Privacy Policy

Accounts

You can create an account with an email address and a password, or with Google.

We store your email address, display name, public slug, optional bio, and language preference (English or Simplified Chinese).

For a password account we store a salted PBKDF2 hash of the password. We do not store the password itself. A Google-only account has no password until you set one through password recovery.

Your public profile at /u/your-slug shows your display name, bio and offers. It does not show your email address.

A password account has to verify its inbox. We send one reminder about five days after signup. If the address is still unverified after seven days, we delete the account, its sessions, its sign-in links, any Google link, and the offers that account posted, including clicks, feedback and reports that depend on those offers.

A verified account stays until you ask us to delete it, or we close it under the terms of service.

API tokens

If you create a personal API token, we store only a hash of its secret, plus its name, granted scopes, creation time, expiry, last use and revocation time. The secret is shown only once.

Tokens can read, publish or edit your offers within the permissions you grant. Offers published with a token are public and attributed to you. Tokens cannot manage your account or sign in to browser pages. You can revoke a token from your account page.

Token API rate limits use the token identity rather than the connecting IP address.

Google sign-in

If you choose Continue with Google, we ask Google only for the openid, email and profile scopes.

From that sign-in we keep your Google subject ID, your email address, the fact that Google had verified the email (stored as the time we marked the address verified), and your Google account name. That name becomes your display name, which you can edit.

We do not keep Google access tokens or refresh tokens. The authorization code is exchanged once for an ID token. We check that token and then discard it.

If the Google email matches an Affhub account that has already verified its inbox, we link Google to that account. If it matches an account that has not verified its inbox, we do not link it until the inbox is verified.

We use this information only to create your account, sign you in, and show your display name. We do not use it for advertising. Affhub's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy

What you submit

Offers you publish are public. That includes the merchant, title, description, type, code, destination link, value, region, eligibility, payment method, expiry, stacking notes, source link, and the other fields on the form.

Feedback records that you marked an offer as worked or not. The public page shows the counts, not your name beside a vote.

Reports (a reason and a description) are kept for review. They are not published on the offer page.

Offer text stays in the language you wrote. We do not send it to a translation service.

Offer clicks

When someone uses an offer, we store which offer was requested, which offer and contributor link was selected, the signed-in account if there is one, a short label for the selection rule, and the time. We do not store an IP address on the click.

Click records stay so we can count uses and rotate equivalent referral links. They are removed with an unverified account, as described above. If you ask us to delete a verified account, we detach its click records from the account.

IP addresses and rate limits

Cloudflare provides the connecting IP address in the CF-Connecting-IP header. The app uses it only to enforce rate limits on actions such as sign-in, sign-up, verification, reports, clicks and the AI features.

We store a hash of the limit bucket (the action, the IP address and the time window), not the raw IP address.

A daily job deletes expired rate-limit rows, expired sessions, expired email links and expired Google sign-in state.

Cookies

affhub_session signs you in. It is HttpOnly and SameSite=Lax, Secure on HTTPS, and lasts about 30 days. The server stores a hash of the token, not the token itself.

affhub_google is used only during Google sign-in. It holds the OAuth state. It is HttpOnly and SameSite=Lax, Secure on HTTPS, limited to the path /auth/google, and lasts about 10 minutes. The matching server row (the PKCE verifier, nonce and language) is deleted when sign-in finishes or when it expires.

affhub_locale remembers English or Simplified Chinese after you use the language switcher. It is not HttpOnly. It is SameSite=Lax, Secure on HTTPS, and lasts about one year. It is not an analytics cookie.

affhub_region remembers your selected country or region, including the choice to browse all regions. It is HttpOnly and SameSite=Lax, Secure on HTTPS, and lasts about one year. It does not determine your language or assert that an offer is available to you.

We do not use advertising cookies or analytics cookies. Affhub does not embed a third-party analytics script.

Email

We send transactional email only: address verification, one reminder before an unverified account is deleted, and password reset. We do not send marketing email.

Messages are sent with Cloudflare Email Sending from no-reply@auth-mail.affhub.link. Reply-To is support@affhub.link.

Each message contains a one-time link. We store only a hash of that link. Verification links last 24 hours. Password reset links last one hour. Opening the link does not use it up; you confirm on the page. The link sits in the URL fragment, so it is not sent to our server as a query string.

Who else processes information

Cloudflare hosts the site on Workers, stores the database in D1, and sends the email above. Delivering a request means Cloudflare sees connection data such as the IP address. Inside the app, that IP address is used only for the rate limits described above.

Google provides sign-in, as described above. We do not send your offers or purchase notes to Google.

agentaab provides optional AI features for signed-in accounts, when those features are turned on.

Offer prefill: if you paste a public http or https link, we may fetch that page and send agentaab the link, the text extracted from the page when the site allows automated reading, and today's date. If the page cannot be read, we send the link without the page text. If you upload a screenshot, we send that image once (PNG, JPEG or WebP, up to 4 MB) and today's date. Affhub does not store the image. Crop out names, emails, card numbers and order IDs first. The form says the same thing.

Purchase interpretation: if you describe what you are buying, we send that description to agentaab so it can suggest search filters. Estimated savings and eligibility still come from the offer terms stored by Affhub.

For both features we send a signed Affhub account id so agentaab can apply its usage limits. We do not send your password, email address or Google tokens for this. We do not sell personal information.

Contact, access and deletion

Email support@affhub.link to ask a privacy question, or to request access, correction or deletion.

There is no delete button in the product. If you ask, we delete the account and the offers, feedback and reports tied to it, and we detach its click records. We may keep a short record of the request if we need it to show that the deletion was done. We may refuse a request that would break the law or someone else's rights.

Unverified accounts are deleted automatically after seven days, as described above.

Children

Affhub is not meant for children. Do not sign up if you are under the age required to consent where you live.

Changes

If this policy changes, we will update this page and the date at the top.