Privacy Policy
How Nova Universe AB processes personal data in connection with Cashodilo: the data we process, purposes and legal bases, recipients, retention and your rights.
Version 2026-10-11 · Last updated
This Privacy Policy describes how Nova Universe AB processes personal data in connection with the Cashodilo mobile application (the "App") and the website cashodilo.com (together, the "Service"): which data we process, for which purposes and on which legal bases, to whom we disclose it, how long we retain it and which rights you have.
At a glance
- No registration is required. An anonymous account is created when the App is first opened. Linking an Apple or Google account is required to keep coins across devices and to request a payout.
- We process device and network data to provide the Service and to prevent fraud.
- On Android, the App reads the apps installed on your device to provide the Service; the Android App cannot be used without it. App usage (Android) and the advertising identifier (iOS) are processed only with your consent. Refusing that consent does not prevent you from using the App.
- We disclose data to the partners through which coins are earned and paid out, and to service providers acting on our behalf (section 5).
- Every payout and every account block is decided by our staff.
- You can delete your account in the App (section 7 and Delete your account).
- We do not sell personal data and do not display advertising.
1. Controller
Nova Universe AB, a company registered in Sweden ("Cashodilo", "we", "us"), is the controller of the personal data described in this Privacy Policy. You can contact us at support@cashodilo.com on any matter concerning this Privacy Policy.
2. Age and availability
You must be 16 or older to use the Service. We do not knowingly process personal data of younger persons; if you believe that we have done so, contact us and we will delete the data.
The Service is available in selected countries in North America and Europe. Your country is determined when you first open the App.
3. Personal data we process
3.1 Account data
- account identifiers, including a pseudonymous identifier that we disclose to partners instead of your account identifier;
- country, language, platform and App version;
- account status and the history of status changes;
- your acceptance of the Terms of Service and this Privacy Policy;
- referral code and referral relationships;
- if you link a sign-in account: the email address and name provided by Apple or Google (if you use Hide My Email, the relay address provided by Apple);
- if you provide them: display name, avatar, birthday and gender.
3.2 Device and network data
When you use the App, we collect technical data about your device and your network connection, in particular:
- device information, such as manufacturer, model, operating system, and language, region and time zone settings;
- device identifiers, including identifiers generated by us and the advertising identifier (on iOS only with your permission), which we store in hashed form;
- network information, such as IP address, mobile carrier and SIM country, and information derived from the IP address, such as country and network operator;
- the installation source of the App;
- security-related device settings and state, such as whether developer options or debugging are enabled, whether a VPN is active, the country of the mobile network, and indications that the device is an emulator or has been modified;
- on Android, Google's Play Integrity verdict on the device and on the App;
- information provided by our partners' software development kits on eligibility and fraud checks.
We use this data to provide the Service, to determine your country, to verify eligibility for rewards and payouts and to prevent fraud. From this data we derive risk indicators, which our staff take into account when reviewing payouts. Risk indicators do not by themselves lead to an account block or to the rejection of a payout.
3.3 Installed apps and app usage (Android)
Installed apps. After a disclosure in the App, and as a condition of using it, the Android App reads the list of apps installed on your device, including pre-installed apps, together with information about each app, such as its name, version, category, installation source and installation date. The App does not access the content of other apps.
App usage. If you grant usage access in your Android settings, the App reads usage statistics, such as the time spent in apps and device usage events. Usage statistics do not show what you do within an app.
Purposes. To verify installations and play time for the purpose of crediting coins, to select the games offered to you and to prevent fraud. To prevent fraud we also compare a fingerprint of the set of apps you have allowed us to see with those of other accounts, and check the apps themselves against a list of tools used for fraud. The fingerprint is computed on our servers from the list you have already allowed us to see; the App reads nothing more.
Without the list of installed apps the Android App cannot be used, because game installations could not be verified and coins could not be credited. If you do not grant usage access, all other features of the App remain available; however, play time cannot be rewarded.
