Browser Extension Privacy Policy

Overview

This privacy policy applies specifically to the GetCurrentOffer browser extension (“Extension”). It supplements our main Privacy Policy, which governs the overall GetCurrentOffer service.

Single Purpose

The Extension has a single purpose: to help you organize and sync your personal credit card merchant offers from supported card issuer portals to your GetCurrentOffer account, and to show you relevant offers while you browse merchant websites.

Permissions & Why We Need Them

• activeTab: To detect whether you are on a supported issuer portal or merchant website and display relevant offer information.
• storage: To store your Extension settings, authentication state, and cached offer data locally on your device.
• scripting: To run content scripts on supported issuer portals that read your merchant offer data from the page.
• alarms: To schedule periodic polling for sync commands from your account.
• tabs: To detect which tab is active and show relevant merchant offer information.
• Host permissions (getcurrentoffer.com): To read your signed-in session on our own website, so the Extension can act as your account without a second sign-in.
• Host permissions (issuer sites): To access your offer data on americanexpress.com, chase.com, citi.com, capitalone.com, capitaloneoffers.com and capitaloneshopping.com when you are logged in. To show the full list, the Extension presses your issuer's own display controls (“show more”, category tabs and card switchers). It never adds an offer to a card, submits a form, or changes a setting.
• Host permissions (all sites, optional): Requested only if you turn on “Detect offers while I shop”, and removed when you turn it off. It detects when you are browsing a merchant website and shows you matching offers. The Extension downloads a list of known merchants and checks the site against it on your device. If the site is not a known merchant, nothing is sent. If it is, the Extension asks our API for offers for that merchant, which means we receive the merchant name (for example “Nike”) along with a truncated hash of your IP address, and we log it as a lookup, normally no more than once every five minutes. If you open the popup on a store while signed in, that store name is logged to your account. We do not receive the page URL, the page contents, or your browsing history, and we never read form fields, passwords, or payment details on these sites.

Data We Collect

When you use the Extension with offer syncing enabled, we collect:

• Merchant names and offer titles/descriptions
• Offer amounts, types, and expiration dates
• Card product names (e.g., “Sapphire Preferred”)
• Last four digits of card numbers (for identification only)
• Offer activation URLs
• Whether an offer is already added to your card, when the issuer shows it
• Issuer name and offer category
• Merchant logo URLs and the time of each sync
• Merchant names looked up while you browse, as described under host permissions above
• Installation telemetry: an install identifier, your browser, operating system, Extension version, country, and install and last-active timestamps
• Connection heartbeat: while the Extension runs it reports, about once a minute, that it is connected, which issuers it can read, whether each appeared signed in or signed out the last time it looked, and when it last read anything
• Sync diagnostics: which issuer each sync attempt covered, whether it succeeded, and any error reason, so we can tell when an issuer changes their site and our scraper breaks

Data We Never Collect

• Full credit card numbers
• CVV/security codes or PINs
• Account balances or transaction history
• Login credentials for any website
• Browsing history or page addresses
• Personal financial information beyond offer details and each card's product name and last four digits

How Data Is Transmitted & Stored

• All data is transmitted over HTTPS (TLS/SSL encrypted connections).
• Synced offer data is sent to our secure API endpoint and stored in our PostgreSQL database (hosted by Supabase) with encryption at rest.
• Your synced offers are keyed to your account and returned only to requests signed in as you.
• Data is stored on servers located in the United States.

Your Controls

• Nothing syncs until you ask for it: the Extension does not sync until you install it, sign in, and run a sync. Passive background capture — where the Extension picks up offers from issuer pages you open yourself — is a separate toggle that is off by default.
• Community sharing is off by default: your synced offers stay private to your account unless you turn sharing on, either on the first-run screen (where the box is unticked) or in the Extension's Settings.
• Disable syncing: Untick a card or turn off automatic sync in the Extension's Settings at any time, or uninstall the Extension.
• Delete data: You can delete all synced offer data from your account settings or via the DELETE /api/user/data endpoint.
• Uninstall: Uninstalling the Extension stops all data collection. Previously synced data remains in your account until you delete it.

Community Sharing

The Extension's first-run screen asks whether you want to contribute the offers you sync to our public community pool. The box is unticked and sharing stays off unless you turn it on. You can change it at any time from the Extension popup.

If you do turn it on, it applies to future syncs automatically rather than asking again for each offer, and only these seven fields can ever be submitted: merchant, issuer, offer title, offer description, offer type, category, and expiration date. The card account name, the last four digits, the activation link, and the logo URL are stripped by our server before the record is written, whatever the Extension sends. Your account is recorded as a contributor of the offer. Submissions are moderated before they appear publicly, except from contributors with an established trust record, whose submissions appear immediately.

Turning sharing off stops future submissions but does not retract offers already published, because the same offer is typically contributed by many users. See the main Privacy Policy for the full detail.

Third-Party Sharing

We do not sell or rent your Extension data, and we do not disclose it for advertising. We disclose it to the infrastructure providers that run the Service on our behalf — Supabase (database) and Vercel (hosting and API) — under data processing agreements.

The one case where Extension data becomes visible to anyone else is community sharing, described above, and only if you turn it on.

Data Retention

Synced offer data is retained until you delete it or delete your account. Upon account deletion, your synced offers are removed within 30 days; offers already published through community sharing remain, without your card details.

Changes to This Policy

We may update this policy as the Extension evolves. Material changes will be communicated via the Extension update notes and on this page.

Contact

For privacy questions about the Extension, contact us at privacy@getcurrentoffer.com.