kits (SDKs), pixels, and similar technologies on the website and in the apps for:

strictly necessary purposes (authentication, security, load balancing, fraud prevention); these do not require consent;
analytics, to understand how the Service is used;
advertising and attribution, to measure campaign performance and to show relevant promotions on and off the Service.

We obtain consent for non-strictly-necessary cookies and SDKs through our cookie banner on the website and through the relevant operating-system permission prompts on mobile (App Tracking Transparency on iOS, advertising-ID controls on Android). You can change your preferences at any time through the cookie settings on the website and through your device settings on mobile.

Our session-analytics tools are configured to mask step counts, so step data is not captured in session recordings.

A separate Cookie Policy lists the specific cookies and trackers in use, their purposes, providers, and retention periods.

13. Advertising (Google AdMob)

Our mobile app may show a small ad banner. These ads are provided by Google Ireland Limited (Google AdMob), acting as a third-party ad provider.

What is collected: when an ad is shown, Google may collect your IP address and approximate location derived from it, your device's advertising ID (IDFA on iOS, Android Advertising ID on Android), information about your interactions with ads and the app, and crash and diagnostic data.

Why: to show and measure ads, for analytics, and to prevent fraud and invalid ad activity.

Legal basis: your consent (Art. 6(1)(a) GDPR) for personalised ads and storing or reading information on your device. Where no consent is given, Google may still show non-personalised ads based on our legitimate interest in funding the app (Art. 6(1)(f) GDPR), using limited data such as IP address and approximate location.

Your choices: if you are in the EEA, UK or Switzerland, the app asks for your consent through Google's consent form before personalised ads are shown. You can change or withdraw your consent at any time in the app's privacy settings. On iOS, the app asks for your permission before your advertising ID can be used for tracking. You can also reset or limit your advertising ID in your device settings (iOS: Settings → Privacy & Security → Tracking; Android: Settings → Google → Ads).

More information: how Google uses information from apps that use its services: https://policies.google.com/technologies/partner-sites

14. Security

We apply technical and organisational measures designed to protect personal data, including encryption in transit, access controls, role-based permissions, logging, regular reviews of vendor security, and incident-response procedures. No internet-based service is fully secure, and we cannot guarantee absolute security. Where required, we will notify affected users and the relevant supervisory authority of a personal-data breach in accordance with Articles 33 and 34 GDPR.

15. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent version. For material changes, we will notify you in advance by email or through an in-app or website notice. Continued use of the Service after the new policy takes effect constitutes acceptance, except where we are required to obtain renewed consent.

16. Contact

ooblee Alpine GmbH
Am Tabor 36, 1020 Vienna, Austria
privacy@oobyte.ai
support@oobyte.ai

To lodge a complaint:
Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Vienna, Austria
dsb.gv.at