Privacy policy

Analytics: cookieless, first-party, pseudonymous

We count traffic with our own cookieless counter, which runs on the same Cloudflare servers that deliver these pages. Each page you open sends one short note: the page address without its query string, the name of the site that linked you here (never the page you came from), and any campaign tag in the link, such as utm_source. It also records a small set of events, for example that an affiliate link was clicked or a newsletter form was submitted, with details like the operator slug and which part of the page it happened on. If a US state is set, from the menu, the location button on the home page, or a link that carries one, its two-letter code can travel with those events so we can see which states readers ask about. The notes themselves carry no name, email address or account. One caveat: a newsletter signup or a submitted report is counted at the same moment your address or report is stored, so the two records could be matched by time. There is no cross-site tracking and no advertising profile, which is why you see no cookie banner.

To count how many different people visit without a cookie, the server turns your IP address and browser user agent into a short one-way code, using a key that changes every day. The IP address itself is never written down. Because the key changes daily, the same person on two different days counts as two visitors, and the code alone does not link your visits on different days. Other records can: a click on a Visit link is also logged by the /go/ redirect with its own hash, which does not change from day to day, and the two records of that click could be matched by time. The daily key is derived from a random secret generated on our own machine and stored only as an encrypted setting in our Cloudflare account. It is not deleted, so we describe the code as pseudonymous, not anonymous. Visit records are kept for about three months; the weekly totals we keep after that contain no codes.

To stop your own browser from being counted, open bonusbandit.win/?bb_skip_count=1 once. That stores one flag in your browser's local storage, so it needs this site's storage to be allowed; where storage is blocked, only the page that link opens goes uncounted. Open bonusbandit.win/?bb_skip_count=0 to undo it. If your browser sends the Global Privacy Control signal, the counter treats that as the same opt-out and sends nothing, with no flag needed.

A second cookieless counter, Ahrefs Web Analytics, runs alongside our own counter as a cross-check on pageviews and traffic sources. It works on aggregate counts, with no cookies and no personal profiles. The opt-out above applies to our own counter only. We can also enable Cloudflare Web Analytics, which works the same way.

When you click a Visit link

Monetized links route through /go/, and that redirect checks which US state you are connecting from (using Cloudflare's network-level geolocation) so we can send you to the legality guide instead of an operator your state has restricted. Each redirect decision is logged for 90 days: the operator slug, your country and state code, the decision made, and a one-way fingerprint built by hashing your browser's user agent and IP address together. When the click is given a click id, so that a signup at the operator can be credited to us, a separate click record keeps the time, the operator slug, your state code, where on our site the link sat, and the same fingerprint for up to 180 days. The raw IP address and user agent are never stored. The fingerprint is pseudonymous, not anonymous: it uses no secret key, so anyone who already knows your IP address and browser could compute it again and match it, and it is derived from your request, so we count it as personal-adjacent data. We use these records to audit the state gate, to credit conversions, and to spot click fraud, nothing else.

If you subscribe to the newsletter

Signing up stores your email address and the context around it. It lands in our own database alongside which form you used (footer, sticky bar, or exit prompt), an optional operator slug if you signed up from an operator page, and the signup time. No name and no payment details. A copy of the address goes to the mailing software that sends the newsletter, described under where the data lives. There is no fixed expiry on a subscriber record: it stays until you ask us to delete it, which we do on request.

To stop abuse, the signup endpoint keeps a salted one-way hash of the submitting IP address and allows one signup per minute per address. The raw IP is never stored. The list is write-only from the browser: the form can add an address but nothing on the public site can read the list back, so it cannot be scraped through us.

We never sell or share the list, and every email we send includes an unsubscribe link. You can also ask us to delete your address outright at the contact address below.

If you report an experience

The report form (and the smaller form on each operator page) stores exactly what you type: the operator, what happened, the amount and date if you give them, and your email address if you choose to leave one. Your email is used only to follow up on your report and is never published. A screenshot, if you attach one, goes into a private storage bucket that has no public access; a human reviews it through a short-lived signed link, and it is never posted without your consent.

