Privacy Policy
Exactly what we collect, why, and how to get it back or delete it.
Introduction
GetCurrentOffer (“we,” “us,” or “our”) operates the website getcurrentoffer.com, the GetCurrentOffer browser extension, and our developer API (together, the “Service”). This policy describes what we collect, why we collect it, who we disclose it to, how long we keep it, and the controls you have.
We have written this policy to match what our software actually does. Where a practice is limited by a technical control rather than a promise, we say so, so that you can hold us to it.
The Short Version
- Your synced card offers are private to your account and are not shown to anyone else unless you turn on community sharing, which is off by default.
- We never receive full card numbers, CVVs, PINs, issuer passwords, balances, or transaction history. Our extension cannot read them and our database has no field to store them.
- Card payments are handled entirely by Stripe. Card details never reach our servers.
- We do not sell or share your personal information for money or for cross-context behavioral advertising.
- You can export or delete everything yourself from Settings → Privacy & data.
Information We Collect
1. Account information. We offer one sign-in method: Google. When you sign in, Google sends us your name, email address, and profile picture. We never receive or store your Google password. We also store an optional display name and, if you opt in, whether you appear on the contributor leaderboard.
2. Your synced card offers. If you install the browser extension and sync an issuer, we store the merchant offers found in your issuer portals (American Express, Chase, Citi, Capital One, PayPal, Rakuten). For each offer we store: merchant name, offer title and description, category, offer type, issuer and source, expiration date, merchant logo URL, the offer's activation link, the card account name (for example “Freedom Unlimited”), the last four digits of the associated card, and the time of the sync.
We do not collect full card numbers, CVV or security codes, PINs, expiration dates of the card itself, your issuer login credentials, account balances, statements, or transaction history. The extension reads only the offers area of your issuer's site; it does not read your statements or transactions, and none of these fields exists in our database.
3. Saved offers and searches. Offers you save or bookmark and searches you choose to save, linked to your account. If you are not signed in, saved offers stay in your browser's local storage and are not sent to us.
4. Community contributions. If you turn on community sharing, we store the offers you contribute to the public pool and a contributor record: your contribution count, a trust score used for moderation, and your position in the ordered contributor list for each offer. See Community Sharing for exactly which fields become public.
5. Payment and subscription information. If you subscribe to a paid plan, checkout runs on Stripe. Your card number, CVV, and billing details are entered on Stripe's systems and never reach our servers. We store only what we need to know what you are entitled to: your Stripe customer ID, your Stripe subscription ID, your plan tier, your subscription status, and the date your current billing period ends.
6. Email and notification data. Your notification preferences, in-app notifications we generate for you, and any email digest or price-alert subscriptions you create. Alert subscriptions store your email address and stay in a pending state until you click the confirmation link; we do not send to an address that has not confirmed. Every email includes an unsubscribe link.
7. Developer and API data. If you create an API key, we store the key name, tier, creation and last-used timestamps, and request counts. Keys are stored hashed; only a short non-secret prefix is kept in readable form. If you connect through our admin MCP server, we log the account email, the tool called, the arguments passed, and the result status. The public MCP server needs no account and attaches no identity: a search made through it is recorded the same way a search on the site is, described in 8 below.
8. Usage and device data. Page views and sessions; search queries, the filters applied, the number of results, and the referring page; how long you hover over an offer card; clicks on outbound merchant and card-offer links; the marketing campaign parameters that brought you to the site; your country as reported by our host; and your browser type, operating system, and user agent string.
If you use the extension, it checks the site you are on against a merchant list held on your device. Only when the site is a known merchant does it ask our API for that merchant's offers, so we receive the merchant name and log it as a lookup. We do not receive the page URL, the page contents, or your browsing history.
We store a truncated one-way hash of your IP address rather than the address itself. This reduces exposure, but we do not claim it makes the data anonymous — we treat these hashes as personal data and protect them accordingly.
9. Extension telemetry. When you install the extension we record an install identifier, your browser, operating system, extension version, country, the campaign parameters that led to the install, and the install, last active, and uninstall timestamps. We also record the outcome of each issuer sync attempt (which issuer, whether it succeeded, and any error reason) so we can tell when an issuer changes their site and our scraper breaks.
10. Support messages. If you contact us, we store your name, email address, message, and a truncated hash of your IP address for abuse prevention.
