This translation is provided to help you understand the service. The French version prevails. French reference version
Who is responsible
Jonathan Ibor (Kola Studio), a sole trader established in France and registered in the Sirene register under SIREN 130 984 743, is the data controller. Yearn is an independent project developed and operated alone. For any question or to exercise your rights: jonathan@yearn.fr. You will receive a reply within one month at most, in accordance with the GDPR.
What Yearn collects, and why
Scroll the table horizontally →
| Data | Why | Legal basis |
|---|---|---|
| Email address, provider and stable identifier of each linked Google or Facebook identity | Recognise you across sessions and manage your sign-in methods. Each identity is recognised by its provider and stable identifier; matching email addresses never cause accounts to be merged. | Contract performance |
| Date of birth | The service is reserved for adults and networks also require this. It is a barrier, not a targeting criterion. | Legal obligation and contract |
| Daily goal, started offers, reported time | To operate the service and calculate the hourly rate shown to everyone. Your reported times feed a collective median. | Contract performance |
| Ledger entries: earnings, cancellations, redemptions | To keep the balance, justify each movement and keep evidence in case of a dispute with a network. | Contract and legitimate interest |
| Sessions: device, dates, token fingerprint | To keep you signed in and allow remote session revocation. The token itself is never stored: only its SHA-256 fingerprint is stored. | Contract and legitimate interest |
| IP address and user-agent when opening an offer | Sent to the network, which requires them to show the offers available in your country and on your device, surveys and games alike, and to detect fraud. | Contract and legitimate interest |
| Referral: your code, the account that referred you, the dates and the milestones reached | To pay the promised bonus to each of the two accounts, and to pay it only once. The code is yours; the referrer's identifier does not leave your export, as it is someone else's data. | Performance of the contract |
| Claims: the reason you pick, the text you write, and the reply | To look into what you dispute and keep a record of what you were told. The text is free-form and yours: write in it only what you are willing to entrust. | Performance of the contract |
| Gift card exchanges: the brand, the value, the date, and the code assigned | To give you the code in the app and to prove that an amount left your balance in return for it. The code is encrypted in the database and never leaves the app; it is not in the export of your data. | Performance of the contract |
| Anti-fraud events: nature, date, and the IP address recorded, both when the account is created and on every exchange request | To spot the same earning being cashed several times, and to recognise a series of accounts created from the same network. The signup address is only noted when the account is born; it is examined only when you request an exchange. This check is the one that can refuse an exchange, and the automated decision section says what it weighs and how to contest it. | Legitimate interest |
| The technical nature of the network of your signup and of your exchange requests: type of connection and operator | To recognise a series of accounts held by one hand, which distorts the rates shown to everyone and drains the card stock. The classification is asked of a third-party directory; it is kept per network range, with no link to an account, and only what counted is written on your account's event. | Legitimate interest |
What Yearn does not do
- Your email address is never sent to the networks. They receive only a Yearn technical identifier, your IP address and your user-agent.
- No data is sold, rented or transferred.
- No advertising tracker and no analytics cookie, neither on this site nor in the app. This page sets no cookie.
- No advertising profiling, and no automated decision other than the anti-fraud check described below.
Signing in with Google or Facebook
Yearn uses Google Sign-In and, when available, Facebook Login. Google provides your email address, a stable account identifier and the address of your profile picture. The Google picture is not kept on the server: it is passed to the app, which keeps it on your device for display. For Facebook, Yearn uses only your email address and stable identifier; no Facebook picture is retrieved. Yearn requests no access to your contacts, calendar or mailbox content. Yearn never receives your passwords; Google or Facebook tokens are used to verify identity and are not retained on the server.
On Android, the Facebook SDK temporarily writes its token to a local cache. Yearn clears this cache when the sign-in flow returns and when the app starts; these preferences are excluded from backups and transfers between devices.
Each linked identity is retained with its provider and stable identifier until account erasure. Linking another sign-in method requires an explicit action from the existing account, verification of the identity to be linked and a code sent to that Yearn account’s email address. Two accounts are never merged solely because their email addresses match.
The chosen provider learns that you sign in to Yearn. Its own processing is governed by its privacy policy: Google for Google Sign-In, Meta for Facebook Login. Separate email and push processing is described below.