Report submissions use the same anti-abuse pattern as the newsletter: a salted one-way hash of your IP for rate limiting, with the raw address never stored. Every report is read by a person before anything derived from it appears on the site, and no report changes a Trust Score, which comes from the published methodology only.

Where the data lives

The site is served by Cloudflare, which processes standard request data (IP address, user agent) to deliver pages and block attacks, the way any host or CDN does. Our database, including the newsletter list and submitted reports, runs on Supabase. The newsletter is sent from our own install of the open-source Listmonk mailing software, hosted on Railway, and delivered by Mailgun; both see a subscriber's email address only to send it. Our own visit counter runs on Cloudflare, so it adds no provider. Those four providers plus Ahrefs Web Analytics are the complete list of services that touch visitor data on our behalf.

One more request leaves each page: the footer shows the Gambling Portal Webmasters Association Approved Portal seal, and the seal image and its verification script load from gpwa.org. Their server sees the same standard request data any image host does (IP address, user agent) and nothing else from us; we hold the seal to show the site passed their membership review, not to track you.

What stays on your device

A few convenience flags are kept in your browser's local storage, for example that you dismissed the newsletter bar or a promo notice so we do not show it again. These flags never leave your device and we cannot read them from our side. The analytics opt-out flag described above is one of these.

The state you choose is one of those flags. Pick a state on the home page, on the leaderboard, on an operator page, or on the shortlist, and we keep the two-letter code in local storage under the key bb-state, so the next page you open does not ask you again. It is the code and nothing else: no address, no coordinates, and no record of what you looked at. The stored code stays in your browser; when a state is set, from the menu, the location button, or a link that carries one, the code is also counted with the events described under Analytics, with nothing that identifies you. Your coordinates never leave the browser. It stays until you change it. To clear it, set the same menu back to the national option, or use the button that continues without a state on the shortlist, or clear this site's data in your browser.

If you use the save button beside an operator, we keep that operator's short name in local storage under the key bb-saved-operators, together with the state you had chosen and the day you saved it. It is a list you build for yourself and it stays in your browser. It is never sent to us, there is no account behind it, we cannot see it, and it does not follow you to another device or another browser. The list holds a limited number of operators and drops the oldest entry once it is full. It stays until you clear it. To see what is on it, or to remove one entry or all of them at once, open the shortlist panel at the top of the leaderboard. You can also unsave an operator with the same button you saved it with, or clear this site's data in your browser.

The home page also has a button that offers to detect your state. It is the one place on this site that asks your browser for your location, it runs only when you click it, and your browser asks your permission before anything happens. If you allow it, your browser hands the page a coarse position, the page matches it to the nearest state and then discards it. The position is never sent to us and we never see it. Declining costs you nothing, because the menu beside the button does the same job. This is a different mechanism from the network-level check described under when you click a Visit link, which reads the state your connection appears to come from and never touches your browser's location.

Our Reddit app

Bonus Bandit Dailies, our app on Reddit, posts a daily bonus roundup to r/BonusBandit. It reads a public feed from this site and posts; it does not collect, store, or process any personal data from Reddit users. Your use of Reddit itself is governed by Reddit's privacy policy.

What we never do

No cookies set by us, advertising or otherwise. No third-party display-ad networks. No selling, renting, or trading personal information. No data brokers. No tracking you across other sites. This site is for adults (21+) and is not directed at children; we do not knowingly collect data from anyone under 21.

One clarification, since promotional placements on this site carry an Ad label: we do run affiliate links. They are our own links to operators, not a display-ad network, and they load no third-party ad script or ad cookie onto this site. How the money works is on the affiliate disclosure page; the Trust Scores are computed mechanically and are not affiliate-weighted.

Your choices and contact

Unsubscribe from any email with the link in its footer, or email us to have your address or a submitted report deleted. Questions about anything on this page go to noah.rafkin@bonusbandit.win. I read and answer these myself.

If a data practice changes, this page changes with it and the effective date above is updated. Material changes get a note in the public changelog.