Privacy policy

Last updated: 31 October 2026

This policy explains what Perkora collects, why, who it is shared with, and what you can ask us to do with it. We collect as little as we can: you do not need a name, e-mail address or password to use Perkora. Keeping your wallet with a Google account is optional.

Who we are

Perkora (perkora.app) is operated by Računalno programiranje "Power Up Solutions", obrt, Čapljina, which is responsible for your personal data (the "controller").

Privacy questions and requests: [email protected].

We apply the EU General Data Protection Regulation (GDPR) to your data wherever you live. Where the law of your own country gives you more protection (in the Philippines, the Data Privacy Act of 2012), you have that too.

What we collect

• Device identifier. A random value stored in a cookie on your browser. It keeps your wallet on this browser. We store only a one-way hash of it.
• Technical data. Your IP address, the country it belongs to, and your browser's user-agent string, recorded when you create a wallet, sign in and claim a reward. When you create a wallet your browser also sends a one-way hash of some technical characteristics of your device (screen size, language, time zone, graphics). We use it only to detect many wallets created on one device; it cannot be turned back into those details.
• Wallet activity. The offers you open, the completions our sponsors report to us (offer, reward amount, status and time) and every change to your balance.
• Phone number, only when you claim a reward. We use it to verify that you are one person with one wallet and, for mobile top-ups and data bundles, to deliver the reward to that number.
• Google account, only if you tap "Keep it with Google". Google tells us your Google account's ID and e-mail address (nothing else: no name, contacts or other Google data). We store them with your wallet so you can open it with "Sign in with Google" on another phone or browser, and so one Google account keeps only one wallet. Deleting your account erases both.
• Visit statistics. Which pages are viewed (without the part of the address after "?"), the referring site, browser, device type and approximate location. Our own statistics server (Umami) counts them without cookies. We use them only as totals, to see which pages work.
• Reward details. What you redeemed, when, and the delivery result from the provider.
• Messages you send us, for example to support.
• How you found us. If you arrive through one of our ads or a shared link, the campaign code in that link and, for ads, the ad network's own reference for the click.
• Notification subscription, only if you turn notifications on. Your browser gives us an address at its maker's push service and encryption keys for it; we store them with your wallet, together with your browser's user-agent string. We use them to send short notices about your wallet (credits confirmed, a reward sent) and occasionally about new offers. If you open Perkora as an app from your home screen, we also note that it was installed and the days it was opened.

We do not collect your precise location, contacts, photos or payment card details.

Why we use it

• To run your wallet, credit completed offers and deliver rewards (needed to provide the service you asked for).
• To prevent fraud and abuse, such as duplicate wallets, bots and fake completions (our legitimate interest in keeping the service honest and paying real people).
• To keep financial and accounting records and meet other legal obligations.
• To answer your messages.

We do not sell your personal data and do not use it for advertising profiles.

Who we share it with

• Offer partners (the companies whose offer walls appear in Perkora). We send them only your random wallet ID, so they can tell us which completions are yours. When you use an offer wall or a sponsor's app or survey, that company also collects data directly under its own privacy policy.
• Reward providers (mobile top-up and gift-card companies). For top-ups and data bundles they receive the phone number and amount needed to deliver the reward.
• Verification provider (Prelude), which receives your phone number to send a one-time code by WhatsApp, SMS or a phone call. A code sent by WhatsApp is delivered through WhatsApp (Meta), which receives your number for that message under its own terms.
• Google, only if you use "Keep it with Google" or "Sign in with Google". You sign in on Google's own page; Google learns that you signed in to Perkora, under its own privacy policy. We send Google nothing about your wallet.
• Advertising networks that showed you our ad. If you came through one, we tell that network, using only its own click reference, that the click led to a new wallet and, later, that a first offer was completed (with what the sponsor paid us for it), so it can tell which ads work. We do not send your phone number, wallet ID or activity.
• Browser push services, only if you turn notifications on. Notices are delivered by the push service of your browser's maker (Google for Chrome and most Android browsers, Apple for Safari, Mozilla for Firefox, Microsoft for Edge). It receives the notice encrypted for your browser, so it cannot read the content; it sees only that a notice was sent to that address, and when.
• Infrastructure providers: our servers are hosted by Hetzner in Germany, and Cloudflare protects and delivers the website.
• Authorities, when the law requires it.

