Privacy policy

Getref ("Getref", "we", "us") is the service at getref.xyz that compares the partner terms of crypto exchanges and runs the Getref Rewards points programme. Getref decides why and how the personal data described here is processed and is responsible for it (the "controller"). Contact details are in the Contact section.

• To create an account we need only your e-mail address. We never ask for passwords, 2FA codes, private keys, seed phrases or identity documents.
• We do not sell your personal data and do not use it for advertising.
• Analytics that identify your browser run only if you allow them. Without your consent we count visits without any identifier.
• The exchange you submit a UID for receives only that UID from us and tells us only whether the account was opened through Getref, when it was registered and whether it is verified.
• You can ask us to delete your data from your profile.

Account. Your e-mail address, the date your account was created, your interface and e-mail language, and a random username. Purpose: to sign you in with a one-time code, to send you the letters you need (sign-in codes, task decisions, e-mail change notices) and to run your account. Legal basis: performance of our agreement with you (the terms of use).

Sign-in. One-time codes are stored only as a cryptographic hash for 10 minutes. After you sign in, your browser keeps a session token; our server keeps a hashed record of it for up to 7 days of inactivity. Legal basis: performance of the agreement and our legitimate interest in keeping accounts secure.

Getref Rewards. Exchange UIDs you submit, the tasks you open and complete, links you followed from a task, the result of each check (including what the exchange reported: whether the account is linked to Getref, its registration date and verification status), an optional screenshot you attach, your points history, your invite code and the friends who joined with it. Purpose: to check that a new exchange account was opened through Getref, credit points, apply the "one UID — one Getref account" rule and the referral rules, and resolve disputes. Legal basis: performance of the agreement (Getref Rewards rules).

Security and abuse prevention. A hash of your IP address and of your network, a random device identifier stored in your browser (also kept on our side only as a hash), the country reported by our network provider, and signals derived from them (for example, several accounts on one device). Purpose: to protect sign-in, tasks and the referral programme from bots, multiple accounts and self-referrals. Legal basis: our legitimate interest in preventing fraud and keeping the programme fair for real users.

Clicks to exchanges. When you follow a link to an exchange we record the offer, the page you came from, the time, your country, device type and language, plus hashes of your IP address and browser. Purpose: to count clicks, attribute sign-ups to tasks, detect abuse and see which pages are useful. Legal basis: legitimate interest.

Visit statistics. Pages viewed, the referring site and campaign tags, country, device, browser and operating system type. Without your consent this is counted with no identifier: a key derived from your IP address and browser with a salt that changes every day and is deleted after 48 hours, so visits cannot be linked across days. With your consent we also use a random visitor identifier stored in your browser and, if enabled, Google Analytics and Yandex Metrica. Legal basis: legitimate interest for anonymous counting; consent for anything that identifies your browser. You can withdraw consent at any time in the cookie settings.

Messages and requests. If you write to us or make a data request, we keep the request and our reply. Legal basis: legitimate interest and, for data-protection requests, our legal obligations.

We do not process special categories of data (such as health or political views) and do not ask for them. Providing your e-mail address is necessary to have an account; everything else on the website can be used without one.

Some checks are automatic. Exchange sign-ups can be approved automatically when the exchange confirms them; a risk score built from the security signals above can send a request to manual review, hold or refuse a referral bonus, and a match with our abuse lists can refuse a sign-in or a UID submission. These decisions only affect points and access to Getref Rewards; they have no legal or financial effect beyond that. A refused task always shows the reason, and you can ask for a person to review any automatic decision through the Contact channels.

We use service providers who process data on our behalf and under our instructions:

Exchanges. To check a task we send the exchange the UID you submitted — nothing else — through its partner programme. The exchange answers whether that account is linked to Getref, its registration date and verification status. Exchanges are independent companies; how they process the data of your exchange account is governed by their own privacy policies.

We may also disclose data when the law requires it, to protect the rights and safety of users and of Getref, or as part of a transfer of the service to a new operator, who would be bound by this policy. We do not sell personal data and do not share it for targeted advertising.

Our servers are in the European Union. Some providers (for example Cloudflare, Resend and Google) process data in other countries, including the United States. Where the law requires it, such transfers rely on an adequacy decision or on the European Commission's standard contractual clauses. Yandex Metrica processes data in Russia; it runs only if it is enabled and you have allowed analytics.

When you ask us to delete your data, we delete your e-mail address and everything else that identifies you directly, end all your sessions and close the account. We keep the history of exchange UIDs, task checks, points and referrals in a form no longer linked to your e-mail address, because it is needed to enforce the "one UID — one Getref account" rule, to keep the points ledger consistent and to handle disputes. Daily visit statistics are kept only as totals that do not relate to any person.

Depending on where you live (for example under the EU and UK GDPR or US state privacy laws), you have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data — you can change your e-mail address in your profile;
• delete your data — use "Request deletion of my data" in your profile; we complete deletion within 30 days;
• restrict or object to processing based on our legitimate interests;
• data portability for data you gave us;
• withdraw consent to analytics at any time in the cookie settings — this does not affect processing before the withdrawal;
• ask for human review of an automated decision;
• not be discriminated against for exercising these rights;
• complain to the data-protection authority of your country.

To use any right other than deletion, contact us through the Contact channels from the e-mail address of your account or with your account username, so that we can confirm it is you. We answer within 30 days (one month under the GDPR), and may extend this when the law allows, telling you why.

Connections to Getref are encrypted (HTTPS). IP addresses, device identifiers and the e-mail addresses in our mail log are stored as keyed hashes; partner API keys are encrypted; access to the operator console is limited to authorised staff, protected by additional authentication and logged. No system is perfectly secure; if a breach affects your data, we will inform you and the authorities where the law requires it.

Getref is intended only for adults (18 or older, or the age of majority where you live). We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will delete it.

We may update this policy when the service or the law changes. The date of the current version is shown at the top of this page. If a change materially affects how we use data you already gave us, we will announce it on the website or by e-mail before it takes effect.

Signed-in users can request deletion of their data from the profile. For any other privacy question or request, write to us on X: @getref_xyz (direct messages). An e-mail address for privacy requests will be published on this page.