Who receives data
Scroll the table horizontally →
| Recipient | Role | What it receives | Where |
|---|---|---|---|
| OVH | Server and database hosting | Nothing more than what is stored | France |
| Authentication | The fact that you sign in to Yearn | European Union and United States | |
| Meta (Facebook) | Facebook authentication, if chosen | The fact that you sign in to Yearn through Facebook | As described in Meta’s privacy policy |
| Rewarded survey provider | Survey provider | A Yearn technical identifier, your IP address and your user-agent | Germany |
| Third-party network directory | Technical classification of an address, for the exchange decision only | The IP address to classify, and nothing else: no identifier, no account, no amount | European Union |
Game offer platforms also receive a technical Yearn identifier, your IP address and your user-agent to provide offers and attribute earnings. Game images are loaded from third-party providers, which therefore receive your IP address when the images are displayed. You can request the identity of the recipients to whom your data has been disclosed by exercising your right of access at jonathan@yearn.fr.
Other networks may be added, including some established outside the European Union. None will receive more than what is described above, and this page will be updated before any new transfer, not after. A transfer outside the European Union is only made on the basis of the Commission's standard contractual clauses.
A hosting provider technically has access to the disks it runs. What OVH's contract commits it to is OVH's business, and I cannot guarantee it on their behalf: what I can say is that the database is not reachable from any public network, that gift card codes are encrypted in it, and that their key is not.
The automated decision, and how to contest it
An automatic check evaluates every gift card exchange request. Above a threshold it refuses the request: your balance is not debited, no code is assigned, and the app tells you so. It is the only decision Yearn makes without human involvement.
What it weighs: the age of your account, your recent exchanges and refusals, the amount requested, and the technical nature of the network the request comes from as well as the one the account was created from. None of these refuses a request on its own: it is their combination that crosses the threshold. The exact weights and the threshold value are not published, because publishing them would tell organised fraud how to stay just below; the Regulation allows this reservation for fraud prevention.
A corporate network, or a business range of an operator, can be read as a server network with no fraud involved. That is this check's known false positive, and a recent account is the most exposed to it. If a refusal reaches you for that reason, a claim is the right path, and the block is lifted.
It does not read your survey answers or the content of your claims, and it decides nothing else: not your access to the service, not the offers shown to you, not the amount you earn. From the network directory queried it keeps only elementary findings, never the overall score that directory computes on its own side: an opaque score cannot be explained to whoever would contest it.
To contest it, open a claim from Account, then Claim. A person reviews it and can lift the block; their decision and its reason are recorded, and you can read them in the export of your data. Trying the exchange again neither lifts a block nor makes it worse. An account whose score has risen is flagged to me even without a claim: the review I make of it is recorded the same way, and on its own it lifts nothing.
The legal basis is legitimate interest: preventing the same earning from being cashed several times, which would drain the card stock at everyone else's expense. The events recorded by this check, their nature, date and the IP address recorded, are kept for 90 days to review complaints about a refused exchange, including the signup record, which therefore disappears three months after the account is created. They are deleted when the account is deleted. What the directory says about a network is kept for seven days, under a prefix and with no link to an account.
Service emails and notifications
Yearn uses Google Workspace for suspension, gift card exchange, earning adjustment and data incident emails: Google receives the recipient address and message content, including the brand and value for an exchange and the amount added for an adjustment, never the card code. Firebase Cloud Messaging (Google) receives a technical app token and the text of the message: the announcement of an exchange, and since 22 October 2026 that of a recorded earning, an earning reversed by the advertiser or an adjusted earning, each naming its amount in euros. A push shows on the lock screen: its text is therefore readable by whoever holds your phone, which is why none of them carries a card code. Push notifications are optional and require your permission; service emails are not marketing.
At your request, a security email with an eight-digit code valid for five minutes confirms linking a sign-in method or an exchange from an account with Facebook only. It is sent immediately by SMTP through Google Workspace, which receives the recipient address and code. It is not stored in the notification queue and cannot be replayed by an operator; no push contains this code. This transactional email does not depend on marketing preferences or Android notification permission.
