Privacy Policy — ZatBack

1. Who we are

This Privacy Policy describes how JTR Labs LLC (“JTR Labs,” “we,” “us,” or “our”) handles information when you use the ZatBack mobile application (the “App”), this publisher overview at jtrlabs.com/zatback, and related services we operate (together, the “Services”).

2. What ZatBack is

ZatBack is a mobile rewards platform. Users earn zats (in-app reward units displayed with Zcash ($ZEC) equivalents) through partner shopping offers, games, daily engagement features, and referrals. ZatBack includes an optional non-custodial Zcash wallet: your seed phrase and signing keys stay on your device; we never receive them.

3. Information we collect

3.1 Account and profile

Internal user ID and session tokens (to keep you signed in)
Username and display name you choose (or we generate for guest accounts)
Referral code assigned to you and referral codes you enter when joining
Optional sign-in identifiers if you use Apple or Google sign-in (provider ID; email only if the provider shares it)

3.2 Rewards and activity

Rewards ledger data (zats earned, pending, and lifetime totals)
Engagement data such as streaks, XP, achievements, daily spin, and vault drops
Records of shop offer clicks, attributed merchant activity, and game quest completions

3.3 Wallet (non-custodial)

We do not collect your seed phrase, private keys, or recovery phrase
If you connect a wallet, we may store your public Zcash address on our servers for display and receiving—never spend authority
On-chain sends are signed on your device; we cannot move your funds

3.4 Device and technical

Device platform and a device fingerprint hash (for session security and push delivery)
Push notification token if you enable notifications
App version, timestamps, and standard server logs (IP address, request metadata) for security and debugging

3.5 Information we do not collect

Precise GPS location (we do not request location permission for core features)
Contacts, photos, or microphone (except camera access if you scan a payment QR code)
Contents of partner merchant checkout pages or your bank credentials

4. How we use information

We use the information above to:

Provide and secure the App (authentication, fraud prevention, abuse detection)
Calculate, display, and reconcile rewards and referrals
Attribute shopping and game activity to your account
Send optional push or local reminders (e.g., daily spin, weekly vault) if you opt in
Improve the Services and comply with law
Respond to support requests and partner reporting obligations

We do not sell your personal information. We do not use your data for third-party advertising profiles inside ZatBack.

5. Legal bases (EEA / UK)

Where GDPR or UK GDPR applies, we rely on:

Contract — to provide the Services you request
Legitimate interests — security, analytics at a service level, partner attribution, and product improvement (balanced against your rights)
Consent — where required (e.g., optional notifications)
Legal obligation — when we must retain or disclose data by law

6. How we share information

We may share information with:

Infrastructure providers — hosting, databases, and caching services that process data on our behalf under contractual safeguards
Affiliate and merchant partners — when you tap a tracked offer, partners may receive click identifiers (e.g., sub-IDs) needed to attribute cashback; purchases occur on their sites under their policies
Game and offer partners — when you complete a quest or install promoted content, limited completion signals may be shared for verification
Apple / Google — if you use their sign-in or app distribution services, their policies apply to that interaction
Push services — e.g., Apple Push Notification service or Firebase/Expo infrastructure to deliver tokens you register
Authorities — if required by law or to protect rights, safety, and integrity of the Services

We may share aggregated or de-identified statistics that cannot reasonably identify you.

7. Retention

We keep account and ledger data while your account is active and for a reasonable period afterward for legal, tax, and dispute resolution needs. Server logs are rotated on a limited schedule. You may request deletion as described below.

8. Security

We use industry-standard measures such as encrypted transport (HTTPS), access controls, and hashed credentials where applicable. No method of transmission or storage is 100% secure; you are responsible for safeguarding your device and any wallet recovery phrase.

9. Your choices and rights

Notifications — disable in App settings or device system settings
Username — update in your profile where available
Wallet — disconnect or stop using in-app wallet features; keys remain only on your device

Depending on where you live, you may have rights to access, correct, delete, or port personal data, or to object or restrict certain processing. Email [email protected]. We will verify your request and respond within applicable timeframes.

California residents (CCPA/CPRA): We do not sell personal information. You may request access or deletion as above. We will not discriminate against you for exercising privacy rights.

10. Children

ZatBack is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.

11. International transfers

We are based in the United States. If you use the Services from other regions, your information may be processed in the U.S. or where our service providers operate, with appropriate safeguards where required by law.

12. Third-party links

Partner merchants, games, and external sites have their own privacy policies. We are not responsible for their practices. Review their policies before completing a purchase or providing information to them.

13. Changes

We may update this policy from time to time. We will post the revised version on this page with a new “Last updated” date. Material changes may also be communicated in the App or by email where appropriate.

14. Contact

Privacy questions: [email protected]
General inquiries: [email protected]
JTR Labs: jtrlabs.com