KickBack Pro privacy policy

Last updated 15 August 2026

KickBack Pro is operated by KickBack Rewards LLC. This policy covers the KickBack app on iOS and Android and the KickBack website.

It is written to be read rather than to be survived. Where a question has an uncomfortable answer, the answer is here.

The short version

• We collect what is needed to pay you cashback: who you are, which card you linked, and which purchases earned money.
• We never receive your card number, and we never receive your bank account or routing number. Both go from your browser to the company that handles them, and we get back a reference that is useless to anyone else.
• We do not sell your data, and there is no advertising or tracking of any kind in our apps or on our site — no analytics, no third-party scripts, no advertising identifiers.
• You can delete your account yourself, at any time. See how, and what survives it.

What we collect

Your account. An email address, a display name, and a password. The password is stored only as a scrypt hash; we cannot read it and cannot tell you what it is.

Your card, as a reference. When you link a payment card, the card number goes from your browser directly to our card network partner and never reaches our systems. They give us a token, plus the card scheme and the last four digits so you can recognise it. That is all we hold.

Your qualifying purchases. When you buy from a participating merchant, we are told about it — by the card network for a linked-card purchase, or by an affiliate network if you followed a creator's link. We record the merchant, the amount, the commission, and the date, so we can work out what you are owed.

We are not told about your other spending. The card network reports purchases at merchants participating in our programme, not your statement.

Your creator connection, if you have one: which creator, and from when. If you have not connected to anyone, you still earn — that is what the house account exists for — and there is nothing to record.

How you want to be paid. For a gift card, the email address you gave us to deliver it to. For a bank transfer, a reference from our payment processor and a label such as "Chase, ending 4305". The account and routing numbers are held by the processor and never by us.

Your cash-outs: what you withdrew, when, by which method, and whether it arrived.

Sessions. A record of your signed-in devices, so that signing out everywhere works. Session and refresh tokens are stored hashed.

A log of actions taken on the account — sign-ins, changes, payouts — so that a question about what happened has an answer. It records what was done and by which account, not who was holding the phone.

If you are a creator, additionally: your tax identifier, when the amount you have earned reaches the threshold at which US law requires us to collect it. It is encrypted at rest under a key held separately from everything else, is never written to a log, and is never returned by any part of our software — including to you. You will only ever see the last four digits.

What we do not collect

• Your full card number, at any point, in any system, log or backup.
• Your bank account or routing number.
• Your location.
• Your contacts, photos, camera, or microphone. The Android app requests no permissions at all beyond network access.
• Any advertising identifier, and any behavioural profile.

Why we are allowed to hold it

To provide the service you signed up for — attributing purchases, calculating cashback, and paying it to you — and to meet the legal obligations that come with moving money, including tax reporting for creators and keeping financial records that can be audited.

Who else sees it

We share the minimum with the companies that make the product work, and with nobody else. We do not sell data, and we do not share it for anyone else's advertising.

• Our card network partner receives your card details directly from your browser when you link a card, and tells us about qualifying purchases. They never receive your KickBack password or your balance.
• Affiliate networks receive an anonymous click reference when you follow a creator's link, and tell us if it led to a purchase. They are not told who you are.
• The gift card issuer receives the email address you chose and the amount, because that is how the card reaches you.
• Our payment processor receives what is needed to make a bank transfer. Your account details are held by them, not by us.
• Our hosting and infrastructure providers, who store the data on our behalf and are not permitted to use it for anything else.
• Law enforcement or a regulator, where we are legally required to. If we are permitted to tell you, we will.

Where it is held

In the United States. If you use KickBack from outside the US, your information is transferred there.

Cookies

The website sets one cookie: the session that keeps you signed in. It is httpOnly, so no script can read it, and it exists for no purpose other than knowing it is you.

There are no analytics cookies, no advertising cookies, and no third-party cookies, so there is no consent banner to dismiss.

How long we keep it

Your personal information is kept while your account is open. When you delete your account it is erased immediately and cannot be recovered.

The financial record of money that has already moved is kept indefinitely, with your identity removed from it. The deletion page explains exactly what that means and why an append-only ledger cannot make an exception.

Your choices

• Delete your account, yourself, from the app — or by email if you cannot sign in. See Delete your account.
• Remove your card without deleting anything else. You stop earning on it immediately.
• Disconnect from a creator at any time. You keep earning at the same rate.
• Ask us what we hold about you, or ask us to correct it, by writing to support@kickbackpro.com.

Depending on where you live you may have additional rights — to a copy of your data, to correction, to erasure, or to object. Ask, and we will tell you what applies and do it.

Children

KickBack is not for anyone under 18, and we do not knowingly hold information about children. If you believe a child has an account, write to us and we will remove it.

Security

The measures we consider material enough to state:

• Card numbers and bank details never enter our infrastructure; both are held by the companies regulated to hold them.
• Passwords are stored as scrypt hashes, never recoverable.
• Tax identifiers are encrypted at rest under a separate key.
• Our logs are built on an allowlist: a field is invisible to them until someone deliberately adds it, which is the opposite of the usual arrangement and the reason a credential cannot end up in a log by accident.
• The database account our software uses cannot alter or delete financial or audit records. That is enforced by the database, not by our code.

No system is perfectly secure, and anyone who tells you otherwise is selling something.

Changes

If we change this policy we will update the date at the top, and we will tell you in the app before anything that materially affects you takes effect.

Contact

KickBack Rewards LLC — support@kickbackpro.com