How We Use Your Information
- Provide, maintain, secure, and improve the Service
- Sync, store, and display your personal card offers across your devices
- Rank and personalize the offers we show you
- Process subscriptions, billing, and refunds through Stripe
- Send the emails you asked for (digests, price alerts) and essential service and security notices
- Moderate community contributions and score contributor trust
- Detect and diagnose sync failures when an issuer changes their site
- Measure which features and marketing channels work, in aggregate
- Detect and prevent fraud, abuse, and scraping; enforce rate limits and our Terms
- Comply with legal obligations
We do not use your synced offer data to build advertising profiles, and we do not disclose it to advertisers.
Legal Basis for Processing
If you are in the EEA, UK, or Switzerland, we rely on:
- Contract: providing the account, sync, and subscription features you signed up for.
- Consent: community sharing, marketing and digest emails, and non-essential analytics cookies. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
- Legitimate interests: securing the Service, preventing fraud and abuse, diagnosing sync failures, and understanding aggregate usage — balanced against your rights.
- Legal obligation: tax, accounting, and responding to lawful requests.
Your Offers and Community Sharing
Offers you sync are private to your account by default. Row-level security in our database restricts each row to the account that owns it.
Community sharing is off by default. You turn it on either on the extension's first-run screen (where the box is unticked) or in Settings → Community. If you never turn it on, none of your offers are submitted to the public pool.
What happens when you turn it on. Please read this carefully, because it is a standing permission rather than a one-off:
- It applies to future syncs automatically. While it is on, each sync submits the offers it finds to the community pool without asking again for each offer. You can also submit your current offers in one action using “Share all”.
- Only seven fields can ever be submitted: merchant, issuer, offer title, offer description, offer type, category, and expiration date. This is enforced as a server-side allowlist, not just a setting: the card account name, the last four digits, the activation link, and the merchant logo URL are stripped before the record is written, whatever the extension sends.
- Contributions are moderated. Submissions enter a pending state and are reviewed before they appear publicly. Contributors above a trust threshold are auto-approved until that trust is revoked.
- Identical offers are merged. The same offer submitted by several people collapses into one public record that counts its contributors. Your account is recorded as a contributor to that record. Your name is not displayed next to an offer unless you opt in to the contributor leaderboard.
- Sharing is not reversible for you alone. Turning sharing off stops future submissions but does not retract offers already published, because an offer is typically contributed by many users and is no longer personal to you. To have your contributor association removed, email privacy@getcurrentoffer.com and we will unlink it from your account.
You can turn community sharing off at any time in Settings → Community, and you can delete your synced offers and sharing records from Settings → Privacy & data while keeping your account.
Where Our Public Offer Directory Comes From
The offers you can browse without signing in come from two places:
- Publicly published rates that we collect automatically from sources that show the same rates to any anonymous visitor, such as Rakuten and Capital One Shopping. No user account is involved.
- Community contributions from extension users who turned on community sharing, after moderation and after the personal fields listed above are stripped.
Card-linked offers from American Express, Chase, and Citi are targeted to individual accounts and are not published anywhere public, so the only way they reach the directory is through community contributions. If you have not enabled community sharing, your offers are not part of it.
Who We Share Information With
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose it only as follows.
Service providers who process data on our behalf under contract:
- Supabase — database and authentication hosting
- Vercel — website and API hosting, performance analytics
- Stripe — subscription payments; Stripe is the controller of the card details you enter with them
- Resend — delivery of transactional, digest, and alert email
- Google — sign-in (OAuth) and Google Analytics
We also disclose information:
- Publicly, where you have chosen to contribute offers to the community pool, limited to the seven fields listed above.
- For legal reasons, when required by law, subpoena, or valid government request, or to establish or defend legal claims.
- For safety, to protect the rights, safety, or property of GetCurrentOffer, our users, or the public.
- In a business transfer, in connection with a merger, acquisition, or sale of assets, with notice to affected users.
- As aggregate statistics that do not identify any individual (for example, “10,000+ offers across 6 issuers”).
Cookies and Analytics
We use cookies and similar technologies for sign-in, for remembering your preferences, and for analytics. Full detail is in our Cookie Policy.
- Essential: session and authentication tokens, CSRF protection. The Service does not work without these.
- Preferences: your settings, and saved offers for signed-out visitors, held in your browser's local storage.
- Google Analytics: traffic and usage measurement. This currently loads for all visitors when you open the site.
- Vercel Analytics and Speed Insights: page performance and load metrics.
You can opt out of Google Analytics with Google's browser add-on, block cookies in your browser settings, or clear local storage; the Cookie Policy explains how. Blocking essential cookies will stop you from signing in. We do not serve third-party advertising cookies.
