What Rewards Platforms Like Nift and Rokt Actually Do With Your Data

More than half of Americans, 56%, say they always or often click "agree" on privacy policies without reading them, and 61% doubt the policies would explain much anyway, per Pew Research Center. Both instincts get tested at the same small form: the one asking for a name and email before an online gift or offer arrives.

Filling in that form has a knowable cost, because the platforms behind it publish exactly what they do with the information. Nift, the gifting network behind thank-you emails from partners like Klarna and ParkMobile, and Rokt, the $3.5 billion company placing offers on checkout confirmation pages, both maintain detailed public privacy policies. Read side by side, they map what the offer economy actually collects, where it goes, and which exits exist.

What the platforms collect

Rokt's policy lists name and email plus "transaction details or conversion data (such as what you purchased, when and via what method)," alongside behavioral tracking through cookies, pixels and web beacons, per its published policy. It also obtains information from outside its own placements, listing "data validation services" and "data enrichment providers" among its third-party sources.

A Nift gift’s baseline is narrower on the form itself: name, email address and zip code "to verify gift eligibility and deliver your gift," per its privacy policy. Behind the form, the policy also lists device identifiers, IP addresses, browsing history on its own pages, and inferences such as gender drawn from names. Neither company's collection is unusual for the category; the point is that both enumerate it in public, which is more than the emails themselves reveal.

Inference and enrichment are the categories most people miss. A platform that guesses your gender from your first name, or buys a fuller picture of you from a "data enrichment provider," knows more than you typed into any form, and only the policy discloses that gap. Reading for those two words tells you more about a platform's real footprint than its homepage ever will.

Where the data goes

California law forces the sharpest disclosure, because it defines "sell" and "share" broadly enough to cover most ad-tech data flows, and then requires companies to say which they do. Under those definitions, "selling" doesn't require money changing hands for a mailing list; passing data to an ad network in exchange for anything of value can qualify. That breadth is why a careful policy sounds more alarming than a vague one, and why the vague one is the bigger warning sign.

Rokt's policy states it may "sell" or "share" identifiers and internet activity as those terms are defined under California privacy law, with advertisers, advertising networks and social networks among the recipients. Not every intermediary makes the same choice; Plaid, the banking-connection layer examined in the same consumer-security press, states that it does not rent or sell personal information, which shows the range the category spans.

Nift's policy ties its disclosures to the gift itself. Selecting a gift sends your name and email to the business providing it, so the gift can be redeemed, and partners may receive information about gifts you view or select. A "Do Not Sell or Share My Personal Information" link and privacy@gonift.com handle opt-outs, meaning the sharing runs by default until a user turns it off. So the direct answer to whether Nift sells personal data is the policy's own structure: disclosure to advertisers and partners is part of how gifts get delivered, and the opt-out, which stops it, is one link away.

Redemption itself adds no exposure beyond that. Using a gift means the selected business already has the name and email it needs to honor the certificate, and nothing in either policy attaches payment credentials to the claim, since selecting a gift never requires payment.

A two-minute privacy policy read

Privacy policies reward a targeted skim far more than a full read. Three sections answer most of what a consumer wants to know:

• Collection list. Every policy enumerates the categories collected. Count how many exist beyond what the form asked for; that gap is the real footprint.
• "Sell or share" section. Language keyed to California definitions is where honest disclosure lives. An opt-out link near it is a good sign; its absence is the red flag.
• Deletion path. Rokt takes requests at privacy@rokt.com or through a web form; Nift takes them at privacy@gonift.com or its online deletion form. A policy with no deletion mechanism is behind the law in a growing number of states.

Those three checks take about two minutes, which is roughly the time Pew's data suggests most people currently spend not reading any of it.

What the trade actually is

Personalized matching cannot run on nothing. A platform that shows a cyclist a bike-shop gift instead of a steakhouse certificate knows something about the cyclist, and pretending otherwise would misdescribe the whole category. What separates platforms is the size of the footprint, enrichment-broadened profiles at one end, form-field basics at the other, and how plainly the policy says so.

Consumers hold more recourse than the trade itself. State privacy laws now back the deletion requests and opt-outs both companies' policies describe, and Pew's research catches the public mid-shift: 78% trust themselves to make sound privacy decisions, even as 61% doubt their actions change anything. On this narrow question, the doubters underrate themselves. The data trail behind a claimed gift is real, documented and, at both companies examined here, reversible by request.