Privacy policy

Analytics: cookieless and aggregate

We measure traffic with Plausible, a cookieless analytics tool. It counts pageviews, referrers, and a small set of aggregate events (for example that an affiliate link was clicked, or that a newsletter form was submitted) so we can tell which pages are useful. The event data carries page paths and operator slugs, never a name, an email address, or an account of yours. There is no cross-site tracking and no advertising profile, which is why you see no cookie banner. Plausible's own practices are in its data policy.

We can also enable Cloudflare Web Analytics, which works the same way: cookieless, aggregate, no personal profiles.

When you click a Visit link

Monetized links route through /go/, and that redirect checks which US state you are connecting from (using Cloudflare's network-level geolocation) so we can send you to the legality guide instead of an operator your state has restricted. Each redirect decision is logged for 90 days: the operator slug, your country and state code, the decision made, and a one-way fingerprint built by hashing your browser's user agent and IP address together. The raw IP address and user agent are never stored. The fingerprint is pseudonymous, not anonymous: it cannot be turned back into your IP address, but it is derived from your request, so we count it as personal-adjacent data and hold it for 90 days only. We use that log to audit the state gate and to spot click fraud, nothing else.

If you subscribe to the newsletter

Signing up stores your email address and the context around it. It lands in our own database alongside which form you used (footer, sticky bar, or exit prompt), an optional operator slug if you signed up from an operator page, and the signup time. No name, no payment details, no third-party list service. There is no fixed expiry on a subscriber record: it stays until you ask us to delete it, which we do on request.

To stop abuse, the signup endpoint keeps a salted one-way hash of the submitting IP address and allows one signup per minute per address. The raw IP is never stored. The list is write-only from the browser: the form can add an address but nothing on the public site can read the list back, so it cannot be scraped through us.

We never sell or share the list, and every email we send includes an unsubscribe link. You can also ask us to delete your address outright at the contact address below.

If you report an experience

The report form (and the smaller form on each operator page) stores exactly what you type: the operator, what happened, the amount and date if you give them, and your email address if you choose to leave one. Your email is used only to follow up on your report and is never published. A screenshot, if you attach one, goes into a private storage bucket that has no public access; a human reviews it through a short-lived signed link, and it is never posted without your consent.

Report submissions use the same anti-abuse pattern as the newsletter: a salted one-way hash of your IP for rate limiting, with the raw address never stored. Every report is read by a person before anything derived from it appears on the site, and no report changes a Trust Score, which comes from the published methodology only.

Where the data lives

The site is served by Cloudflare, which processes standard request data (IP address, user agent) to deliver pages and block attacks, the way any host or CDN does. Our database, including the newsletter list and submitted reports, runs on Supabase. Those two providers plus Plausible are the complete list of services that touch visitor data on our behalf.

What stays on your device

A few convenience flags are kept in your browser's local storage, for example that you dismissed the newsletter bar or a promo notice so we do not show it again. These flags never leave your device and we cannot read them from our side.

The state you choose is one of those flags. Pick a state on the home page, on the leaderboard, on an operator page, or on the shortlist, and we keep the two-letter code in local storage under the key bb-state, so the next page you open does not ask you again. It is the code and nothing else: no address, no coordinates, no record of what you looked at, and nothing that leaves your browser. It stays until you change it. To clear it, set the same menu back to the national option, or use the button that continues without a state on the shortlist, or clear this site's data in your browser.

If you use the save button beside an operator, we keep that operator's short name in local storage under the key bb-saved-operators, together with the state you had chosen and the day you saved it. It is a list you build for yourself and it stays in your browser. It is never sent to us, there is no account behind it, we cannot see it, and it does not follow you to another device or another browser. The list holds a limited number of operators and drops the oldest entry once it is full. It stays until you clear it. To see what is on it, or to remove one entry or all of them at once, open the shortlist panel at the top of the leaderboard. You can also unsave an operator with the same button you saved it with, or clear this site's data in your browser.

The home page also has a button that offers to detect your state. It is the one place on this site that asks your browser for your location, it runs only when you click it, and your browser asks your permission before anything happens. If you allow it, your browser hands the page a coarse position, the page matches it to the nearest state and then discards it. The position is never sent to us and we never see it. Declining costs you nothing, because the menu beside the button does the same job. This is a different mechanism from the network-level check described under when you click a Visit link, which reads the state your connection appears to come from and never touches your browser's location.

Our Reddit app

Bonus Bandit Dailies, our app on Reddit, posts a daily bonus roundup to r/BonusBandit. It reads a public feed from this site and posts; it does not collect, store, or process any personal data from Reddit users. Your use of Reddit itself is governed by Reddit's privacy policy.

What we never do

No cookies set by us, advertising or otherwise. No third-party display-ad networks. No selling, renting, or trading personal information. No data brokers. No tracking you across other sites. This site is for adults (21+) and is not directed at children; we do not knowingly collect data from anyone under 21.

One clarification, since promotional placements on this site carry an Ad label: we do run affiliate links. They are our own links to operators, not a display-ad network, and they load no third-party ad script or ad cookie onto this site. How the money works is on the affiliate disclosure page; the Trust Scores are computed mechanically and are not affiliate-weighted.

Your choices and contact

Unsubscribe from any email with the link in its footer, or email us to have your address or a submitted report deleted. Questions about anything on this page go to noah.rafkin@bonusbandit.win. I read and answer these myself.

If a data practice changes, this page changes with it and the effective date above is updated. Material changes get a note in the public changelog.