Privacy

1 November 2026

Dealpuffin is a marketplace of live Stripe coupons. This page says what we store when you use dealpuffin.com or the agent tools at mcp.dealpuffin.com.

Account

Sign-in is Firebase Authentication: Google, an email link, and Facebook when that option is available. We keep your Firebase user id and your verified email. We do not store your password. Stripe is not a sign-in method.

A signed-in session uses an httpOnly cookie named dp_session. It holds the sign-in token for about an hour. Signing out clears it.

Waitlist

If you join the waitlist, we store that email so we can tell you when the catalog goes public. That address is not an account, and it is not used for a weekly letter unless you later ask for one.

Products and Stripe

A product listing stores the product URL, the name and description you give, the category, and which Stripe coupons you choose to publish.

A Stripe connection stores a read-only restricted key, encrypted, and the time it last synced. We use it to import coupons and promotion codes. We do not store the key in plaintext, we do not charge cards with it, and we do not redeem a code in Stripe. The code a seeker receives is pasted at your checkout.

Imported coupon records include the Stripe ids, the discount terms, expiry, redemption counts, and whether a code is locked to one Stripe customer. Public search never returns the code string. A code is shown only after a claim, or to the provider who owns it.

Claims and wishes

A claim records which account revealed which code, and when. A wish records the category, the text, and an optional target, attached to your account.

Agents and API keys

An API key is shown to you once. We store a hash, a last-four hint, the label, and the tools you turned on. An agent that connects with OAuth stores a client registration and a hashed refresh token, with the tools granted at consent. You can remove a key or an agent from Settings.

Cookies, theme, and analytics

The theme switch stores dp-theme in your browser’s local storage. It stays on your device.

The site uses Google Analytics 4 to count visits. Google may set its own cookies. Cloudflare sits in front of the site and sees request metadata such as IP address. The server keeps ordinary request logs.

Who else sees it

We do not sell personal information. The companies that process it for us are Google (sign-in and analytics), Cloudflare (DNS and proxy), and Google Cloud (the app and the database). Stripe receives the API calls we make with a provider’s read-only key. Seeker emails are not sent to Stripe.

A published listing is public to people who can browse the catalog: the product, the discount terms, and a masked code. The code itself is not public.

How long

Account, listing, claim, and key records stay while the account or listing is active. A removed API key is deleted. Waitlist emails stay until the launch note is sent, or until you ask us to remove yours. Server logs are kept only as long as the host retains them.

Your choices

You can sign out, remove API keys, and stop publishing a coupon. To delete your account, a listing, or a waitlist email, write to [email protected].

Dealpuffin is not for children under 16.

Changes

If this page changes in a way that matters, the date at the top changes with it.