TIPS Privacy Policy

Updated: 11 September 2026 · edition 3

Data used for accounts, games, advertising, Node exchange and withdrawals, who can access it and how to make a data request.

1. Responsibility for data

The TIPS data controller is Purple Ltd, a private limited company incorporated under the laws of the Republic of Cyprus. This policy covers tipstask.com, the account interface and the TIPS Telegram Mini App.
For access, correction or deletion requests, use the support form and put “Privacy” in the subject. The form provides a reference number. privacy@tipstask.com, support@tipstask.com and legal@tipstask.com are planned addresses that do not yet accept email.

Telegram sign-in processes your Telegram identifier and available profile information needed to verify sign-in: first name, last name, username and language. The exact set depends on the sign-in method. Sign-in alone does not give TIPS access to private conversations or your phone number.
Google sign-in processes the account identifier, email and name supplied for authentication. Email registration processes the address, name and a protected password derivation; plaintext passwords are not stored.
The account also stores language, linked sign-in methods, notification settings, XP, level and active-day indicators.

Game verification processes the session identifier, game, time and duration, Score, collected units and result parameters needed to detect invalid activity.
Accounting stores Coin and Node balances and history, operation identifiers, ad intents and confirmations, bonuses, exchanges, rankings and announced season results. This supports duplicate prevention and the review of disputed operations.
The support form stores your name, reply email, language, category, subject, message, reference and status. An IP-address hash and browser information are also stored to protect the form. Do not submit passwords or secret banking information.
The web server and infrastructure process IP addresses, time, request addresses and technical browser information for operation, security and diagnostics.

Withdrawal processing uses the amount, method, status and destination you supply. Destination details are encrypted using AES-256-GCM; a mask is used for display.
For a bank card, this means its number, cardholder name and issuing country. Authorised staff can access these details to carry out a manual transfer; necessary data is provided to the bank or payment provider involved. TIPS does not ask for CVV, PIN, card expiry or bank passwords.

Performance of the service terms: sign-in, running your account, accounting for rewards, voluntary Node exchange, processing withdrawals and responding to related requests. Without necessary information, the corresponding feature may be unavailable.
Legitimate interests: protecting accounts and the service, preventing fraud, duplicate credits and abuse, technical diagnostics and defending rights in disputes, taking users' rights into account.
Compliance with applicable legal obligations: retaining necessary accounting records and responding to lawful requests from competent authorities. Processing that legally requires consent needs appropriate separate consent; opening this policy is not a substitute for it.

The tips_session cookie keeps you signed in; its current lifetime is up to 30 days. Page JavaScript cannot access it and it is transmitted over a secure connection in production. Signing out removes the sign-in cookie.
localStorage and sessionStorage hold language, sound, preferences and unfinished game-credit or exchange requests for recovery after a failure. These are not the source of the server balance. You can clear them in browser settings, but a pending local request may lose automatic recovery information.
Third-party sign-in and advertising components may use their own storage and technical identifiers. This policy therefore does not claim that every connected service is free of advertising cookies.

Telegram and Google process information according to your chosen sign-in method and their own policies. Telegram is also used for service messages according to account settings.
Choosing an advertisement loads the AdsGram SDK. The provider may process Telegram identifiers available in the Mini App, username, device information and advertising interactions. TIPS receives event confirmation to award a bonus. See the AdsGram privacy policy. Declining advertising does not remove your base game reward.
When you open an available partner task, the partner may receive a separate pseudonymous TIPS identifier and interactions with its page. The identifier should not be treated as fully anonymous. The partner explains the data it requests in its own task. An integration's existence does not imply continuous availability.
Hostinger provides server infrastructure. Authorised personnel have access for support, accounting and payouts; banks or payment providers involved receive necessary transfer data. Data may also be disclosed to a competent authority on a lawful basis.

Other players may see an abbreviated profile name, rank and Score: the first word of the name and an initial from the remaining part, if present. Do not use sensitive information as a profile name.
Private balances, Node and Coin history, email, Telegram ID and payout details are not included in the public leaderboard. If you receive an announced prize, your place and that prize amount may be inferred from published season rules.

Account information is retained to service the account; support, game and accounting records are retained as needed to perform operations, resolve disputes, prevent abuse and meet applicable legal obligations. Closing an account does not mean immediate deletion of every related record and backup.
Ordinary Nginx logs are configured for daily rotation with 14 archives. This is not a single retention period for all logs, databases or backups. A data-request response can clarify the applicable period and grounds for a particular category.
External providers may process data in other countries, including outside the EEA. Locations and conditions depend on the provider. International transfers require grounds and safeguards under applicable law; information about a particular recipient and safeguards can be requested through support.

Under applicable law, you may request access and a copy, correction, erasure, restriction, portability, object to processing based on legitimate interests and withdraw consent where consent is the basis. Withdrawal does not affect the lawfulness of earlier processing.
Submit a request through the support form. Account ownership may need verification. There is currently no automatic deletion button; requests are handled manually, taking open operations and retention obligations into account. Statutory response deadlines apply.
Game results and operations are checked automatically. If a check rejected your result or affected a reward, you may explain your position, challenge the decision and request human review through support.
You may complain to a competent data protection authority, including the Cyprus Commissioner for Personal Data Protection, or seek a judicial remedy. Contacting support does not limit these rights.

TIPS uses HTTPS, protected password derivations, encrypted payout details, session checks and operation logs. No technical measure guarantees protection from every incident.
The service is for users aged 18 or over. If you believe an account belongs to a minor, contact support.
The edition date appears at the top. Material processing changes must be communicated before the relevant new processing begins; where consent is required, it is requested separately.