Yearn stores your language, push registration metadata and notification records (recipient, content, status and attempts). An unfinished notification expires after 7 days; its history is deleted 30 days after its final status. Push registrations not refreshed for 30 days are deleted, as are those linked to a revoked session. Unconfirmed incident previews expire after 30 minutes; confirmed campaigns are deleted after 30 days. Account erasure removes messages and contact details from previews; a message already transmitted cannot be recalled.
Your export includes language, notifications and push registration metadata; delivery tokens are excluded. The countries and safeguards applicable to Workspace and Firebase processing must be verified before these channels are enabled.
Reminders
If you agree, through a choice separate from the notification permission, the app may show at most one reminder a day in the evening: a game you started that still has earnings to collect, or offers waiting for you after you sign up or after a few days without a visit. The reminder is written by Yearn and shown by your phone; it does not go through Firebase. It stops by itself when you do not come back, and you can withdraw your agreement at any time from your profile, or turn off the “Reminders” channel in your phone settings.
For this, Yearn keeps the date of your agreement and, for each reminder, its day, its kind, its language, its text and the time you opened it, for 60 days. Your export includes this data.
How long data is kept
- Your account and your goals: as long as the account exists. An inactive account is not deleted automatically today; deletion from the app is what ends it, and it is immediate.
- Linked Google or Facebook identities: provider and stable identifier retained until account erasure.
- Email verifications: codes are valid for five minutes and stored in the database only as HMAC fingerprints, never in plain text in the database, notification queue or logs. Request and attempt history is used to limit requests over one hour, then deleted during periodic cleanup. It is also deleted with the account or the relevant session.
- Sessions: thirty days without use, then automatic deletion. Every call pushes the deadline back, so a session you keep using does not expire. You may close one at any time from the app.
- Ledger entries and conversion evidence: kept even after the account is deleted, because they justify amounts paid. The criterion is how long an amount can still be disputed or audited; the exact duration remains to be settled with an accountant, and it will appear here as soon as it is.
- Reported times: kept, but detached from you. They feed the median everyone sees; a report separated from its author is no longer personal data.
- Anti-fraud events: kept for 90 days to review complaints about a refused exchange, then deleted by the periodic cleanup. The record of your signup network follows the same bound, counted from the account's creation. They are deleted with your account if you delete it sooner. What a third-party directory says about a network prefix lives seven days apart, with no link to an account.
Your rights
Two rights are exercised directly from the app, without going through me or waiting for a reply: access and portability, then deletion.
- The export returns, in a machine-readable format, what the server holds about you: account, goals, ledger, claims, referral, offers started, times declared, gift card exchanges, conversions announced by the networks, bonuses, anti-fraud events, sessions, and the administrative actions that targeted your account, with their reason. Excluded fields include: the fingerprint of session tokens, which is an authentication key; gift card codes, which are read in the app; the identity of the people who decided, which is not your data; and what the anti-fraud check retained about the network, restricted for the fraud prevention that Article 23 of the Regulation allows. What decided is still returned: the nature of the event, its date, the address recorded, the score, the card and the amount requested.
- The app deletes your account and your anti-fraud events. What remains is listed above: accounting entries can still point to you because their account identifier stays written even though it no longer leads to an existing account.
- Other rights, rectification, restriction and objection, are exercised by writing to jonathan@yearn.fr.
- If a reply does not satisfy you, you may refer the matter to the CNIL.
Erasure also removes linked identities and email verifications. Confirmation codes, exchange proofs and their fingerprints are excluded from the export; provider tokens are not retained on the server.
Minimum age
Yearn is reserved for people aged 18 or over. A birth date is requested when the account is created and an account cannot be created below that age.
Security
All content travels over HTTPS. Port 80 only redirects: if you type the address without a prefix, your first request leaves in the clear, and it is the only one. The HSTS header the server returns then commits your browser to HTTPS only for a year. Session tokens are stored hashed, never in the clear. Gift card codes are encrypted in the database; the key is not in the database.
The database is not reachable from any public network. Shared secrets used with networks are removed from server logs.
Changes
Any material change will be announced in the app before taking effect, and the date at the top of this page will indicate the applicable version.