Privacy policy.

What we collect on the public site

Almost nothing. The marketing pages, guides, and bonus catalog do not require an account, do not set first-party advertising cookies, and do not run user-identifying analytics. A basic server log records IP addresses and user agents for 14 days for operational reasons only. The only cookie set without an account is a functional lang cookie that remembers whether you chose English or Korean; it carries no personal data and is not used for advertising or tracking. We also use Vercel Web Analytics, a cookieless service that reports aggregate page views; it sets no cookies and does not identify you or follow you across sites.

When you click an offer’s apply button, the link passes through our own address (/go/...) on its way to the bank or card issuer. For that click we record which offer it was, the page you clicked from, the site language, and the time. The click record holds no IP address and no cookie, and it is not linked to an account; the request itself appears only in the short-lived server log described above, like any other page request. We use these counts to see which offers readers act on.

What we collect when you sign in

If you create an account to use the bonus tracker:

• Your email address, which you sign in with (password or Google) and which Supabase Auth uses for account emails such as password recovery. If you set a password, Supabase stores only a salted hash — we never see or store the plaintext.
• An sb-session cookie set on your browser after you sign in. It contains an access token and refresh token issued by Supabase, is httpOnly, lives at most 30 days, and is — together with the functional lang preference cookie described above — one of only two cookies BonusPrimer sets.
• The bonuses you choose to track and any notes you attach. These rows are scoped to your user ID by row-level security policies inside the database — no other user can read or modify them.
• Profile preferences you set on the settings page (display name, credit band, notification toggles). Same row-level scoping.

What third parties see

When you click an outbound affiliate link, you are handed off to an affiliate network or directly to the issuer’s site. Those parties set their own tracking cookies to attribute any resulting conversion to BonusPrimer. We never see the personal information you share with them on their site. Their privacy practices are governed by their own policies.

Account data (email, tracker rows, profile) is stored at Supabase, our database and authentication provider. Supabase’s data processing is governed by their privacy policy.

What we never do

• Sell or rent any data about you.
• Run behavioral ad networks on the site.
• Require you to create an account to read anything.
• Share your email with anyone outside BonusPrimer and Supabase.

Your rights

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, or any other US state with a comprehensive privacy law, you have the right to access, correct, or delete the information we hold about you. Write to hello@bonusprimer.com. We will respond within 30 days. If you are in the EU or UK, the same rights apply under GDPR and UK GDPR.

Updates

If this policy changes, we will update the “Last updated” date at the top and post a short note describing what changed.

Questions about this policy can be sent to hello@bonusprimer.com.