Privacy policy
PaysFair pays people for surveys, games and app tests. That involves personal data, so this page says exactly what is stored, why it is allowed, who else sees it, and how long it stays. It is written to be read.
Last updated November 1, 2026.
Who is responsible
Obsidian UG (haftungsbeschränkt), Leopoldstr. 2-8, 32051 Herford, Germany, represented by its managing director Billal Ainaoui. HRB 20982, Amtsgericht Bad Oeynhausen. Questions about your data go to [email protected].
What is stored, and why it is allowed
Each row says what is stored, what it is for, and which part of the GDPR permits it. Nothing here is collected for advertising, and nothing is sold.
| What | What for | Legal basis |
|---|---|---|
| Your email address and a password hash | Your account, signing in, the confirmation link, a password reset. | Art. 6(1)(b): we cannot keep an account for you without it. |
| Only if you sign in with Google: the id Google gives your Google account, and the email address Google confirms for it | Signing you in with Google, and knowing it is the same Google account next time. | Art. 6(1)(b): it is the way in you chose. Closing your account removes it. |
| The country you choose | Which surveys and which gift cards are available to you. | Art. 6(1)(b). |
| That you confirmed you are 16 or older, and when | The age limit this service is allowed to use consent at. | Art. 8 with Art. 6(1)(a). |
| Sign-ins: the time, your IP address and your browser's description | Showing you your own sessions, and noticing a stolen password. | Art. 6(1)(f): keeping accounts from being taken over. |
| Every consent you give or withdraw, with the exact wording you saw and its version | Proving what you agreed to, which is the point of consent. | Art. 7(1): we must be able to demonstrate it. |
| Surveys and offers, only once you switch them on: a user number, your IP address, your device and browser type and your approximate location (country and city, read from your IP address) passed to the networks, and what they report back | Finding tasks that fit you, and paying you for what you completed. | Art. 6(1)(a), and you can switch it off at any time. |
| Your profile answers, only once you say yes on the profile screen, and each only if you answer it: the year and month you were born, your gender, your postal code, your household's income band, your highest finished education, your work, your relationship status, the size of your household and the number of children under 18 living with you | Showing you the surveys you qualify for. When you start one, its research company and the marketplace that brings it to us may receive the answers that survey asks about. | Art. 6(1)(a); saying no deletes every answer, and so does closing your account. |
| An IP check when you sign up, sign in, ask for a cash-out or open the surveys, and on the other requests while you are signed in (a new address at once, a known one every 15 minutes): whether your IP address belongs to a proxy, a VPN or a data center, a risk score for the address, the name of its network and its country, and the country our network provider saw the request come from. The check runs on our own fraud-check service, on the same server; no other company receives it | Keeping accounts and cash-outs safe from fraud. Survey networks also refuse traffic through proxies and VPNs, so before a survey the check spares you a survey that would not count. An account made behind a VPN, or one that uses a VPN and then shows up from another country than its own, is closed. | Art. 6(1)(f): preventing fraud. Kept 90 days. |
| In the Android app, a device check at sign-in and at every start: identifiers of the phone (its device id and two hashes of its hardware and settings, read by our own fraud-check code), whether it is an emulator, rooted, or runs a hooked, tampered or cloned app, the identifier Fingerprint.com gives the phone, Google Play Integrity's answer on whether the phone is genuine and the app is the one Google Play shipped, and what the phone says about itself: whether a VPN carries its traffic, the country of its SIM card and mobile network, its time zone and language. On the website, at most once a day while you are signed in: the identifier Fingerprint.com gives the browser, an identifier our page computes from the browser's settings, and the browser's time zone and language | Preventing fraud: finding one person with several accounts, and phones made to fake activity. | Art. 6(1)(f): preventing fraud; reading the phone is strictly necessary for that. Kept 90 days. |
| Errors and steps: when a page or the server fails, the error, the page, your browser's description and your IP address; steps such as signing up, finishing the start, and how many surveys and offers a list showed you; and, in the app and on this website, the screens you open and the doors and tasks you use, by their names only and never what you type, with a random id (in the app it stays in the app; on this website it lives in the page's memory for the visit and is never stored in your browser) | Finding and fixing what breaks, and seeing where people get stuck. | Art. 6(1)(f): keeping the service working. Kept 90 days. |
| Your balance and every movement of it | Your money. Each line says what it was, when, and what the balance was afterwards. | Art. 6(1)(b), and Art. 6(1)(c) for the accounting record. |
| Cash-outs: the amount and the address the gift card goes to | Sending you what you asked for. | Art. 6(1)(b). |
| Visits to this website: the page, the site that sent you there, your browser and system, your screen size and your country | Knowing which pages people read and how they find them. Counted by a program on our own server; no other company receives it. | Art. 6(1)(f). No cookie is set, and your IP address is not stored. |
| Only if you say yes to Google Analytics: the pages you read here, how long and how far, links you follow to other sites, the site that sent you, your browser, system, screen and rough location, with two cookies (see Cookies) | Seeing in more detail which pages help and how people find them. | Art. 6(1)(a) and § 25(1) TDDDG: your consent, which you can take back at any time under Privacy choices at the bottom of every page. |
Who else sees it
Every company that receives anything is named here, not described as a category.
