Privacy Policy

The short version

Promo Code Index is built to work without knowing who you are. There are no visitor accounts and no advertising, and we build no advertising profiles. The only place we ask for anything about you is the newsletter and deal-alert signup, which is optional and takes an email address. Skip it and the site never learns who you are. What we record ourselves keeps the site fast, fair, and free of abuse, and none of it holds your name, your email address, or your IP address.

One thing we won’t bury in the fine print: the affiliate network Impact runs a tag on our pages that sets cookies in your browser. It is built to credit purchases to the site that sent a shopper, though on this site it has nothing to credit (the Information section explains why). We also use Google Analytics, which sets cookies of its own to count visits and tells us nothing about who you are. These are the only tracking technologies on the site, and one switch controls them all. In the EEA and the UK none of them load until you say yes. Everywhere else they load with the page, and you can switch them off from any page. If your browser sends a Global Privacy Control signal, none of them load at all, wherever you are. Following a “Visit” link to a store Sovrn Commerce tracks may also send the click through Sovrn’s own redirect before it reaches the retailer, but in the EEA and the UK only once you say yes, and never if your browser sends a Global Privacy Control signal. When it doesn’t, the link goes to the store directly. “When you leave this site” and “Your rights” below explain what that means and how to opt out. The Cookies section below names exactly what each tag on this page stores.

Information we collect

Click events. When you click through to a retailer from a coupon, deal, product, or store link, we record the click: which offer, product, or store it was, which part of the page it came from, the page you came from, and your two-letter country code (worked out by our hosting provider from your connection). If we are comparing two versions of a button, we also note which version you saw. Alongside that we store a one-way cryptographic hash (SHA-256) of the day’s date, your IP address, and your browser’s user-agent string. It lets us count each visitor once a day, and because the date is part of it, the same browser produces a different value the next day, so it cannot follow you from one day to the next. We do not store your IP address itself, your name, your email address, or any account identifier. These events power the “popular right now” feature you see on the site.

When the link goes through an affiliate network, we add our own reference for the click to it, so a commission the network reports later can be matched to the page it came from. The network receives that reference and nothing about you.

Offer-view counters. When a coupon button scrolls into view, we count one view: which offer was shown and on which kind of page (a store page, the homepage, a category page). That is the entire record. There is no cookie, no hash, and no identifier of any kind. We use these counts only to learn which offer layouts people find useful. When we compare two versions of a button, your browser also keeps a note of which one you were given (the word “control” or the name of the alternative, in your browser’s local storage) so you see the same version on every visit. Roughly half of all visitors share each value, so it identifies no one.

Newsletter and deal alerts. If you enter your email address to get our newsletter or to follow a store, a category, or a word, we store the address, which page the form was on, and the dates that show where your subscription stands: when you submitted the form, when you confirmed it, when we last emailed you, when you stopped the newsletter, and when you unsubscribed, if you have. If you follow something, we also store what you follow, how often you want to hear about it, and any pause you set. We store no name and no browsing history, and nothing on the list is linked to the click and view records above, which hold nothing that could be matched to an address. We do not sell, rent, or share the list.

Confirming, and leaving. Signing up takes two steps on purpose. We send nothing to an address until it has been confirmed, apart from the one email asking to confirm it. Ignore that email and you won’t hear from us again. Every email after that carries a one-click unsubscribe link, both in the message and in its headers, so your mail app can remove you without your opening anything. Alert emails also link to a page where you can change what you follow, how often you hear from us, or pause alerts for a while. You can also write to privacy@promocodeindex.com and we will delete your address by hand.

Abuse prevention. We use your IP address briefly to enforce fair-use limits on voting, signing up, and the AI assistant, so one person can’t stuff the ballot or flood a paid service. The signup form also counts attempts against the email address you typed. These rate-limit counters expire on their own within 24 hours and are never joined with click or browsing data. Separately, our hosting provider processes standard request data, including IP addresses, to serve and secure the site, as almost every web host does.

