Last Updated: October 2026
This Privacy Policy ("Policy") explains how Avalun ("Platform" — the avalun.io website, including the web version at avalun.io/app, and the Avalun Android application) collects, processes, and stores your personal data. We respect your privacy and prioritize the protection of your personal data.
Operator / data controller: Avalun Ltd. — [email protected]
This Policy applies when you access the Platform or use it. By using the Platform, you accept the terms of this Policy. If you do not accept this Policy, please do not use the Platform.
2.1. Phone Number: Your mobile phone number, used for one-time SMS verification. Phone verification is not required to use the app or the web version; it is required only before withdrawals and for referral rewards and commission. It is our main defence against bot accounts. We do not require identity documents.
2.2. Google Sign-In Profile: If you sign in with Google, we receive your Google account identifier, display name, email address and profile picture URL as provided by Google.
2.3. Push Notification Token (FCM): A Firebase Cloud Messaging token for your device, so we can send notifications (for example when a session is ready to collect or a withdrawal is completed).
2.4. Google Play Purchase Receipts: When you buy a boost in the app, we receive the purchase token and order details from Google Play in order to verify the purchase and apply the boost. We never see your payment card or bank details; those are handled entirely by Google.
2.5. Play Integrity Verdict: A device-integrity attestation issued by Google Play Integrity, confirming the app is genuine and running on a real, uncompromised device.
2.6. IP Address and Device Information: Your IP address, device model, operating system version, app version, language and time zone, collected automatically when the app or the web version talks to our servers. On the web version we also receive your browser type (user agent), and when an account is opened on the web we store the IP address used at sign-up and mark the account as opened on the web, to limit the number of web sign-ups per IP address per day. Used for security, fraud prevention and rate limiting.
2.7. Activity Data: Your daily sessions, AP balance and history, streaks, referrals, boosts, and withdrawal requests.
2.8. Wallet Addresses and Transactions: The Polygon wallet address you provide for withdrawals, and the public on-chain transaction hashes of AVL sent to it. If you pay for a boost with crypto on the website, the wallet address you pay from, the transaction hash and the payment amount, which we process to verify the payment on the Polygon blockchain.
2.9. Analytics Data: The app includes the Firebase Analytics SDK (Google), which records app-usage events with a random app-instance identifier and basic device information. It is used to find crashes and understand feature usage, not for advertising. The avalun.io website itself does not use analytics or cookies (see the Cookie Policy).
2.10. Support Correspondence: Emails you send to [email protected] and our replies.
We use the information we collect for the following purposes:
3.1. Service Provision: We use your information to provide, manage, and develop the Platform, including daily rewards, boosts and token withdrawals.
3.2. Communication: We use your information to send you updates, notifications, and support messages about the Platform.
3.3. Security: We use your information to secure the Platform, prevent fraud, and ensure proper use.
3.4. Analysis and Improvement: We use your information to analyze the Platform's usage, identify issues, and improve the Platform.
3.5. Legal Obligations: We use your information to fulfill our legal obligations, protect our rights, and comply with legal processes.
We may share your information in the following situations:
4.1. Service Providers: We work with service providers to operate and develop the Platform: Google (Google Sign-In / Firebase Authentication, Firebase Cloud Messaging, Firebase Analytics, Google Play Billing, Play Integrity), Twilio (SMS verification codes), Reown/WalletConnect (wallet connection on the website), Alchemy and the Etherscan/Polygonscan APIs (reading the Polygon blockchain), Cloudflare (content delivery and security) and DigitalOcean (hosting and encrypted backups). These service providers can only use your information to provide services to us and cannot use it for other purposes.
4.2. Public Blockchain: AVL withdrawals and crypto boost payments are recorded on the Polygon blockchain. Wallet addresses, transaction hashes and transaction amounts are public by nature and cannot be deleted by anyone; we never publish your phone number or name on-chain.
4.3. Legal Requirements: We may share your information if we are required to do so by law, to protect our rights, or to comply with a legal process.
4.4. Business Transfers: In the event of a merger, acquisition, or asset sale, your information may be transferred to the acquiring entity. In such a case, we will take necessary steps to ensure the protection of your information.
4.5. With Your Consent: We may share your information with your consent or at your direction.
Your personal information will not be sold, rented, or shared without your explicit consent.
We take appropriate technical and organizational measures to protect your personal information. However, please note that no data transmission or electronic storage is 100% secure.
5.1. Encryption: We encrypt sensitive information to protect it.
5.2. Access Control: We limit access to your personal information to authorized personnel who need it to perform their duties.
5.3. Regular Security Checks: We perform regular security checks to ensure the security of our systems.
5.4. Data Breach Notification: In the event of a data breach affecting your personal information, we will notify you in accordance with applicable laws.
We retain your personal information for as long as it is necessary for the purposes specified in this Policy. When you delete your account in the app (Settings → Delete Account) or on the web version (Settings/Profile → Delete account), your personal information is anonymized immediately. However, we may retain certain anonymized information to fulfill our legal obligations, resolve disputes, prevent fraud and enforce our policies. See the Account Deletion Policy for details.
You have the following rights regarding your personal information:
7.1. Access Right: You have the right to access the personal information we have collected about you.
7.2. Correction Right: You have the right to request the correction of incorrect or missing information about you.
7.3. Deletion Right: You can permanently delete your account at any time yourself, in the app (Settings → Delete Account) or on the web version (Settings/Profile → Delete account); see the Account Deletion Policy. Under certain conditions, you also have the right to request the deletion of your personal information.
7.4. Data Portability Right: You have the right to request the transfer of your personal information to another data controller.
To exercise these rights, please contact us at [email protected].
We may update this Policy from time to time. In case of significant changes, we will inform you through the Platform or via email. We recommend that you regularly check the most current version of this Policy.
If you have any questions or concerns about this Policy, please contact us at [email protected].