Data Security
- TLS encryption in transit and encryption at rest for stored data
- Row-level security so an account can only read its own offers, settings, and keys
- A server-side field allowlist that strips personal fields from community submissions regardless of what a client sends
- API keys and OAuth codes stored as hashes, compared in constant time; only a non-secret key prefix is readable
- Federated sign-in, so we never hold a password for your account
- Truncated hashing of IP addresses in analytics and abuse logs
- Access controls on administrative tooling, with tool calls logged
No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.
Data Retention
- Account data: kept while your account is open, and deleted when you delete your account.
- Synced offers, saved offers, and settings: kept until you delete them, clear your data, or delete your account. Offers are replaced as they are re-synced.
- Community contributions: the public record persists after you stop sharing, for the reasons described above. Ask us and we will unlink your contributor association from the record.
- Subscription records: kept while the subscription is active and afterwards for as long as tax and accounting law requires.
- Usage, analytics, search, and extension telemetry: kept for as long as it is useful for product and security analysis. We are introducing a scheduled purge for this category; until it is in place we periodically prune these tables manually, and we will update this section with a fixed retention period once the automated job is live.
- API and MCP logs: daily request counts reset daily; lifetime totals persist for the life of the key. Administrative tool-call logs are pruned periodically.
- Support messages: kept while needed to handle your request and to maintain a record of the issue.
When you delete your account we remove your account record, synced offers, saved offers, settings, profile, and extension state, and we revoke your API keys so they stop working (the key record itself is retained in revoked form as an audit trail). Offers you contributed to the public pool remain, as described above. Backups roll off on their own schedule and are overwritten within 30 days.
Your Rights and Controls
You do not need to email us to exercise the main ones. From Settings → Privacy & data you can:
- Export your data as JSON, covering your synced offers, settings, and API key records
- Clear your data — delete your offers, saved offers, and sharing records while keeping your account
- Delete your account and every associated record
- Turn syncing on or off per issuer, and turn community sharing off, at any time
- Turn off email notifications, or unsubscribe from any email we send
Depending on where you live, you may also have the right to access, correct, port, restrict, or object to our processing of your personal data, to withdraw consent, and to lodge a complaint with your data protection authority. To exercise a right that is not available in Settings, email privacy@getcurrentoffer.com. We respond within 30 days, and we will not treat you differently for exercising a privacy right.
California Privacy Rights
Under the California Consumer Privacy Act as amended by the CPRA, California residents have the right to know, delete, correct, and port their personal information, to opt out of sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights.
In the last 12 months we collected the categories described in Information We Collect: identifiers, customer records, commercial information, internet activity, approximate geolocation at country level, and inferences drawn for ranking offers. We collect these for the business purposes listed under How We Use Your Information, and we disclose them only to the service providers named above.
We do not sell personal information and we do not share it for cross-context behavioral advertising, including of anyone we know to be under 16. See our Do Not Sell or Share My Personal Information page. You may use an authorized agent to submit a request; we may ask you to verify your identity before we act on it.
Data Breach Notification
If a breach affects your personal data, we will notify the relevant supervisory authority without undue delay and, where required, within 72 hours of becoming aware of it. We will notify affected users without undue delay where the law requires it or where the breach is likely to put you at high risk.
Our notice will describe the nature of the breach, the categories and approximate number of records involved, the likely consequences, the measures we have taken, and the steps you can take to protect yourself. If you believe your data has been compromised, contact security@getcurrentoffer.com.
International Data Transfers
Your data is stored and processed in the United States by our hosting providers. If you use the Service from outside the United States, your data will be transferred there.
For users in the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, incorporated into our agreements with the service providers named above, together with the technical measures described in this policy. You may request further information about these safeguards at privacy@getcurrentoffer.com.
Children's Privacy
The Service is not intended for children under 13, and we do not knowingly collect personal information from them. If we learn that we have, we will delete it promptly. A parent or guardian who believes we hold a child's data can contact privacy@getcurrentoffer.com.
Changes to This Policy
We may update this policy. Changes appear here with a revised “Last updated” date. If a change materially affects how we handle your synced offers or community contributions, we will give notice by email or a prominent notice in the Service before it takes effect, and where the law requires consent we will ask for it rather than assume it.
Contact Us
- Privacy: privacy@getcurrentoffer.com
- Security: security@getcurrentoffer.com
- Web: getcurrentoffer.com/contact