Privacy policy (Datenschutzerklärung)

The controller responsible for processing personal data on RefCodes is:

Email: info@refcodes.de

For any privacy question or to exercise your rights, email us at the address above. Further details are in the legal notice.

RefCodes is a platform for discovering and sharing referral codes. You can browse without an account. If you sign up, we process the data needed to run your account and the content you choose to share. We don't sell personal data, don't show third-party advertising and don't use analytics, statistics or marketing cookies.

Providing personal data is not required by law or contract. Without an email address and password, however, you can't create an account, add codes or take part in verification.

The website and application server are hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. When you open a page, your browser sends technical information that is processed automatically in server logs: IP address, date and time, requested URL, referrer URL, browser type and version, operating system and the HTTP status code.

We need this to deliver the website, keep it stable and secure, and detect and defend against attacks and abuse. The legal basis is our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR). Logs are kept only for a short period according to the provider's retention settings and are not combined with other data sources. Details: Netlify, Inc. privacy policy.

To limit abusive request rates, the application server counts requests per client in one-minute windows. It stores only a salted, one-way hash of your IP address with each count — never the IP address itself — and deletes these counters after a few minutes.

Sign-in and the RefCodes database are provided by Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. Your data is stored in the Supabase region EU West (Paris).

• Authentication: your email address and your password, which Supabase stores only as a cryptographic hash — RefCodes never sees your password. Supabase also records technical sign-in data such as sign-in times and session tokens and sends the confirmation and sign-in emails you request.
• Database: all RefCodes data described in the next section is stored in a Supabase-hosted PostgreSQL database.

The legal basis is the performance of our contract with you, i.e. providing your account (Art. 6(1)(b) GDPR), and our legitimate interest in securing sign-in (Art. 6(1)(f) GDPR). Details: Supabase privacy policy.

When you use the contact form in the legal notice, we process the subject, your email address and your message to answer you. They are not stored in the RefCodes database: the server forwards them once as an email to our mailbox, and we reply from there. Rate limiting uses a salted hash of your IP address, never the address itself.

A short notification that a new message has arrived is also sent to the operator's Telegram account. It contains no subject, message or sender details.

The legal basis is our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR), or steps prior to a contract you request (Art. 6(1)(b) GDPR). Messages are deleted from our mailbox once your inquiry is resolved, unless statutory retention obligations apply.

Profiles, referral codes and influencer-code submissions are public by design — sharing them is the purpose of RefCodes. Everything else below is visible only to you and, where needed for moderation, to RefCodes administrators.

Profile

Username, display name, bio, avatar URL, role and the date you joined. Previous usernames are kept so links to your old profile URL keep working and nobody else can take them over.

Referral codes

Brand, code, referral link, description, category, status, creation and update dates, and click and copy counters.

Votes and verifications

Whether a referral code worked for you or had a problem (with an optional note), and your verifications of influencer codes. One vote per member and code.

Copy history

When you're signed in and copy a code or open its link, we record which code and when, so we can ask you later whether it worked.

Copy and click events

To count copies and clicks without double-counting, we store the code, the event type, the time and a salted SHA-256 hash of the requesting IP address. The hash is only compared with recent events from the same address and is deleted after 24 hours; the event itself (code, type, time) stays for your activity overview. RefCodes doesn't store the raw IP address.

Influencer code submissions

The influencer, brand, code or link, offer, description and terms, the source where it was published, and who submitted it.

Follows

Which members you follow.

Coins ledger

Every coin you earn or spend as a permanent transaction record (type, amount, description, date), so balances stay auditable.

Boosts

Which code you boosted, when the boost started and ended, and the coin transaction that paid for it. Expired boosts remain on record.

Reports

Content you reported, the reason and any details you added, and how moderators resolved the report.

Notifications

Messages about activity on your account (for example new followers, verified submissions, coin adjustments or moderation decisions) and whether you've read them.

Moderation data

Account bans (date and reason), reasons for removing content, and an audit log recording which administrator took which action on which item and when.

We don't use automated decision-making within the meaning of Art. 22 GDPR. Codes that collect several problem reports from different members are removed automatically; this doesn't have legal or similarly significant effects on you, and you can contact us if you think it happened in error.

• Art. 6(1)(b) GDPR — contract: running your account and the features you use (profile, codes, votes, submissions, follows, coins, boosts, notifications).
• Art. 6(1)(f) GDPR — legitimate interests: security, abuse prevention and rate limiting, accurate copy and click counts, server logs, moderation of reports and documenting admin actions. You can object to this processing at any time (see your rights).
• Art. 6(1)(a) GDPR — consent: optional cookies or similar technologies. RefCodes currently uses none; if that changes, they will only be used after you opt in.

Storing information on your device that is strictly necessary for a service you request (such as the sign-in cookie) doesn't require consent under § 25(2) No. 2 TDDDG.

We use the following service providers as processors under data processing agreements (Art. 28 GDPR):

• Netlify, Inc. — hosting and delivery of the website (data processing agreement)
• Supabase Pte. Ltd. — authentication and database hosting, including sending sign-in and confirmation emails (data processing agreement)

Public content is visible to every visitor. We disclose data to authorities only where we are legally required to. We don't sell or rent personal data.

Our providers are based in the United States or have group companies and support staff outside the European Economic Area, so personal data may be processed in third countries. Where a provider is certified under the EU-U.S. Data Privacy Framework, transfers rely on the European Commission's adequacy decision (Art. 45 GDPR). Otherwise they are based on the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR) included in the providers' data processing agreements. You can request a copy of these safeguards from us.

• Account and profile data: until you delete your account or ask us to delete it.
• Codes, submissions, votes and follows: until you delete them or your account.
• Coin transactions and boosts: for as long as your account exists, as an unchangeable record of your balance.
• Hashed IP addresses of copy and click events: 24 hours. The events without them stay with the referral code.
• Reports, bans and the admin audit log: as long as needed to handle the report, prevent repeated abuse and document moderation decisions.
• Contact form messages: in our mailbox until your inquiry is resolved.
• Server logs: for a short period according to the hosting provider's retention settings.
• Cookie choice: 12 months, then we ask again. Language choice: 12 months.

Where statutory retention obligations apply, we keep the affected data until they expire and restrict its processing in the meantime.

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 21),
• withdraw consent at any time with effect for the future (Art. 7(3)),
• lodge a complaint with a data protection supervisory authority (Art. 77), in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement.

To exercise your rights, email info@refcodes.de. In the dashboard you can edit your profile, delete your codes, download all data we store about you and delete your account yourself (Settings). Deleting your account deletes your codes, follows, notifications and copy history and removes your name from your profile; votes and influencer codes you contributed stay without your name, and coin transactions stay as an anonymous record.

RefCodes only uses cookies that are necessary for the site to work. There are no analytics, statistics, advertising or third-party cookies, and fonts are served from our own domain. These are all the cookies we use:

• Sign-in session

  Keeps you signed in. Set by our authentication provider (Supabase) when you sign in.

  Necessary · Until you sign out; sessions expire if they aren't refreshed.

• Sign-in security check

  Links a sign-in or confirmation email to the browser that requested it, so nobody else can use the link.

  Necessary · Until the link is used.

• Language

  Remembers the language you chose (English or German) when it differs from your browser's language.

  Necessary · 12 months

• Cookie notice

  Remembers that you've seen the cookie notice, so we don't show it on every visit.

  Necessary · 12 months

You can review this at any time in the Cookie settings. You can also delete cookies in your browser settings; you'll then be signed out and see the cookie notice again.

We update this policy when RefCodes's features or the law change. The current version is always available on this page, with its date at the top.