Privacy Policy

Ember and attofun.com are operated by ATTOFUN PTE. LTD., a company incorporated in Singapore, which also operates cash-back.ai. We are responsible for your personal data as described in this policy. We handle personal data in line with the Personal Data Protection Act 2012 of Singapore (PDPA) and other laws that apply to us.

• Website: the first time you visit, Ember creates an anonymous attribution code, saved in a host-only HttpOnly cookie. This does not create an account. We show only the rewards tracked by this code, before and after explicit claim, not a person’s wallet. Its immutable initial snapshot contains the source site, available structured device/country hints and captured campaign identifiers, but not raw IP or full user-agent. Like most websites, our hosting provider records technical data such as your IP address, browser, the page requested and the time. See “Analytics, advertising and browser storage” below for the tools that run on our pages.
• Messaging details: when you send your code to Ember in a messaging app, your user ID, display name, phone number or username (depending on the app), language, and the messages you send to Ember.
• Game and reward data: the game you picked on our website, the link carrying an encrypted tracking token, and what our partners report back, such as the tasks you completed, their status and the reward.
• Rewards and referral data: your balance, welcome bonus, invite link, who invited you and who you invited.
• Payout data: your wallet address, the network you choose, and transaction records. If we need to verify your identity, we may also collect your name, date of birth, nationality, ID document and a selfie, usually through a verification provider.

• to show games and rewards available where you are, and to open your game links;
• to show the current code's cumulative tracked rewards and task statuses on our website, without access to the beneficiary's wallet or identity;
• to track completed tasks and credit rewards, welcome bonuses and referral rewards;
• to reply to you and send you service messages in the chat, such as reward confirmations;
• to send you new game alerts and other promotional messages, only if you have opted in;
• to process withdrawals and meet anti-money-laundering, sanctions and tax obligations;
• to detect and prevent fraud, duplicate accounts and abuse;
• to measure and improve our website and Ember;
• to comply with the law and protect our rights.

Where the PDPA requires consent, we rely on the consent you give by using Ember, or on other grounds the law allows, such as fulfilling our agreement with you or legitimate interests like fraud prevention.

Some fraud checks are automated. If an automated check affects your rewards or withdrawal, you can ask for a person to review it.

The games and rewards on our website come from our partner AON (aon.pro). On phones, your browser requests them directly from AON, so AON receives technical information such as your IP address and browser type. On computers, an existing server fallback requests them instead. When you tap a game, Ember validates the original action URL and appends an encrypted tracking token. The raw attribution code is not sent to AON in sub_id. Signing does not prove current availability or reward eligibility; only trusted partner reports establish rewards.

When you open a game link and install a game, the publisher and partner networks collect information needed to track progress under their own privacy policies. They return the encrypted tracking token with task reports so Ember can match legitimate rewards to the code. They do not receive your messages with Ember.

Official entry links contain the raw attribution code, and necessary service logs may retain it. Opening chat does not claim rewards: explicit /claim is required. A forwarded or exposed code may be claimed first by another eligible holder and may allow holders to read this code's rewards during its original 90-day access window, even after it is claimed. Possessing the code does not verify the original visitor or grant access to an account wallet.

If you send your code to Ember, you talk to Ember through messaging apps such as Telegram, WhatsApp or Messenger. We receive only the messages you send to Ember and the profile information the platform shares with businesses and bots (such as your user ID, display name and, on WhatsApp, your phone number). We cannot see your other chats or contacts.

• WhatsApp and Messenger are provided by Meta Platforms. Messages to Ember are sent through Meta's business messaging platforms, and Meta may process them as a service provider under its own terms and privacy policy.
• Telegram processes messages under its own privacy policy.

We use data received from these platforms only to provide Ember to you. We do not use it for third-party advertising, and we do not sell or share it with data brokers.

We send promotional messages only if you opt in, and we stop when you reply STOP. We follow the Do Not Call provisions of the PDPA and each platform's messaging policies.

Attribution codes are excluded from model inputs and ordinary chat collection copies; they must not be sent to ordinary advertising analytics or public caches. Necessary code diagnostics do not authorize logging full tracking URLs, tokens, request bodies or cookies.

Messages you send to Ember are processed by AI systems to understand your requests. We use AI and cloud providers that act on our behalf under contracts that restrict them to using your data to provide their services to us. Please do not send Ember sensitive information it does not need, such as passwords or card numbers.

