Privacy policy

Who we are

exydeal (exydeal.com) is an independent service, developed and operated by a private individual based in Romania, that finds discount codes in public sources. That person is the controller of the data described below. Contact: [email protected].

What we process about visitors

• Searches - the name of the store you search for, used to return your results and to build the public code base. We never link it to your identity.
• Codes you submit - the code, description and optional nickname from the “Add a code” form become public on the site, by the nature of the service. Don't put personal data in those fields.
• Votes (“Worked” / “Invalid”) - kept only as totals, with no link to you.
• IP address - processed technically for abuse prevention, to detect your country (so we search your country's stores) and in the server's security logs. We build no profiles from it.
• Anonymous statistics - for each visit we note the page, what is clicked, the country, the device type and the browser, on our own server, with no third-party analytics service. To count a day's visitors, the server computes a code from the IP address and browser, mixed with a secret value that changes at midnight; the code is not stored in your browser and cannot link one day to another.
• Only with your consent - a random identifier kept in your browser, to recognise returning visitors, and a recording of how a visit unfolds (which pages open, where you scroll, what you click), which we can play back like a film. What you type is never recorded; inputs are masked.

Data about the creators whose posts we show

Codes come from public posts on Instagram, TikTok, Facebook, YouTube and Reddit. For each code we keep and show its source: the link to the post, the author's name or account as it appears publicly, the relevant excerpt of the post's text and the date. We use them so anyone can check where a code comes from.

If you wrote a post and don't want it to appear here, write to [email protected] with the link to the post and we'll remove it.

Why, and on what legal basis

• Running the service (searches, submitted codes, votes, code sources) - our legitimate interest in offering a free service of verifiable codes, and visitors' interest in finding them.
• Security and abuse prevention (IP address, logs) - legitimate interest.
• Anonymous statistics and notifications - legitimate interest, to understand how the site is used and improve it.
• The browser identifier and visit recording - your consent, which you can withdraw at any time.

We don't use the data for advertising, we don't profile, and we never sell data.

How long we keep it

• Statistics - 12 months, then deleted automatically.
• Visit recordings - 30 days, then deleted automatically.
• ntfy notifications - at most 12 hours, at ntfy.
• Codes, their sources, submitted codes and votes - as long as the service runs or until you ask us to delete them. Expired codes are no longer shown but stay in the database as history.
• Server logs - only as long as needed for security and troubleshooting, then deleted.
• Your banner choice - in your browser, until you change it.

What we store in your browser

A single cookie, NEXT_LOCALE, holding the language you chose (kept for a year), strictly necessary for your preference. In localStorage: the theme (light/dark), your choice in the banner and, only if you accepted, the random statistics identifier. If you refuse or withdraw your consent, the identifier is deleted. We use no marketing or cross-site tracking cookies.

Third-party services and transfers

• Our own server in Romania, and Cloudflare - the site and its database run on our own server in Romania. Traffic passes through Cloudflare (protection and delivery), which processes the IP address and technical request data; Cloudflare is certified under the EU-US Data Privacy Framework.
• Google - store logos (favicons) load from Google's public service; your browser makes that request directly.
• ntfy.sh - tells us when an external service the site relies on stops working. The alerts contain no visitor data.
• Serper, LiteScrape, Searlo and Exa - search engines we use to find public posts with codes. They receive only the name of the store searched.
• YouTube (Google), TikTok, Meta (Facebook/Instagram), Reddit and the public Arctic Shift archive - we read the text of public posts containing codes from them. They receive only the post addresses.
• DeepSeek (China) - the AI model that reads the text of public posts to verify each code. It receives the public text of those posts, which may include the author's name or account, but nothing about the site's visitors. China has no EU adequacy decision.
• 2Performant - the affiliate network, described below.

Affiliate links

Some official codes have their “Open the store” button marked “affiliate link”. That link goes through 2Performant, which on click sets cookies in your browser to attribute the order and pay us a commission. That tracking is done by 2Performant and the store, under their own policies; we receive no data about you or your order, only the commission. Your price and discount stay the same. Community codes never carry an affiliate link.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and you can withdraw your consent at any time with the button above. For any request write to [email protected]. We may need to verify that the request concerns your data. Please write to us first; we can usually sort it out quickly. You can also lodge a complaint with the Romanian supervisory authority, ANSPDCP (dataprotection.ro).

Security and reporting

The site is served over HTTPS, requests are rate-limited and administration access is protected. Security issues or abusive content: [email protected]. The rules for submitted content and reporting are in the Terms.

Changes

When the service changes, we update this page and the date at the top.