AI assistant questions. If you use the deal assistant, the question you type is sent to Anthropic, our AI provider, to write the answer, and to Voyage AI, which turns it into numbers we use to find offers that match what you meant. We do not store your questions in our database, and Anthropic’s commercial API terms do not use them to train its models by default. Please leave personal information out of your questions. The assistant only needs to know what kind of deal you’re after.

Community feedback. “Did this code work?” votes are stored only as two running totals for each code, one for yes and one for no, which help decide the order codes appear in. No vote is linked to you.

Affiliate attribution. We work with an affiliate network called Impact, and it has a tracking tag. It is built for attribution: recording that a visit happened here, and rewriting links to retailers on the page so that a purchase can be credited to Promo Code Index. On this site it has no such link to rewrite, because every link to a retailer goes through our own redirect, so today it records visits and credits no purchase. It stores a few values in your browser and sends page-view events to Impact’s servers. We do not read those values, we get no personal information back from them, and they are not used to advertise to you. Impact decides for itself how it uses what its tag collects, under its own privacy policy; it is a separate company, not one acting on our behalf. But the tag is tracking technology, and calling it anything else would be dishonest.

Where we ask first. If you are visiting from the European Economic Area or the United Kingdom, that tag and Google Analytics do not load at all until you choose “Accept” on the banner. Not when the page loads, not while you decide, and not if you ignore the banner. Declining and ignoring have exactly the same effect, and neither sends so much as a request. Elsewhere they load with the page, as the attribution tag has since the site opened. You can change your answer at any time with “Cookie preferences” at the bottom of every page, and if you switch them off after switching them on, we delete what they stored. Anywhere in the world, a browser that sends a Global Privacy Control signal gets none of them, with no banner to answer.

What we deliberately don’t collect

• No visitor accounts and no names. The optional signup form is the only place we ask for an email address, and it asks for nothing alongside it
• No stored IP addresses: not in our click data, and not in our analytics
• No advertising of our own: we run no ads, set no advertising or retargeting cookies ourselves, and do no fingerprinting
• No precise location, only a country code
• No selling of the data we hold. The one caveat is the click through Sovrn, explained under “Your rights”

The affiliate attribution tag and Google Analytics are the only tracking technologies on the site. The attribution tag is built to credit purchases and Google Analytics to count visits. We run no advertising, and Google Analytics has its advertising features switched off in the tag itself on every page, not merely unticked in a dashboard. Nothing we collect feeds an ad profile. What Sovrn does with its own click cookie is up to Sovrn, as explained under “Your rights”.

Cookies and local storage

Promo Code Index sets one cookie of its own on the public site, the one that remembers your answer to the banner, and keeps two small notes in your browser’s storage, described at the end of this list. Everything else below is set by a third-party tag running on the page, and each is worth naming plainly:

• Affiliate attribution (Impact). The tag described above sets first-party cookies, at the time of writing IR_gbd and IR_MPS, and stores an impact-referral value in your browser’s local storage. Impact uses them to record your visit here; as explained above, they credit no purchase on this site today. Impact sets their lifetime, not us, and what Impact does with them is governed by Impact’s own privacy policy. In the EEA and the UK, none of this is set unless you accept it first.
• Leftover Sovrn cookies. The on-page Sovrn Commerce tag that used to set cookies here was removed on September 26, 2026. If your browser still holds one from before then (its names begin with vglnk.), we clear it the next time you load a page. Sovrn still sets its own cookie when you follow a “Visit” link to a store it tracks, described under “When you leave this site” and “Your rights”.
• Analytics (Google). Google Analytics 4 sets first-party cookies named _ga and _ga_ followed by a stream id. They hold a randomly generated number that lets Google tell one browser from another, so that ten page views by you are not counted as ten visitors. They carry no name, no email, and nothing you typed. In the EEA and the UK they are not set unless you accept first, and the same “Cookie preferences” switch deletes them.
• Your cookie choice. When you answer the banner, we store that answer in a cookie named promocodeindex_consent for about six months. It holds one word, whether you accepted or declined, and exists only so we don’t ask again. It is what makes “no” stick. A choice you made on fyndare.com doesn’t carry over, because a cookie stays with the address that set it, so the banner may ask you again here.
• Notes in your browser’s storage. If we are comparing two versions of a button, local storage remembers which one you were given, as described under “Information we collect”. And so the banner doesn’t have to ask our server on every page whether it needs to appear where you are, session storage remembers that answer until you close the tab. Neither note leaves your browser, and neither identifies you.
• Administrator login. Authentication cookies are set only inside the administration area (/admin) and only for the site’s administrators. They are strictly necessary for that login to work and are never set on public pages.