- Cloudflare sits in front of the website, so it sees the requests your browser makes.
- Google receives mail sent to addresses at this domain (Google Workspace). If you choose “Continue with Google”, you sign in on Google's own page, under Google's privacy policy, so Google knows you signed in to PaysFair; it tells us only your email address and the id of your Google account, never your name, picture or contacts. In the Android app, Google Play Integrity tells us whether the phone is genuine and the app unmodified. It also receives what Google Analytics measures, only from visitors who said yes to it; the Analytics contract is with Google Ireland Limited. Google says Analytics does not log or store the IP addresses of visitors from the EU, Switzerland or the UK.
- Resend sends the confirmation and password-reset emails. They are sent from inside the EU.
- Contabo provides the server the app runs on.
- Survey and offer networks, only once you switch surveys and offers on: market research companies and advertising networks that pay for completed surveys, games and app offers. To find tasks that fit you they receive a user number, your IP address, your device and browser type and your approximate location (country and city), never your email address, name or password. Which networks these are, we tell you on request.
- The gift-card provider, for a cash-out you request.
- Fingerprint (FingerprintJS, Inc.) receives the Android app's and the website's device check and tells us an identifier for the phone or browser and whether it looks manipulated. Its data is processed and stored in its EU region (Frankfurt), for fraud prevention only.
Nobody else. Your data is not sold, and it is not used to advertise to you anywhere.
Where it is processed
The server is in the United States, rented from Contabo GmbH, a German company. That is a transfer outside the EU. Where a service provider processes data outside the EU or EEA, the transfer is safeguarded by the European Commission's Standard Contractual Clauses (Art. 46 GDPR). The agreements are available on request. The emails this app sends go through a provider sending from inside the EU.
Some survey and offer networks are outside the EU as well, for example in the United States, where the law protects your data less than in the EU. What they receive (see above) goes to them only because you switched surveys and offers on, and on that consent (Art. 49(1)(a) GDPR): the switch says so before you turn it on, and turning it off stops it. Profile answers go to them only on your yes on the profile screen, which says the same before you give it.
What Google Analytics measures can also be processed in the United States: Google's own list of the companies that process Analytics data includes sites there. Google LLC is certified under the EU-U.S. Data Privacy Framework, which the European Commission has found to protect personal data adequately (Art. 45 GDPR).
How long it is kept
- Your account and its settings: until you close it.
- Sign-in sessions: 30 days, then they expire on their own.
- The IP checks and the app's device checks: 90 days.
- Errors and steps: 90 days. Closing your account deletes yours at once.
- Visit statistics: two years. They hold no IP address and no account, only what the table above lists.
- Google Analytics: 14 months for what it records about visitors, the longest its free version allows. Its two cookies expire after two years, or at once when you say no.
- Consents: as long as the account, and afterwards for as long as we might have to prove one.
- Money: every movement of a balance is an accounting record, and German law requires those to be kept for ten years. Closing your account removes your identity from them; the amounts and dates stay.
What you can do
- Get a copy of everything (Art. 15 and Art. 20). Settings has a button that hands you one file with every piece of data listed above, and nothing about anybody else.
- Correct what is wrong (Art. 16), directly in Settings.
- Close your account (Art. 17). Your sign-in and your email address are removed. The money record stays for the ten years above, without your identity attached.
- Take back a consent (Art. 7(3)), per feature, with the same switch you used to give it. What happened before stays lawful; nothing new happens after. For Google Analytics, that switch is Privacy choices at the bottom of every page.
- Object (Art. 21) to anything resting on a legitimate interest, which here is the sign-in log, the IP checks, the errors and steps, and the visit statistics.
- Complain (Art. 77) to a data protection authority, in the country you live in or where the company is. Ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestr. 2-4, 40213 Düsseldorf.
Children
PaysFair is for people aged 16 and over. Signing up asks you to confirm that, and the answer is stored with its timestamp. If we learn that an account belongs to someone younger, it is closed and the data removed.
When this page changes
The date at the top says when it last did. If a change affects what you already agreed to, the app asks you again rather than assuming, and the version you saw is what is recorded.