Privacy Policy
Last updated October 29, 2026
Who we are
Referral Code Share (“we”, “us”) runs this website: the early-access version of a free referral code sharing site, where people post their own refer-a-friend codes and anyone can copy them. Accounts open when the full site launches.
This policy covers the early-access site — the feed, your private post and request pages, and the emails we send. It explains what we collect, why, who else handles it, and the choices you have. We decide how this data is used, so we’re responsible for it (its “controller”). When the full site opens, its own Privacy Policy replaces this one.
Questions or requests about your data? Write to [email protected].
The short version
- Reading and copying codes needs nothing from you: no account, no email.
- We ask for your email only to post a code, request a program or join the waitlist. It’s never shown on the site, and we never give it to brands or ad platforms.
- A post you publish shows your first name (and last initial, if you add one), your referral code and your reward line to everyone.
- We don’t sell your information, and the site shows no ads and uses no ad trackers.
- You can ask us at any time to see, correct or delete what we hold about you.
What we collect
Only what our forms ask for, plus the technical data every website handles:
- Your email address, when you post a code, request a program or join the waitlist. It’s never shown on the site. We also keep a standard form of it (lowercase, without the dots or +tags some email providers ignore), so one inbox counts as one person. We also check its domain — the part after the @ — because we don’t accept temporary or throwaway email addresses.
- Your code post: the referral code or invite link, the program website you entered and — once you publish — your first name and, if you add one, your last initial (never your whole last name), your reward line, any details you add, an optional expiry date and the countries where the code works. These are shown publicly on your post, with the program it belongs to. All posts from one email show the same name: the one you last published with, which we fill in on your private page when you post another code.
- Your program requests: the website you entered and, once you confirm, that you want the program added — shown only as a count (“12 people asked”), never with your name or email.
- Codes and links we email you: the 6-digit codes and private links that prove you own the inbox. We store the codes only in scrambled (hashed) form, and every link and code expires.
- Reports: the reason you chose and any note you add when you report a post. A copy is emailed to us.
- Copy counts and repeat reports: to count each visitor’s copy of a code only once, and to stop one person reporting a post over and over, we keep a one-way scrambled form of your IP address (a keyed hash) — never the address itself.
- Technical data: like any website, our servers and Cloudflare (which delivers the site) process your IP address, browser and device type, the pages you ask for and when, to deliver pages, apply rate limits against abuse, and keep the site secure.
We don’t ask for passwords, payment details, your phone number, your precise location, or sensitive information such as your health or beliefs. Please don’t put personal details in a post: our check turns away posts that contain phone numbers, email addresses or social media handles.
How we use it, and why
We use your information only for the purposes below. Where data-protection laws such as the GDPR ask for a legal reason (a “lawful basis”), it’s in brackets.
- To do what you asked: email you a private link to finish or edit your post (it works for 72 hours), a link to confirm a program request, or a 6-digit waitlist code (it works for 10 minutes); publish your post; and count your request. (You asked us to — performing our agreement with you.)
- To email you once when accounts open — only if you confirmed your email, by typing back the code or by finishing your post or request. (Your consent, which you can withdraw at any time.)
- To keep the feed fair, safe and free of spam: bot checks, rate limits, one post per program per email, a limit on how often a post can be edited, automated checks of posts, programs and email domains (we don’t accept temporary or throwaway addresses), and reports. (Our legitimate interest in running a trustworthy site.)
- To meet legal duties and protect the site, our visitors and ourselves — for example to answer a valid legal request. (A legal obligation, or our legitimate interest.)
Before a post goes live, an automated check reads its text and confirms its program is real, running and one we list. When you send a form, an automated check also decides whether your email address’s domain is a lasting email service or a temporary one we don’t accept. These checks decide only whether a post, program or email address is accepted — nothing with legal or similarly serious effects on you. If you think it got something wrong, write to [email protected] and a person will look at it.
Emails we send
Only the emails you ask for — your private links, your 6-digit codes, a note when you’re already on the list — and one email when accounts open, if you confirmed your address. No newsletters, and we never let anyone else email you through us. To come off the launch list, write to [email protected].
Services that handle your data
These providers handle data for us, each only as much as its job needs:
- Hosting and email: our hosting and email providers store the data above and deliver our emails on our behalf.