“Cookie preferences” at the bottom of every page turns the tags on or off whenever you like, wherever you are in the world, and switching them off deletes what they already stored. Your browser settings work too. Either way it costs you nothing: every page, every code, and every outbound link keeps working exactly the same. Your visit simply won’t appear in our visitor counts.

Analytics

Google Analytics 4 is the one analytics service on the site, and we treat it that way. It sets the cookies named in the Cookies section above, so it does not load for anyone who declined or ignored the banner in the EEA or the UK, the same rule as the affiliate tag, for the same reason. We use it for aggregate measurement only: the advertising features are switched off in the tag itself on every page load, Google Signals is off, the property is not linked to any advertising account, and we send Google no identifier of our own. There is no email, no account, and no hashed anything, because we don’t have those to send. Google receives your IP address as part of the request, as every server you contact does, and uses it to work out an approximate location. Google states that it does not log or store that address in Google Analytics 4, and it is not available to us in any report. What we actually look at is which pages people reach from search and which ones they leave straight away.

If we ever switch on an analytics feature that does more than this, such as advertising integrations, cross-device identity, or anything else that profiles you, we will update this policy before it goes live, not after.

When you leave this site

Coupon and deal links lead to retailers through affiliate networks (CJ, Rakuten Advertising, and Sovrn Commerce). Impact’s tag runs on our pages while you are still here, as described above; the other networks come into play only once you leave. When you follow an outbound link, those networks and retailers may set their own cookies to attribute any purchase you make. That attribution is how this site earns commissions (see our Affiliate Disclosure). Their processing is governed by their own privacy policies, and we encourage you to read them. Rakuten Advertising, for example, names the cookie it sets after such a click and explains how to remove it in its Cookie and Tracking Technology Policy.

Sovrn Commerce is one of those networks, and it does more than “set a cookie”. A “Visit” link to a store Sovrn tracks sends you through Sovrn’s own redirect, sovrn.co, before you reach the retailer, and Sovrn sets its own cookie there. In the EEA and the UK, the link passes through Sovrn only if you chose “Accept” on our cookie banner, and if your browser sends a Global Privacy Control signal, it never passes through Sovrn, wherever you are. When it doesn’t pass through Sovrn, the link takes you to the store directly. Sovrn’s disclosure under the Transparency and Consent Framework lists that cookie with a ten-year lifetime and purposes that include building advertising profiles. Sovrn’s privacy policy (last updated January 14, 2026) says Sovrn “sells” or “shares” identifiers, browsing activity, and inferences about you, as California law uses those words, and does not say that this click is left out. “Your rights” below names every way to stop it. Sovrn decides for itself how it uses what that click collects, under its own privacy policy; it is a separate company, not one acting on our behalf.

Until September 11, 2026, we also worked with Awin. If you followed one of our retailer links before that date, Awin may have set a cookie in your browser.

Service providers

We rely on a small set of providers to run the site:

• Vercel: hosting and content delivery. It processes request data, including IP addresses, briefly, and works out the country code we store.
• Supabase: database and image storage. It holds the records described above, including the signup list.
• Upstash: short-lived rate-limit counters for abuse prevention.
• Anthropic: answers AI assistant questions.
• Voyage AI: turns AI assistant questions into numbers used to find matching offers.
• Resend: sends our email, meaning signup confirmations, deal alerts and the newsletter to the addresses on the list, and password-reset emails to the site’s administrators.
• Google: Google Analytics 4. It sets the cookies described above and processes visit data on servers in the United States and elsewhere, under Google’s own privacy policy and the EU–US Data Privacy Framework.

Each provider above processes data on our behalf and under its own security and privacy commitments. We do not sell, rent, or hand the data we hold to advertisers or data brokers. Sovrn Commerce and Impact are described elsewhere on this page, in “When you leave this site” and “Information we collect”, and deliberately not here: each is an independent company, not a processor working on our behalf.

