Who this notice covers
This Privacy Policy explains how the Creative Rewards App mobile application (Android package com.creativehub.rewardsapp) handles information when you use it. The app is operated by the operator responsible for this application. This notice does not state a separate registered company or personal legal name. Privacy questions and requests can be sent to the contact listed below.
Information collected or used
When a participant registers, the app asks for a full name, phone number, and country. The phone number is normalized for the selected country. The source code does not show a date-of-birth field or phone one-time-password verification.
The service associates a participant profile with an internal identifier and a device-scoped Supabase anonymous-auth identity. For a giveaway entry, it stores the giveaway, server-assigned participation number and sequence, and creation time. A reveal timestamp may also be stored.
The app and its providers may process device, network, diagnostic, security, and service-operation information. The precise server logs, retention, and provider-side data fields require confirmation against production configuration.
Phone numbers and participation
A phone number is used as part of participant registration and to prevent a phone from being linked to more than one participant identity. In the current code, registration does not verify control of the number with an SMS code. A phone number by itself is not a secure credential and must not be treated as proof that someone owns a participant identity.
Entries and participation numbers are created or retrieved through server-authoritative app calls. My Giveaways retrieves entries for the currently authenticated device identity; the website does not provide a public lookup by phone number. Organizers may display winner information in the app as part of campaign results.
Local storage and identifiers
The app stores the participant name, phone number, country code, internal profile ID, selected language/role, and anonymous-session refresh token in device-protected storage. Supabase Auth also persists its session. App caches may store giveaway, category, and My Giveaways data to support app performance. Clearing the app or changing devices can affect access to a device-bound participant identity.
Supabase processing
The mobile app uses Supabase for authentication and application data, including participant profiles, device links, giveaways, participations, and related records. Giveaway images use the app’s storage service. The project region, live access policies, logging, backup retention, and deployed database configuration could not be verified during the source audit; do not infer a specific retention duration or hosting region from this notice.
Firebase Cloud Messaging
The app integrates Firebase Cloud Messaging for push notifications. When notifications are enabled, a device messaging token may be associated with the participant device record so notifications can be delivered. Firebase and Google may process message delivery, device, and diagnostic information under their applicable terms. You can manage notification permission in your device settings.
Google AdMob and advertising identifiers
The app integrates Google Mobile Ads for Banner, App Open, Interstitial, and optional Rewarded ad formats. The app requests non-personalized ads in its current source. This does not mean that no device or ad-related data is processed: Google’s advertising SDK may process IP address, device and advertising identifiers, approximate location derived from IP, ad interactions, delivery/frequency information, and diagnostics under Google’s terms and the consent choices that apply.
Rewarded ads are optional. A user can continue with the normal free participation path without watching one; watching does not create an extra entry or increase winning odds in the app’s participation flow.
Consent and privacy choices
The app source integrates Google’s User Messaging Platform (UMP), checks whether ad requests may be made, and exposes a privacy-options control when the SDK requires one. The consent messages and regional configuration managed in the advertising account were not available for this audit. Review or change choices using the in-app advertising privacy options where shown and the device controls available to you.
How information is used
- Create and maintain a participant profile and device-bound session.
- Check campaign eligibility and create or retrieve a participation entry.
- Show joined giveaways, participation numbers, campaign results, and relevant notifications.
- Protect the service, diagnose failures, and prevent duplicate or abusive participation.
- Deliver, measure, and limit the frequency of ads subject to applicable choices and provider settings.
Sharing and service providers
Information is processed by the app’s backend and the providers needed to run it, including Supabase, Firebase/Google, and Google Mobile Ads. Providers may process information for service delivery, security, diagnostics, advertising, and legal compliance under their own terms. The app does not send participant names or phone numbers to Google for ad targeting in the reviewed code; advertising SDK processing still occurs independently. Campaign organizers may access campaign management and results information available to their authorized account.
Security
The app uses Supabase authenticated sessions for participant-scoped requests and stores selected identity values in platform secure storage. Server-side functions handle participation creation and profile changes. No system can guarantee absolute security. The deployed backend security rules, access logs, and incident practices were not independently verified during this audit.
Retention
The source does not establish a fixed retention period or backup-expiry schedule. Participant and campaign records may remain while needed to operate the campaign, resolve results, prevent abuse, meet legal obligations, or handle disputes. You may request deletion; a request may be limited where records must be retained for these purposes. The operator should publish a specific retention schedule after confirming production backups and legal requirements.
Your choices and requests
You can edit your participant name, phone number, and country in the app. You can turn off notifications in device settings and manage advertising privacy choices in the app when that option is available. You can request deletion using the instructions on the Data Deletion page or email support. A request is reviewed before action; providing a phone number alone does not prove identity.
Data deletion
The checked-in app source contains a server-side participant self-deletion function, but the database migration and its production deployment could not be verified, and no in-app control calling it was found in the reviewed source. For now, use the support request process described on the Data Deletion page. Do not send sensitive information unless support asks for what is necessary to verify the request.
Children and age eligibility
The registration flow reviewed does not collect date of birth or implement an app-wide age gate. Campaign eligibility may set its own age or country rules. A person should not participate unless they are legally allowed to do so and meet the campaign’s terms; a parent or guardian should contact support if a child’s information was submitted. The current Google Play listing shows an Everyone content rating, which is not a substitute for age-eligibility controls or legal review.
International processing
Supabase, Firebase, and Google may process information in countries other than where you live. The production Supabase region and contractual transfer details were not confirmed in the source audit. Provider privacy notices explain their practices: Supabase Privacy, Firebase Privacy and Security, and Google Privacy Policy.
Changes to this policy
We may update this notice as the app or its data practices change. The effective date below identifies the current website copy. Material updates should be reflected here and, where appropriate, in the app or store listing.
Contact
For privacy, support, or deletion requests, email mohamed.elsamman.dev@gmail.com. Include “Creative Rewards App” in the subject. The app operator’s legal name has not been stated in this notice; contact details do not establish a registered legal entity.