Privacy Policy

Last updated: November 5, 2026

This Privacy Policy explains what personal data RAYU Auto Surf (“we”, “us”) collects, why, and what rights you have. Data controller: [your name or company], [address], [your contact email].

1. Data we collect

• Account data: your email address and password. Passwords are stored only in hashed form; we cannot see them.
• Sites you add: addresses, titles, approval status and view counts.
• Surf activity: which sites you were shown, start and completion times, and points earned. This is needed to apply the 20-second visit and 1 second = 1 point rules and to prevent abuse.
• Points history: every change to your points balance and its reason.
• Technical data: your IP address is used briefly to limit repeated failed logins; standard server logs may also record IP addresses and browser information.
• Acceptance record: the date you accepted the Terms of Service and this policy.

2. Why we use it (legal bases)

• To create and run your account and the surf and points system (performance of our agreement with you).
• To keep the Service secure and prevent fraud and automated abuse (legitimate interests).
• To meet legal obligations where applicable.

We do not sell your personal data. We do not send marketing emails.

3. Sites shown during surfing

When you surf, other members’ websites load in your browser. Those sites may collect data such as your IP address and set their own cookies according to their own privacy policies. We do not control them.

4. Advertising

Our home page may show ads from third-party networks. These providers may use cookies or similar technologies; see our Cookie Policy. [List the ad networks you use, if any.]

5. Sharing

We share data only with service providers needed to run the Service (for example our hosting provider [name]), when required by law, or to protect our rights and users.

6. Retention

• Account, site and points data: while your account exists.
• Unfinished visit records: deleted automatically after about 2 days.
• Failed-login records: about 15 minutes.

When you ask us to delete your account, we delete or anonymise your personal data unless we must keep it by law.

7. Your rights

Depending on where you live (for example under the GDPR or Turkey’s KVKK), you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to complain to your data protection authority. To use these rights, contact [your contact email].

8. Security

We use hashed passwords, secure session cookies and access controls. No system is completely secure, but we work to protect your data.

9. Children

The Service is not intended for people under 18, and we do not knowingly collect their data.

10. Changes

We may update this policy; the date at the top shows the latest version.