3.4 Games
Games are provided by Adjoe GmbH ("Adjoe") through its Playtime software development kit (SDK). We provide Adjoe with your pseudonymous identifier and, if you have provided them, your birthday and gender. The SDK collects device data and, with usage access, play time directly; Adjoe processes this data as an independent controller (section 5). We store the status of the games you play and the coins earned from them.
3.5 Surveys
Surveys are provided by CPX Research and Prime Surveys. They receive your pseudonymous identifier, country and language. Your answers within a survey are collected by the survey provider under its own privacy policy. The survey provider informs us of completed surveys and of the coins to be credited.
3.6 Coins, orders and payouts
We record all credits and debits of coins, your orders and their review.
- PayPal. If you connect a PayPal account, we receive the identifier of the account, its holder's name and email address, its verification status and its country. We use this data to make payouts and to prevent fraud and duplicate accounts.
- Swish (Sweden). For payouts via Swish, we process your Swish number and your personnummer. We use your Swish number and your personnummer to make payouts and to prevent fraud and duplicate accounts, and the personnummer also to verify that you are 18 or older. If you enter a personnummer and the link is refused, we keep that personnummer until your account is deleted, to prevent fraud and duplicate accounts. Access to the personnummer is restricted and logged.
- Gift cards and reward codes. We record which code was issued for which order.
3.7 Leaderboard, streaks and boosters
We process your weekly leaderboard score and prizes, your streak and your active boosters. Other users see only the display name and avatar you have chosen or a generated name. You can hide yourself from the leaderboard in the App.
3.8 Notifications and emails
If you allow notifications, we process your push token and your notification preferences. If your account is linked to an email address, we send you emails about your account and your orders.
3.9 Customer support
We process the content of your support requests by email or in-app chat, any screenshots you attach and technical information about your device and App version. The App has no access to your photo library; you select individual images with the system photo picker. Support data may be processed by service providers that provide our customer support tools.
3.10 Analytics and crash reports
- Analytics. With your consent, given through the consent banner, the App sends usage data, such as screens and features used, App version, device type and country, to our analytics provider, hosted in the EU. On the website, page views are measured without cookies and without storing IP addresses.
- Crash reports. The App sends crash and error reports, including technical data about the error and your account identifier, to our crash-reporting provider, hosted in the EU. Crash reports do not contain your name, email address or IP address.
3.11 Consent management
Your consent choices are stored on your device and, as proof of consent, with our consent management provider under a random identifier.
3.12 Data we do not collect
The App does not access your contacts, precise location, photo library, messages, the content of other apps, keystrokes or clipboard.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the Service, crediting coins, processing orders and payouts | Performance of a contract, Art. 6(1)(b) |
| Preventing fraud, duplicate accounts and abuse | Legitimate interest, Art. 6(1)(f) |
| Installed apps (Android) | Performance of a contract, Art. 6(1)(b) |
| App usage (Android) | Consent, Art. 6(1)(a) |
| Advertising identifier (iOS) | Consent, Art. 6(1)(a) |
| Matching games and surveys to you, including birthday and gender | Performance of a contract; consent for birthday and gender |
| Leaderboard, streaks, boosters and referrals | Performance of a contract, Art. 6(1)(b) |
| Push notifications | Consent, Art. 6(1)(a) |
| Account and order emails | Performance of a contract, Art. 6(1)(b) |
| Product analytics | Consent, Art. 6(1)(a) (App); legitimate interest (website) |
| Crash reporting | Legitimate interest, Art. 6(1)(f) |
| Customer support | Performance of a contract and legitimate interest |
| Bookkeeping and other legal obligations | Legal obligation, Art. 6(1)(c) |
Balancing of interests. Where we rely on legitimate interest, we have weighed our interests against your interests and fundamental rights. Our legitimate interest in fraud prevention is to ensure that coins are converted into money only for genuine activity by eligible users. Our legitimate interest in crash reporting is to maintain a functioning App. We limit the impact on you by pseudonymisation, fixed retention periods and human review of decisions. You may object at any time to processing based on legitimate interest (section 9).
