Privacy policy

A1 Promos runs the website at aonepromos.com and the Chrome extension “A1 Promos: Promo Codes & Auto-Apply”. This policy explains what we collect when you use them, why we collect it, and how to get rid of it. It's written to be read, not skimmed past, so it's short.

The short version

• You can browse, copy and vote on codes without an account. We don't run analytics and we don't track you across other sites.
• We never store your IP address, only a salted hash of it that can't be turned back into the address.
• To submit codes you sign in with Google. We keep your Google account ID, name, email address and profile picture link, and no Google tokens.
• The extension matches the shops you visit on your device. Your browsing history never leaves your browser.
• We don't sell your data, and we don't share it with anyone except the providers that run the site for us.
• You can delete your account, and everything tied to it, at any time.

Browsing the site

Reading pages, copying codes and answering “Did it work?” need no account. The site has no analytics scripts, no advertising pixels and no social widgets. The only third-party requests a page makes are for the fonts it uses and, on forms, the Cloudflare Turnstile bot check.

The site runs on Cloudflare, which handles requests on our behalf as our hosting provider and keeps its own short-lived operational logs to run the network.

Your IP address

We never store your IP address. When you copy a code, vote, submit a code, send us a message, sign in, or the extension reports a result, we keep a salted hash of it instead: a scrambled form that can't be turned back into the address. We use it only against abuse: rate limits, counting each person once, and making sure one person can't verify or sink a code alone.

Signing in with Google

Submitting codes needs an account, and the only way to sign in is with Google. We use Google's OpenID Connect sign-in and ask for the openid, email and profile scopes, nothing more. From Google we receive and store your Google account ID, your email address, your name and the link to your profile picture. We don't store any Google access or refresh tokens; we only need to know who you are.

Your sign-in session lasts 30 days and is extended while you keep using the site. We keep your browser's name with the session so you can recognise it. Expired sessions are deleted every day.

Codes and messages you send us

When you submit a code or contact us we store what you typed, your browser's name, your country and the salted hash of your IP address. Submitted codes are reviewed by a person before they're published. Approved codes may show “Shared by” and your name; you can switch that credit off in your account settings.

Contact messages are kept for as long as we need them to reply and to handle any follow-up.

Cookies

The site sets three cookies, all of them ours. None is used for advertising or tracking.

• __Host-a1_session keeps you signed in for 30 days.
• __Host-a1_oauth protects the Google sign-in while it's in progress and expires after 10 minutes.
• a1_flash shows a one-time message such as “Settings saved.” and is removed once it's read.

Forms are protected by Cloudflare Turnstile, which checks you're not a bot. Turnstile runs in a frame served by Cloudflare and may set its own cookie on that frame; it's covered by Cloudflare's privacy policy.

The Chrome extension

The extension checks the sites you visit against our list of shops inside your browser. The addresses of the pages you visit never leave your browser.

When the popup or the in-page panel needs a shop's codes, it asks our server for them without your account (at most every 10 minutes per shop). That tells us someone is looking at that shop, not who. At checkout it reads only the order total, on your device, to see whether a code worked. It never reads cart contents, products, addresses or payment details.

With Share anonymous results on (the default; switch it off in the extension's settings), copies, “Did it work?” votes and auto-apply results (amounts, which codes, outcomes) are sent without your account, so we can't link them to you. So is a checkout where the extension found the promo field but couldn't read the total, at most once per shop per browser session, so we can fix it. A random install ID is sent only with auto-apply results and is hashed on our server. Besides that, we see only the salted IP hash we use against abuse.

Signed in on aonepromos.com? The extension reads this site's session cookie (__Host-a1_session, and no other site's cookies) and sends it only to aonepromos.com, for three things: showing who's signed in, signing out and submitting codes. It never stores the cookie, and keeps your name, email and profile picture link only in the browser's session storage.

The extension has no analytics and makes no third-party requests: the popup shows your initial instead of loading your Google profile picture. We never sell data collected by the extension, and we don't use it for anything other than finding and applying promo codes.

Affiliate links

Some shop links are affiliate links, and we may earn a commission when you buy through one. The shop or its affiliate network may tell us that a purchase was made through our link so that we can be paid; we don't receive your name, address or payment details from them. The extension uses an affiliate link only after you click Copy, Activate deal or Try codes, and never replaces another site's referral.

Who we share data with

We don't sell your data and we don't share it with advertisers. The only companies that handle it are the ones that run the site for us: Cloudflare (hosting, storage and the Turnstile bot check) and Google (sign-in). We would disclose data if the law required it, and we would tell you unless we're not allowed to.

Deleting your account

You can delete your account at any time under Account › Danger zone on your account page. That removes your profile and every sign-in session, which signs you out everywhere, the extension included. Codes you submitted that are already published stay live without your name; the salted IP hashes on past events stay, since they can't identify you. Signing in again later with the same Google account creates a new, empty account.

If you'd rather we did it for you, or you want a copy of what we hold about you, email us at the address below from the email address on your account.

Children

The site and the extension aren't aimed at children under 13, and we don't knowingly collect data about them. If you think a child has created an account, tell us and we'll delete it.

Changes to this policy

If we change what we collect or why, we'll update this page and the effective date at the top. Changes that matter will also be mentioned on the site before they take effect.

Contact

Questions about privacy go to info@aonepromos.com or through the contact form. A1 Promos is the operator of aonepromos.com and the extension, and is responsible for the data described here.