Privacy policy
Version 2026-10-21. Draft: this text describes what the system actually does and must be reviewed and completed by the operator (name, address, legal bases) before public launch.
Who processes the data
The operator of this ad network. Contact for data questions: support@j2x.net.
What data we collect and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email, password hash, role, date and version of consent | Account, login, confirmation and password emails | Contract (use of the service) | While the account is active; anonymized after deletion |
| 2FA secret (encrypted), backup codes (hash) | Protection of accounts (required for admins, optional for everyone else) | Legitimate interest (security) | While active; erased when 2FA is turned off or the account is deleted |
| Saved payout recipient (FaucetPay email, username or address) and when it was changed | Paying withdrawals to the right account; pausing withdrawals after a change | Contract | While the account is active; erased on deletion |
| Requested new email address (until confirmed) | Changing the account email | Contract | Up to 24 hours or until confirmed; erased on deletion |
| Login history: date, result, shortened IP, country, device type and browser name | Letting you spot logins that were not you | Legitimate interest (security) | 90 days; erased on deletion |
| Where you came from when you signed up: referring site (domain only), UTM tags of the link and the first page you opened | Knowing which channels bring sign-ups | Legitimate interest (measuring our marketing) | While the account is active; erased on deletion |
| Email notification choices | Sending only the notifications you want | Contract | While the account is active; erased on deletion |
| Deposits, balance, withdrawals (amount, recipient, status), settlements | Executing payments and accounting | Contract and legal obligation | Kept because of accounting obligations; the recipient and IP are removed on deletion |
| IP on a withdrawal request | Security and investigation of abuse | Legitimate interest | 180 days |
| IP of admin actions | Audit of the actions | Legitimate interest | 365 days |
| Counters for limiting attempts (IP, email) | Protection against brute force | Legitimate interest | 2 days |
| Sent emails (recipient address) | Proof of delivery | Legitimate interest | 30 days |
| Visits to our public pages when not signed in: page, time, shortened IP (e.g. 203.0.113.0), country, device type, browser name, referring site (domain only), UTM tags, and whether the visitor is a known bot. No extra cookies, no full IP, no full User-Agent, no fingerprinting | Counting visits, sources and crawlers of the website | Legitimate interest (running and improving the site) | 90 days |
Session cookie j2x_sid (set on j2x.net pages, also before sign-in) | Login and protection of forms | Strictly necessary | Cookie until the browser is closed; session files 14 days. See the cookie policy |
Visitors of sites that show our ads
Ads are shown in an iframe that sets no cookies and does not track across sites. For every view and click we keep only: a hash of the IP address (irreversible, with a secret key), the IP truncated to /24 (e.g. 203.0.113.0), a hash of the User-Agent, device type, browser languages (main codes only, e.g. bg,en), country and network class (from IP2Location LITE), the page domain and the time. We use them for reporting, billing, protection against fake clicks and frequency limiting. We do not keep the full IP address and we do not build interest profiles. Retention: 37 days (configurable), after which only daily aggregates without personal data remain. Ads are chosen by price and quality, not by a personal profile, so we do not ask for consent for personalization. Publishers (site owners) remain responsible for their own policy and cookies.
Who we share data with
- Payment providers (Apirone for incoming, FaucetPay for outgoing payments) - only the data needed for the payment.
- Email provider (SMTP) - the address and the text of the emails.
- IP2Location LITE - country/network data (lite.ip2location.com); the lookup is local, the IP is not sent anywhere.
Your rights
You can get a copy of your data and delete your account from My data (requires your password). You can also ask for correction, restriction or objection at the contact address and lodge a complaint with the supervisory authority (the Bulgarian Commission for Personal Data Protection). Deletion anonymizes the account; financial records remain without a link to your personal data, as far as the law requires us to keep them.