App Privacy Policy
Effective date: October 22, 2026
1. Introduction
Raycash Inc. (“Raycash”, “we”, “our”, or “us”) is a Delaware corporation. This Privacy Policy explains how we handle personal information in the Raycash mobile app for iOS and Android (the “App”). With the App you create a Raycash account, reserve your raytag, join our waitlist and our newsletter In confidence, take part in the Raycash Points program, invite friends, and can choose to be notified when your Raycash account is ready.
The App and the raycash.xyz website (the “Website”) share one Raycash account: if you use both with the same email address, your account, Raycash Points and referrals are the same in both. The Website is covered by its own Privacy Policy.
2. Information We Collect
2.1 Information you give us
- Email address, when you sign in. Your first sign-in creates your account.
- Raytag, the unique handle you choose when you set up your account.
- Referral code, if you enter a friend’s code or open the App through their referral link.
- Newsletter preference, when you choose to subscribe to In confidence.
2.2 Your account
Your account holds your email address, an internal account ID, and when the account was created. To sign you in we email you a one-time code, which we store only in hashed form and which expires after 10 minutes. Each signed-in session records the IP address and the device software (user agent) it was started from, to keep your account secure.
2.3 Raycash Points and referrals
We record which tasks you have completed, the points you have earned, your referral code, who referred you, and how many people you have referred. The leaderboard, in the App and on the Website, shows your rank, points, referral count, a generated avatar, and a masked form of your email address (for example, a****e@***.***). It never shows your full address to anyone but you.
2.4 Accounts you connect
Connecting another account is optional. The App opens X’s or Telegram’s own sign-in page for it, and you can disconnect the account at any time from your account page on the Website (raycash.xyz/user).
- X (Twitter): your X account ID, username, display name and profile picture. We use X’s API to check whether you follow @raycashxyz and whether you have posted about Raycash, and we keep a link to the qualifying post. We use the access X grants us only to confirm which account is yours, then revoke it straight away. We never post on your behalf.
- Telegram: your Telegram user ID, username, name and profile picture. Our Telegram bot checks whether you are a member of the Raycash Community group.
2.5 Notifications
If you allow notifications, the App gets a push token for your device from Expo, our notification provider, and sends it to us. We keep it with your account ID so we can tell you when your Raycash account is ready. Signing out of the App removes the token from our servers, and you can turn notifications off at any time in your device’s settings.
2.6 Crash reports and diagnostics
The App uses Sentry to find and fix crashes and errors. When the App crashes, hits an error or stops responding, it sends Sentry a report that includes:
- what went wrong, and where in the App
- your device model, operating system, and App version
- a random identifier for this installation of the App
- the IP address your device connected from, from which Sentry may work out an approximate location
- the steps that led up to the problem: the screens you opened, the buttons you tapped, the App moving to and from the background, and the web addresses of the requests the App made. Some of those addresses contain what you typed, such as a raytag you checked or a referral code you entered.
We do not attach your email address or account ID to these reports.
Sentry also records session replays: a reconstruction of the App’s screens, used to see what led to a problem. It records about 1 in 10 sessions, and, for every session in which an error occurs, the moments leading up to the error. Text and images are masked in replays, so they show the layout of a screen but not what is written or pictured on it.
The App has no setting to turn crash reports or replays off.
2.7 Security and abuse prevention
To check that requests to sign in, or to check a task, come from a genuine copy of the App and not from an automated script:
- On iOS, the App creates a key on your device and has Apple’s App Attest service vouch for it. We keep the key’s ID and public key. They are not linked to your account.
- On Android, the App asks Google Play for an integrity verdict, which we send to Google to check. We do not keep the verdict. We count how many of these checks each IP address asks for, to limit abuse.
We also count requests by IP address to rate-limit sign-in. Our hosting provider, Vercel, processes standard server logs (such as IP addresses, request times and device details) to deliver the App’s requests.
2.8 Information on your device
Some information never leaves your device:
- Passcode: the App keeps only a salted hash of it, in encrypted storage on your device. We never receive it.
- Face ID, Touch ID or fingerprint: your device’s operating system checks them. The App only stores whether you turned the setting on, and never receives your biometric data.
The App also keeps your session in your device’s secure storage, and sends it with each request to our servers to show the request is yours. It keeps a copy of your account details (email address, raytag, points and referrals) in encrypted storage on your device, so it can open without waiting for the network.
2.9 What the App does not collect
The App shows no ads, uses no advertising identifiers, and does not track you across other companies’ apps or websites. It contains no analytics service other than the crash reporting described in section 2.6. It does not access your location, contacts, photos, camera or microphone. When you share your referral link, your device’s own share sheet sends it; we do not see who you share it with.
3. How We Use Your Information
- To create your account, sign you in and keep your account secure
- To add you to the waitlist and tell you when Raycash is available to you, by email and, if you allow it, by notification
- To send you the In confidence newsletter and other Raycash marketing updates, if you subscribe. You can unsubscribe at any time.
- To reserve your raytag
- To run Raycash Points: checking tasks, awarding points, crediting referrals and showing the leaderboard
- To prevent fraud, abuse, automated sign-ups and gaming of the points program
- To find and fix crashes and errors in the App
- To comply with applicable laws and respond to lawful requests
When you create your account in the App, we add you to the waitlist and email you a confirmation. We add you to the In confidence newsletter only if you choose to subscribe. Every email we send includes a link to unsubscribe.