When measurement is enabled after its automatic code-capture settings are reviewed, some pages, including the home page, load these tools:

• Google Analytics 4 measures page visits and clicks, such as which game and messaging app you choose. Google may receive your IP address, browser and device information and the page address, and may set analytics cookies (such as _ga).
• Meta Pixel measures page visits and the same clicks for advertising. Meta may receive your IP address, browser and device information and the full page address, and may set advertising cookies (such as _fbp).

There is currently no in-site consent or opt-out control; you can use browser privacy settings or tracking blockers to limit these tools and clear cookies.

We also store a few things in your own browser: the list of games you last saw, for up to an hour, so the page opens instantly next time; your anonymous code in a 120-day rolling cookie, renewed only after successful initialization; and whether you have opened the rewards panel. The code, signed game links and rewards are not saved in the shared game-list cache. Page reads and new game starts stop 90 days after the code was created, including after claim; cookie renewal does not extend that window. At expiry a new independent code is created without old rewards or binding. Clearing cookies starts a new anonymous visit: there is no website login or recovery. These browser preferences are not used for advertising.

• Game partners: an encrypted tracking token, not the raw attribution code, to match task reports.
• Messaging apps: to deliver messages between you and Ember.
• Analytics and advertising providers: Google and Meta, as described in “Analytics, advertising and browser storage”.
• Service providers: cloud hosting, AI, customer support, identity verification and payout providers, all acting on our instructions.
• People you invited, or who invited you: your referrer may see that you joined and the rewards they earned. They do not see which games you played.
• Authorities and advisers: where required by law, or to protect our rights, users or the public.
• A buyer or successor: if our business is sold or restructured.

We do not sell your personal data for money. Website usage data is shared with Meta and Google for advertising measurement; this may be treated as a sale or sharing under some privacy laws. You can object to it by contacting us.

Payouts in stablecoins such as USDC and USDT are recorded on public blockchains. Your wallet address, the amount and the time of the transfer become publicly visible and permanent. We cannot delete or change information once it is recorded on a blockchain.

Our providers may process data outside Singapore. When we transfer personal data overseas, we take steps to make sure it receives protection comparable to the PDPA, for example through contracts with the recipient.

We keep personal data only as long as needed for the purposes above. Reward and payout records are kept for as long as required for accounting, tax and anti-money-laundering purposes, which is usually at least five years after the transaction. Website server logs are kept only for a limited period. When we no longer need data, we delete or anonymise it.

We use reasonable technical and organisational safeguards to protect your data, including encryption in transit and access controls. No system is completely secure, so please keep your messaging account and wallet secure too.

Under the PDPA and other applicable laws, you can:

• ask for a copy of your personal data and how it has been used;
• ask us to correct data that is wrong or incomplete;
• withdraw your consent to our use of your data. We may then be unable to keep providing Ember, and we will explain the consequences first;
• object to the sharing of website usage data for advertising;
• stop promotional messages at any time by replying STOP;
• ask us to close your account and delete your data, subject to records we must keep by law.

To make a request, email [email protected]. We will reply within 30 days, or tell you if we need more time. We may need to verify your identity first.

If you are in the European Economic Area or the United Kingdom, you also have the rights to data portability, to restrict or object to processing, and to complain to your local data protection authority. Where those laws apply, we process your data to perform our contract with you, to meet legal obligations, for our legitimate interests (such as fraud prevention), or with your consent.

You can ask us to delete your Ember account and personal data at any time:

• Send the message “delete my data” to Ember on the messaging app you use, or
• email [email protected], identifying the relevant attribution code and which messaging app you used, if any. Never include passwords, verification codes or a full conversation transcript.

We will confirm your request, let you withdraw any Confirmed balance of at least US$10 first, then close your account and delete or anonymise your personal data within 30 days. We keep only the records we must keep by law, such as payout and anti-money-laundering records, and information already recorded on a public blockchain cannot be deleted. To remove what is stored in your browser, clear this site's data in your browser settings.

Ember is only for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has used Ember, please contact us so we can delete their data. Games also have their own age ratings; please check them before you play.

We may update this policy from time to time. We will post the new version on this page with a new date, and tell you through Ember if the changes are significant.

For questions or requests about your personal data, contact our Data Protection Officer at [email protected] (ATTOFUN PTE. LTD., Singapore).