Privacy Policy

1. What we collect

Account details: your email address, the name and photo from Google if you sign in with Google, your username, display name, bio, and any avatar or cover you upload.

What you post: your referral links, codes, rewards, notes, and your "It worked" and "Report" votes.

Usage: views, clicks, and copies on referrals, counted per day. To count visitors fairly without tracking them, we store a one-way hash of the IP address and browser that changes every day. For account safety we also keep a one-way hash of the IP address you signed up from.

Payments: Stripe collects your card and billing details. We never see or store full card numbers. We keep your Stripe customer ID and the status of your Boosts and membership.

2. How we use it

To run your account and profile, rank referrals fairly, stop spam, bots, and fraud, process payments, send the emails you need (sign-in links, notices when your code is used, and, for purchases, receipts and slot-open alerts), and show you analytics for your own referrals.

We do not sell your personal information, and we do not show third-party ads.

3. Cookies and local storage

We use only essential cookies: a sign-in session cookie, a small "signed in" flag so pages can show your member menu, and an invite cookie when you arrive from an invite link.

Cloudflare Turnstile checks that you are human when you sign in, post a code, or send a request. Our analytics are cookieless. Because we use no advertising or tracking cookies, we do not show a cookie banner.

4. Who we share it with

Service providers that run the site for us: Cloudflare (hosting, security, storage), Neon (database), Stripe (payments), Resend (email), Sentry (error reports), Google (only if you choose Google sign-in), and a logo service that receives store domains, never your data.

Your username, display name, bio, profile page, and live referrals are public by design. We may also share information when the law requires it or to protect members from fraud.

5. How long we keep it

Account and posting data is kept while your account exists. Daily visitor hashes used for deduplication are deleted after a few days. Payment records are kept as long as tax and accounting laws require.

6. Your choices and rights

From Profile settings you can edit your profile, download a copy of your data, or delete your account. Deleting removes your profile and referrals from the site right away.

Depending on where you live (for example under GDPR or CCPA), you may have rights to access, correct, delete, or port your data, and to object to some uses. Email support@refertosender.com and we will respond within 30 days.

7. Children

ReferToSender is for adults 18 and over. We do not knowingly collect information from anyone under 13, and we delete it if we learn of it.

8. International transfers and changes

We are based in the United States and our providers may process data in other countries, using standard contractual protections where required.

We will post changes here and email members about significant ones. Questions: support@refertosender.com.