privacy.
Applies to the floor app and flooronrh.com. Last updated 15 September 2026.
floor lets you pick up token rewards by standing at a real-world drop, posting about it, and getting paid to a wallet. To do that we need a small amount of data. This page lists all of it.
What we collect
- Account. You sign in with Apple or Google through Privy, our login provider. We store the identifier Privy gives us and, if your login shares it, your email address. We never see your password.
- Location, only while you verify. When you start a verification at a drop, the app sends your GPS position every few seconds for the duration of the check, about 20 seconds. We keep that short trail with the claim so an admin can review it and so we can catch faked locations. Location is never collected in the background or outside a verification.
- Country from your IP address. During verification we compare the country of your connection with the country of the drop. We store the country code, not the IP address.
- Device identifier. A random identifier generated on your phone is sent with each verification so we can see when one person claims from several accounts.
- Your post. The link to the post you submit with a claim.
- Your floor photo. The photo you take at the drop. The original is kept in a private archive. If an admin approves it and puts it on the wall, a resized copy without location metadata is shown publicly on flooronrh.com. You agree to that when you claim.
- Wallet address. The address of the wallet your rewards are paid to. Payouts are recorded on Robinhood Chain, which is a public blockchain.
- Push token. If you allow notifications, a token that lets us tell you when a reward is ready.
- Crash reports. If the app crashes, a report goes to Sentry with the error, the app version and the device model. Reports are scrubbed of coordinates, wallet addresses and post links before they leave the phone.
What we do with it
Review and pay claims, stop cheating, show approved floor photos on the wall, notify you about rewards, and fix crashes. Nothing is sold or used for advertising.
Who else sees it
- Privy handles login and wallets.
- Cloudflare stores photos and serves the website.
- Railway hosts the backend and database.
- Expo delivers push notifications.
- Sentry receives crash reports.
- Apple and Google provide sign-in and, for testers, TestFlight.
Payouts are visible to anyone on the Robinhood Chain block explorer, as with any blockchain transaction.
How long we keep it
Account, claim and verification data stay while your account exists. Original photos are kept as an archive. Crash reports are deleted by Sentry after 90 days.
Your choices
- Location, camera and notification permissions can be changed in your phone settings at any time. Without location you cannot verify a drop.
- To have your account, claims and photos deleted, or a photo taken off the wall, message @flooronrh on X from the account you posted with. On-chain payouts cannot be deleted.
Safety
Things people ask before installing a beta app that pays out crypto.
- Permissions the app asks for. Location (while in use), camera and photo library (only when you take or pick a floor photo), and notifications. Nothing else: no contacts, no microphone, no background location, no reading of other apps.
- No private keys. The app does not hold a wallet key and never asks you to sign a transaction. Your reward wallet is created by Privy for your login and payouts are sent to it by our server. The app cannot move your money.
- The reward money is in a public contract. Drops are funded into a vault contract on Robinhood Chain. Its source is published on Blockscout, so anyone can read exactly what it can and cannot do, and every payout is a public transaction. The contract has not had a third-party audit yet, which is why drop sizes stay small during the beta.
- Where the builds come from. iPhone builds are distributed only through TestFlight, so each one is reviewed by Apple before testers get it. Android builds come straight from our build service, and the get the app page shows the SHA-256 fingerprint of the current APK so you can check that the file you installed is the one we built.
- What the server can see. Only what is listed above under "What we collect". Verification trails, photos and post links go to our own backend, not to any analytics or advertising service.
- Deleting the app removes everything stored on the phone. Your account stays until you ask us to delete it.
Children
floor is not for anyone under 18.
Changes
If this page changes in a way that matters, the date at the top moves and the change is listed in the app's release notes.