- Cloudflare: delivers the site and protects it from attacks, and Cloudflare Turnstile checks that our forms are used by people, not bots. Cloudflare processes your IP address and browser signals to do that, under its own privacy policy: www.cloudflare.com/privacypolicy/
- AI checks: when you publish a post, the text you wrote (your name, the code or link, the reward line and the details) and the program website are checked by an AI model we use through OpenRouter, to keep out spam and to confirm the program is real and running; when you confirm a program request, only the website is checked; and when you use an email address on a domain we haven’t checked before, only that domain (the part after the @, such as example.com) is checked. OpenRouter passes it to the company that runs the model. Neither ever receives your whole email address.
- Domain registration records: to tell established domains from brand-new ones, we look up the public registration date of a program website’s domain — and of an email domain we haven’t checked before — through rdap.org, sending only the domain.
- Program icons: loaded from Google’s public favicon service — for the programs in the feed, and for a website you type into one of our forms, so you can see it’s the right program. To show them, your browser asks Google for that website’s icon, which shares the website’s address, your IP address and basic browser details with Google. No cookies are set, and nothing else you type — your email, your code — is sent. Google handles that request under its own privacy policy.
When you follow a link off this site — to a brand’s website, or to our pages on social networks — that site’s own privacy policy applies.
What we don’t do
We don’t sell your information. We never upload your email address to Google, Meta, or any other ad platform (no “custom audience” or “Customer Match” lists), and we don’t pass it to the brands in the feed.
We don’t build profiles of you, and we don’t use your information for anything this policy doesn’t describe.
Who can see your information
Everyone can see what a published post shows: your first name (and last initial), your code, reward line and details. Search engines can index it, and other people can copy or share it. Taking a post down removes it from our site, but not copies others have made.
Our providers see only what they need for their job. Beyond that, we share information only when the law requires it, to protect people or the site from fraud or harm, or — if Referral Code Share is ever sold or merged — with the new owner, who would have to keep to this policy.
Where your data is processed
Our providers may store or process data in countries other than yours, including the United States. When data from the EEA, the UK or Switzerland goes to a country without an adequacy decision, we rely on our providers’ safeguards, such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.
How long we keep it
- Published posts: until you ask us to remove them. A post stops showing when its expiry date passes or its program ends; we keep it so you can update it, and so the one-post-per-program rule still holds.
- Unfinished posts and unconfirmed requests: deleted 30 days after their link expires.
- Email addresses: one that was never confirmed and has no post or request is deleted 30 days after it was last given. Confirmed addresses are kept through the launch, then deleted when you ask or once they’re no longer needed.
- Reports and email delivery records: deleted after 30 days. The copy of a report emailed to us is kept as our record of it.
- Copy counts: the scrambled IP that counted your copy of a code is kept with that post and deleted with it.
- Checked email domains: the domains we accept or refuse (never whole addresses) stay on our list while the site runs.
- Security records: rate-limit records are deleted within a day of expiring; server logs are kept only as long as security needs them.
How we protect it
The site is served over HTTPS. Private links are long random keys that work once and expire, 6-digit codes are stored only as keyed hashes, and the IP addresses we keep are one-way keyed hashes, never the addresses themselves. Only we and the providers above can reach the stored data.
No system is perfectly secure, so please don’t forward your private links: anyone with one can edit that post or confirm that request until the link is used or expires.
Your choices and rights
- Change your post: use your private link, or post the same program again with the same email to get a fresh one.
- Take a post down, or come off the launch list: write to [email protected].
- See, correct, get a copy of, or delete what we hold about you: write to [email protected].
Depending on where you live — for example the EEA, the UK, Switzerland, California or another US state — you may also have the right to object to or restrict how we use your data, to withdraw your consent at any time (this doesn’t affect what we did before), and to complain to your local data-protection authority. We won’t treat you differently for using any of these rights.
We answer within 30 days. To protect you, we may ask you to confirm a request from the email address it’s about.
Children
The site isn’t meant for anyone under 16, and we don’t knowingly collect their information. If you believe a child has given us their details, write to [email protected] and we’ll delete them.
Changes
If this policy changes, the date at the top changes with it. If a change matters — a new kind of data, a new provider, or ads — we’ll update this page before it takes effect.
Contact us
Questions, requests or complaints about your privacy? Write to [email protected].