01 Who we are
Faucet Arena operates the website at faucetarena.com and is the data controller for the information described here. For anything on this page, including requests to access or delete your data, contact us from the support page.
02 What we collect
What you give us
- Your email address, which is also your login and your FaucetPay payout address.
- Your password, stored only as a one-way hash. We cannot read it and neither can anyone who steals the database.
- An invite code, if you signed up through someone's referral link.
What your browser sends
- IP address and the country it resolves to.
- Device and browser characteristics: user agent, screen size, timezone, language. Combined these form a device fingerprint.
- Session data: when you logged in, from where, and when you last passed a security check.
What you generate by playing
- Every claim, view and offer completion, with its timestamp, the reward, and which faucet or campaign it came from.
- Your balances and your full ledger, which is append-only: entries are added, never edited or deleted.
- Withdrawal requests and their outcome.
- Click timing patterns, used to tell human behaviour from automation.
We do not ask for your real name, your address, your date of birth or any identity document. We do not collect payment card details because there is nothing to pay for.
03 Why we collect it
| What for | Data used | Basis |
|---|---|---|
| Running your account | email, password hash, session | contract |
| Paying you | email, ledger, withdrawals | contract |
| Scoring the season | claims, offers, points | contract |
| Stopping fraud and bots | IP, device, click timing | legitimate interest |
| Keeping the site up | server logs | legitimate interest |
| Accounting records | ledger, payouts | legal obligation |
We do not use your data for advertising profiling and we do not sell it. Advertising partners pay us for completed actions, not for information about you.
04 Fraud prevention, in plain terms
The prize pool is real money, which means people will try to take it with fake accounts. Preventing that is the reason for most of the technical data we hold.
- We compare device fingerprints and IP ranges across accounts to find several accounts run by one person.
- We look at how regular your click timing is. Human timing varies; a script's does not.
- We require a security check (Cloudflare Turnstile) at login, valid for the session rather than on every action.
- An account can be flagged automatically and then reviewed by a person. No account is closed by an automated decision alone: a human reviews it first, and you can appeal.
- We do not publish the exact thresholds. Doing so would only help the people we are keeping out.
Completing one partner offer is what unlocks your account. That requirement exists precisely so we can rely less on invasive tracking: a bot farm will not pay a partner to verify a fake account.
05 Who we share it with
Only the services needed to run the site, and only what each one needs.
| Who | What they get | Why |
|---|---|---|
| CPX Research | an anonymous user id, your IP and country | to show you offers and confirm completions |
| FaucetPay | your email and the amount | to send your withdrawal |
| Cloudflare | IP, request metadata | DNS, security checks, abuse protection |
| Vercel | request logs | hosting the site |
| Neon | the database itself | storing all of the above |
Offer partners receive an identifier that is not your email. They do not learn who you are from us. What they collect inside their own offer is governed by their privacy policy, and you should read it before handing over personal details in a survey.
We will also disclose data where a law or a valid legal order requires it.
06 Cookies and local storage
No advertising cookies and no third-party analytics trackers.
- A session cookie that keeps you logged in. Without it the site cannot work.
- A security check cookie set by Cloudflare Turnstile, so you are not asked to prove you are human on every click.
- Local storage for small interface preferences, which never leaves your browser.
Offerwalls shown inside the site are third-party frames and may set their own cookies once you open them.
07 How long we keep it
- Account data: while the account exists.
- Ledger and payout records: kept after deletion where accounting rules require it, because a payment record cannot be erased on request.
- Security and fraud signals: up to 12 months, then removed.
- Server logs: 30 days.
- Closed seasons: kept indefinitely as a frozen snapshot, because a settled tournament has to stay verifiable. Player names in it are pseudonymous.
Deleting your account forfeits any balance you have not withdrawn. We cannot restore it afterwards, because the account it belonged to no longer exists.
08 Your rights
If you are in the EU or the UK you have the following rights, and we apply them to everyone regardless of where they live.
- Access: get a copy of the data we hold on you, including your full ledger.
- Correction: fix anything inaccurate, such as a mistyped payout email.
- Deletion: have your account and personal data removed, except records we must keep for accounting. You can do it yourself at any time from faucetarena.com/account/delete (also in your profile).
- Portability: receive your data in a machine-readable file.
- Objection: object to processing based on legitimate interest. Note that objecting to fraud prevention means we cannot keep the account open, because it is the only thing protecting the prize pool.
- Human review: ask a person to look again at any automated flag on your account.
Requests are answered within 30 days, from the support page, using the email on the account. If you are not satisfied with our answer you can complain to your local data protection authority.
09 Where data is stored
The database is hosted in the European Union (Frankfurt). Some of our providers operate globally, so data may be processed outside the EU under the standard contractual clauses those providers publish.
Cryptocurrency payouts are recorded on FaucetPay's systems, and any on-chain transaction is by nature public and permanent. We never publish your email or your account details alongside a transaction.
10 Children
The service is for people aged 18 and over. We do not knowingly collect data from children. If you believe a minor has an account, tell us and we will close it and delete the data.
11 Changes and contact
- Material changes to this policy are announced on the site before they take effect.
- The version and date at the top of this page always reflect the copy in force.
- For anything here, contact us from the support page.
- How the tournament itself works is in the rules.