Transfers to other countries

Our servers are in Germany. Some of the providers above are in other countries, including the United States and the Philippines. Where the GDPR requires it, these transfers rely on a European Commission adequacy decision (such as the EU-U.S. Data Privacy Framework) or on the Commission's standard contractual clauses. You can ask us for a copy of the safeguards that apply.

Cookies

Perkora uses only cookies that the service needs to work: the device cookie that holds your wallet, a sign-in cookie, a security cookie that protects forms, and, if you pick a language, a cookie that remembers it. If you arrive through an ad or a shared link, a cookie keeps the campaign code (and the ad network's click reference) for up to 30 days, until you create a wallet. We use no analytics cookies and no advertising profiles. Offer walls from our partners may set their own cookies when you open them.

How long we keep it

• Wallet data is kept while your wallet is open.
• After a wallet is closed, balance and reward records are kept only as long as accounting, tax and fraud-prevention rules require, and are then deleted or anonymised.
• When you delete your wallet, we delete its mobile number, its Google account ID and e-mail, the network addresses and browser details we saved, ad click references and notification subscriptions at once. We keep only a one-way code made from the number (it cannot be turned back into the number) for 12 months, so that a new wallet with the same number does not get the welcome and invite bonuses again (our legitimate interest in preventing fraud). The number a reward was sent to stays in that reward's record.
• Technical records used for security, and ad-network click references, are kept for a short period, then deleted.
• A notification subscription is kept while notifications are on. When you turn them off, or your browser tells us the subscription has ended, we stop sending at once and delete it within 30 days.

Notifications

Notifications are off until you turn them on in your wallet and allow them in your browser. You can turn them off at any time with "Turn off" in your wallet (under "Keep this wallet"), or in your browser's or phone's settings for Perkora (site settings, or the app's notification settings).

Your rights

Wherever you live, you can ask us for:

• Access: what data we hold about you, why, where it came from and who received it, and a copy.
• Portability: the data you gave us in a common machine-readable format (JSON), to keep or to pass to another service.
• Correction of data that is wrong or incomplete.
• Deletion of your data.
• Restriction: we keep your data but stop using it while a correction or objection is checked.
• Objection to uses based on our legitimate interest, such as fraud checks. We then stop unless we have compelling grounds that outweigh your interests, or need the data for a legal claim.
• Withdrawal of consent where we rely on it, without affecting what was done before.
• Human review: our fraud checks run automatically and can hold or refuse a reward. If one affects you, you can ask a person to review the decision, give your side and contest it.

You can delete your wallet yourself: open your wallet and choose "Delete my account" at the bottom of the page. For anything else, or if you can no longer open your wallet, write to [email protected] and include your Wallet ID (shown on your wallet page). We may ask you to confirm the request from that wallet, so that nobody else can get your data; we never ask for ID documents. Requests are free. We answer within one month; if a request is complex we may need up to two more months and will tell you why. Some records must be kept by law even after a deletion request; we will tell you which.

If you are not satisfied with our answer, you can complain to a data protection authority, in particular where you live or work. In the European Union this is your national authority (list at edpb.europa.eu); in the Philippines it is the National Privacy Commission (privacy.gov.ph).

California residents

Perkora is open only to users in the Philippines. If you are a California resident, the California Consumer Privacy Act (CCPA) also gives you the right to know what personal information we collected about you in the last 12 months, to get a copy, and to have it corrected or deleted, and the right not to be treated differently for using these rights.

• What we collect (the categories in the CCPA): identifiers (Wallet ID, a hash of your device identifier, IP address, phone number, and the Google account ID and e-mail if you keep your wallet with Google); internet activity (pages viewed and offers opened); commercial information (completions and rewards); and approximate location (the country of your IP address). We do not collect sensitive personal information as the CCPA defines it.
• Sources, purposes, recipients and retention are listed in the sections above.
• No sale. We do not sell your personal information, have not sold it in the last 12 months, and do not knowingly sell the data of anyone under 16. Advertising networks receive only the notice described under "Who we share it with", and only for wallets created through their own ads.

To make a request, write to [email protected] with your Wallet ID, yourself or through an authorised agent with your signed permission. We confirm receipt within 10 business days and answer within 45 days.

Security

All traffic is encrypted (HTTPS). Device identifiers are stored only as hashes, access to production systems is restricted, and backups are protected. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

Children

Perkora is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created a wallet, contact us and we will close it.

Changes

We will update this page when our practices change and change the date at the top. Significant changes will also be shown in the app.