Data retention

Click events, offer-view counts, and vote totals are kept for as long as they remain useful for the statistics they power; none of them holds your name, email address, or IP address. Newsletter and alert addresses are kept until you ask us to remove yours, or until we stop sending email altogether, in which case we delete the list rather than keep it. An address that was asked to confirm and never did is deleted about a month after its confirmation link expires, because an address that has given us no usable consent is not worth holding. If you unsubscribe, we keep the address itself and nothing more, so that a later signup can’t quietly put you back on a list you left. Tell us and we will delete that record too. Rate-limit counters expire on their own within 24 hours. Administrator password-reset tokens are single-use, stored only as hashes, and expire within one hour. Google holds the visit data Google Analytics collects for 14 months and then deletes it automatically. That is the shortest setting that still allows a year-over-year comparison, which for a site whose traffic is seasonal is the reason to keep it at all. The affiliate and analytics cookies live in your browser, not our database. The companies whose tags write them set their lifetimes, not us, and clearing your browser storage removes them.

Your rights

Depending on where you live (for example under the GDPR in Europe or the CCPA/CPRA in California), you may have rights to access, correct, delete, or port personal data, and to opt out of its sale or sharing. Three honest notes on how those rights apply here.

We do not sell the data we hold. Nothing in our own records is sold, rented, or passed to advertisers.

Sovrn is the exception, and you can opt out of it. Following a “Visit” link to a store Sovrn Commerce tracks may send the click through Sovrn’s own redirect, sovrn.co, before it reaches the retailer, and Sovrn then sets its own cookie there. In the EEA and the UK that happens only once you say yes, and never if your browser sends a Global Privacy Control signal; when it doesn’t, the link goes to the store directly. Sovrn’s privacy policy (last updated January 14, 2026) says Sovrn “sells” or “shares” identifiers, internet activity, and inferences, as California law uses those words, and does not say that click is left out. Because it runs through our site, allowing it may count as “sharing” on our part. Any one of these stops it:

• Turn on Global Privacy Control in your browser. We then never send your click through Sovrn, and Sovrn says it honors the signal for its own tracking too.
• Use Sovrn’s Privacy Center, where “Disable Tracking” stops Sovrn Commerce tracking on every site that uses it, or its opt-out page for the sale or sharing of your data. Both work by setting a cookie of Sovrn’s, so clearing your cookies undoes them.
• For interest-based advertising across the industry, YourAdChoices offers a single opt-out.

The rest of what we keep is not tied to a name or an email address, so we are generally unable to find the records that relate to a specific person who asks (a situation the GDPR anticipates in Article 11). The signup list is the one exception, and the simple one: it is keyed by your email address, so if you write to us from that address we can show you, correct, or delete your entry directly. You can contact us with any other request or question and we will do our best to help.

Global Privacy Control and Do Not Track

We honor Global Privacy Control for this page’s own tags. If your browser sends it, the attribution tag and Google Analytics do not load on any page, wherever you are, even if you chose “Accept” before switching the signal on, and we clear anything they had already stored. There is no banner to answer for those; the signal is the answer. Sovrn says it also honors Global Privacy Control for the tracking on a “Visit” link to a store it tracks, described under “Your rights”. Every page, code, and link keeps working.

Do Not Track never gained an agreed meaning, so we do not act on it separately. What it asks for is one click away under “Cookie preferences” at the bottom of every page, and in the EEA and the UK the tags stay off until you turn them on.

Children

Promo Code Index is for adults. The site is not directed at anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has signed up for our emails or otherwise given us their information, write to us and we will delete it.

International visitors

The site is operated from the United States, and our own records are held on servers in the United States. By using the site, you understand that the limited data described above is processed there.

Changes to this policy

If our practices change, for example if we add a new analytics tool or a new partner whose tag runs on our pages, we will update this policy before the change takes effect and revise the “last updated” date above. Material changes will be flagged prominently on this page.

Contact

Send questions about this policy, or any privacy request, to privacy@promocodeindex.com.