3.1 Our legal bases
Where EU or UK data-protection law applies, we use the following legal bases:
- Account, raytag, waitlist and Points administration: processing necessary to provide the account and Points program you request under our App Terms.
- Security and fraud prevention: our legitimate interests in protecting customers, preventing abuse and keeping the App secure.
- Crash reports and diagnostics: our legitimate interests in keeping the App working and fixing problems in it.
- Notifications: your consent, given when you allow notifications, which you can withdraw at any time in your device’s settings.
- Newsletter and marketing emails: your consent, which you can withdraw at any time.
- Leaderboard: our legitimate interests in recognizing participation and enabling participants to compare their progress in the Points program. We display your rank, Points total, referral count, a masked form of your email address and a generated avatar. You can object to this at any time by emailing privacy@raycash.xyz. We will then remove your entry from the leaderboard without affecting your account or Points balance.
- Legal obligations: compliance with applicable legal requirements.
Where we rely on legitimate interests, we assess those interests against your rights and interests. Where we rely on consent, withdrawing it does not affect the lawfulness of processing before withdrawal.
4. Who We Share It With
We do not sell your personal information, and we do not share it for targeted advertising. We share it with the service providers that run the App for us, only as much as each one needs, and with X or Telegram only if you connect an account there:
- Vercel hosts the servers the App talks to and processes server logs (privacy policy).
- Neon hosts our database (privacy policy).
- Resend delivers our emails and keeps our mailing lists (privacy policy).
- Sentry receives crash reports, diagnostics and session replays, as described in section 2.6 (privacy policy).
- Expo provides push tokens and passes our notifications to Apple and Google (privacy policy).
- Apple checks the App’s integrity on iOS and delivers notifications to Apple devices (privacy policy).
- Google checks the App’s integrity on Android and delivers notifications to Android devices (privacy policy).
- X and Telegram, only if you connect those accounts. Their own privacy policies apply to what you share with them (X, Telegram).
Apple’s App Store and Google Play, which you download the App from, handle your information under their own privacy policies.
We may also disclose information when the law requires it, to protect the rights and safety of Raycash or others, or as part of a merger, acquisition or sale of assets. In that last case, we will tell you before your information becomes subject to a different privacy policy.
5. International Transfers
Raycash is based in the United States, and our service providers process data there. If you are outside the United States, your information will be transferred to and processed in the United States. You can contact privacy@raycash.xyz for information about the safeguards used for a particular transfer and how to obtain a copy.
6. Deleting Your Account
You can delete your account at any time:
- In the App: tap the person icon at the top of the home screen to open Account, then tap Delete account.
- On the Website: at raycash.xyz/delete-account, where you sign in with a code sent to your email address.
- By email: write to privacy@raycash.xyz.
Deleting your account removes it at once, together with its sessions, raytag, push tokens, referral code and referrals, connected X and Telegram accounts, and your place on the waitlist and the newsletter.
Some records are not linked to your account and stay after it is deleted: the results of the X and Telegram tasks we checked, kept by X or Telegram account ID together with the link to a qualifying post; crash reports and session replays already sent to Sentry; server logs; App Attest keys; and the counts of requests by IP address. They are kept as described in section 7.
You can also ask us to delete some of your information without deleting your account, by emailing privacy@raycash.xyz.
7. Data Retention
- Your account, raytag, points, referrals, push tokens and connected accounts: until you delete your account. Disconnecting an account removes its details from your profile.
- Mailing lists: until you unsubscribe or delete your account.
- Sign-in codes expire after 10 minutes, and sessions after at most 30 days.
- Crash reports and session replays: for the period Sentry keeps them for us.
- Server logs: for the period our hosting provider keeps them.
- Task results, App Attest keys and request counts: only as long as they help us protect the App and the Points program from abuse.
We may keep some information for longer when the law requires it, or to resolve disputes and prevent abuse.
8. Your Rights and Contact
Depending on where you live and the law that applies, you may have rights to access your personal information, correct it, request deletion, restrict its use, receive a portable copy, or object to certain processing. Where we rely on your consent, you may withdraw it at any time.
You can object to direct marketing at any time by using the unsubscribe link in a marketing email or contacting us.
To make a request, email privacy@raycash.xyz. We may need to verify your identity before acting on it. Some rights are subject to legal conditions and exceptions; if we cannot fulfill a request, we will explain why.
Where EU or UK data-protection law applies, you also have the right to complain to a relevant supervisory authority. In the UK, this is the Information Commissioner’s Office. In the EEA, you can contact the authority in the country where you live or work, or where you believe an infringement occurred.
9. Security
We protect your information with encryption in transit and hashed sign-in codes. The App keeps your session in your device’s secure storage, keeps your passcode only as a salted hash, and proves its requests are genuine through App Attest and Play Integrity. No system is perfectly secure, but we work to protect your information and to limit what we hold to what we need.
10. Children
The App is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us personal information, contact us and we will delete it.
11. Changes to This Policy
We may update this policy from time to time. We will change the effective date at the top of this page when we do, and we will email you about material changes.
Raycash Inc.
800 N State St, Dover, DE 19901, United States
privacy@raycash.xyz