5. Recipients
5.1 Partners. The following partners process personal data as independent controllers under their own privacy policies:
- Adjoe GmbH (games), Data Privacy Statement;
- CPX Research and Prime Surveys (surveys);
- PayPal and Swish (payouts);
- Apple and Google (sign-in, app distribution and delivery of push notifications; on Android, Google's Play Integrity check).
5.2 Service providers. We engage service providers that process personal data on our behalf and on our instructions, under data processing agreements, in the following categories: hosting, database and storage; email delivery; push notification delivery; analytics; crash reporting; consent management; IP address lookup; customer support tools; and other IT services.
5.3 Authorities. We disclose personal data to authorities and courts where we are legally required to do so.
5.4 Corporate transactions. In the event of a merger, acquisition or sale of assets, personal data may be transferred to the acquirer, subject to this Privacy Policy.
6. Transfers outside the EU/EEA
Some recipients process personal data outside the EU/EEA, in particular in the United States. Such transfers are based on an adequacy decision of the European Commission, including the EU–US Data Privacy Framework, or on the Standard Contractual Clauses adopted by the European Commission.
7. Retention
| Data | Retention |
|---|---|
| Account data | For the life of the account |
| Anonymous accounts not linked to a sign-in account | Deleted after 30 days of inactivity |
| Device and network data | 180 days |
| Installed apps and app usage (Android) | 90 days after an app is removed or a usage record is created; at most one year after the device was last used |
| Records required to prevent fraud and abuse after account deletion, such as hashed device identifiers | Up to 3 years after deletion |
| Coin records, orders, payout and referral records, account status history and acceptances of the Terms | 7 years after the end of the calendar year, as required by Swedish bookkeeping law |
| Swish personnummer | Until the account is deleted |
| Push tokens and notifications | Until the token is revoked or expires; notification records up to 90 days |
| Support chat | Until the account is deleted |
| Support emails | 24 months after the last message |
| Analytics data | 12 months |
| Crash reports | 90 days |
Deleted data may remain in backups for a limited period before it is overwritten.
8. Automated decisions
Eligibility for the welcome bonus is determined automatically on the basis of device information, in order to prevent repeated claims on the same device. You may request a review by our staff at support@cashodilo.com. Risk indicators are computed automatically but do not by themselves lead to an account block or to the rejection of a payout; such decisions are taken by our staff.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and obtain a copy;
- rectification of inaccurate data;
- erasure (see Delete your account for the data we are required to retain);
- restriction of processing;
- object to processing based on legitimate interest, including processing for fraud prevention;
- data portability for the data you have provided to us;
- withdraw consent at any time with effect for the future: usage access in the Android settings, tracking in the iOS settings, analytics in the App's Privacy screen and notifications in the App's Notifications screen.
To exercise your rights, contact us at support@cashodilo.com. We respond within one month. You also have the right to lodge a complaint with the data protection authority of the country where you live; in Sweden, where we are established, this is the Swedish Authority for Privacy Protection (IMY, imy.se).
Residents of the United States
We do not sell personal information. Where a state privacy law treats the disclosure of advertising identifiers to our partners as "sharing", you can opt out by denying tracking permission (iOS) or in the App's Privacy screen. Requests under state privacy laws can be sent to support@cashodilo.com; we verify them against your account.
Residents of Canada
Under PIPEDA you may withdraw consent, subject to legal and contractual restrictions, access your personal information and challenge its accuracy. You may lodge a complaint with the Office of the Privacy Commissioner of Canada.
10. Security and data breaches
We implement appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, pseudonymisation and restricted, logged access by our staff. In the event of a personal data breach, we notify the competent supervisory authority and, where the breach is likely to result in a high risk to your rights and freedoms, inform you, in accordance with the GDPR.
11. Changes to this Privacy Policy
We may amend this Privacy Policy. The version in force is identified by the date at the top of this page. Where we make material changes, the App will ask you to confirm that you have read the amended Privacy Policy.
12. Contact
Nova Universe AB, support@cashodilo.com