Privacy Policy
Last updated:
This policy explains what personal data DealsAndBobs collects, why, how long we keep it, and your rights. We have kept it short and plain on purpose. If anything is unclear, email .
In short
- We only collect what we need to run your account and the community.
- We don't sell your data, send marketing emails, or use advertising cookies.
- We use one essential cookie to keep you logged in. Analytics cookies (Google Analytics) are used only if you accept them.
- You can delete your account – and the content you posted – yourself, at any time.
1. Who is responsible for your data
The "controller" of your personal data is , registered in (company number ), registered office: . We are registered with the Information Commissioner's Office (ICO), the UK data protection regulator, under registration number . For anything about your data, contact us at .
2. What we collect and why
| Data | Why we use it | Lawful basis (UK GDPR) |
|---|---|---|
| Account details: username, email address, password (stored only as a secure, one-way hash), date you joined and accepted our terms, and the cartoon avatar you pick from our set (shown publicly next to your posts; you can't upload your own photo) | To create your account, log you in, and contact you about your account or legal matters | Contract – needed to provide the service you signed up for |
| If you continue with Google, Microsoft or Facebook: your account ID with that service, your email address and first name. We don't get your password, contacts, friends list or anything else, and we never post anything on your behalf. | To create your account and log you in with that service. We suggest a username from your first name – you can change it before signing up. | Contract |
| What you post: deals, comments, edits, and when you posted them | To publish them on the site. Your username and posts are public. | Contract |
| Votes (hot / not) | To calculate a deal's temperature and make sure each member votes only once. Other members cannot see how you voted. | Contract |
| Deal alerts: your email address, when you signed up and confirmed, where on the site you signed up, and whether you unsubscribed. You don't need an account for this. | To send you our daily email with the best deals, once a day, after you confirm your address by clicking the link we send you. Every email has an unsubscribe link. | Consent – you can withdraw it at any time by unsubscribing |
| Deal notifications (only if you turn them on): the technical address your browser gives us for notifications and its encryption keys, when you turned them on and when we last sent one. It is not linked to your email or account. | To send you one notification a day with the top deal, after you allow notifications in your browser. | Consent – you can withdraw it at any time on the Get the app page or in your browser or phone settings |
| Saved deals | To keep the list of deals you chose to save for later. Only you can see it. | Contract |
| Reports and moderation records: reports you send, reports about your content, moderator decisions and notes, account suspensions | To keep the community safe, deal with illegal content, handle complaints and appeals, and show we meet our legal duties | Legal obligation (Online Safety Act 2023) and legitimate interests (a safe, spam-free community) |
| Login session: a random session token in a cookie; we store only a scrambled (hashed) copy | To keep you logged in securely | Contract |
| Technical data: IP address, browser type, and the pages requested | Processed by our hosting provider to deliver the site, protect it from attacks, and help us fix errors. We do not store IP addresses in our own database, except in scrambled form for security (see the next row). | Legitimate interests (security and keeping the site working) |
| Security records: when you log in, sign up, change your password or ask for a password reset, we record a scrambled (hashed) version of the email address used and of your IP address, and the time | To limit repeated attempts, so nobody can guess passwords or flood the site with fake accounts. Deleted automatically after 24 hours. | Legitimate interests (keeping accounts secure) |
| Account emails: your email address and the emails we send you (for example the link to confirm your email address when you sign up, password reset links and "your password was changed" alerts) | To let you recover your account and warn you about important changes to it. We do not send marketing emails. | Contract |
| Messages you send us by email | To reply, handle reports, complaints and data protection requests | Legitimate interests, or legal obligation where the law requires us to respond |
Where we rely on legitimate interests, those interests are running a safe, reliable community site. You can object – see Your rights. Giving us an email address and password is required to create an account; everything else you post is up to you. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The only automatic rules are simple limits (for example, how many deals an account can post per day) to stop spam.
3. Who we share it with
- Cloudflare, Inc. – hosts the website and database and protects it from attacks. Cloudflare processes data only on our instructions. Our database is stored in Western Europe.
- Google, Microsoft and Meta (Facebook) – only if you choose “Continue with Google”, “Continue with Microsoft” or “Continue with Facebook”. The service confirms who you are and tells us your account ID, email address and first name. Their own privacy policies apply to those accounts: Google, Microsoft, Meta.
- Google (Google Analytics) – only if you accept analytics cookies. Google Analytics tells us how the site is used (for example which pages and deals are viewed, how people found us, and roughly which country and type of device they use). It sets cookies in your browser and receives technical data such as your browser, device and pages visited. Google Analytics doesn't store IP addresses, we don't use it for advertising, and we don't link it to your DealsAndBobs account. Google acts as our processor under its data processing terms. Data is kept for 14 months.
- Resend – our email delivery service. It sends account emails (such as password reset links) and, if you sign up for them, our deal alert emails on our behalf, so it receives your email address and the content of those emails. For deal alerts it also keeps a list of subscribers and a record of who unsubscribed, so nobody is emailed after unsubscribing. It processes data only on our instructions.
- Your browser's notification service (Google for Chrome and Android, Apple for Safari and iPhone, Mozilla for Firefox, Microsoft for Edge) – only if you turn on deal notifications. It delivers our notifications to your device. The content of each notification is encrypted so only your device can read it.
- Professional advisers (such as lawyers or accountants), where needed.
- Police, regulators or courts – only where the law requires it, or to protect people from harm.
We do not sell your data or share it with advertisers. When you click a link to a retailer (including an affiliate link), you leave our site: the retailer and any affiliate network may set their own cookies under their own privacy policies. We do not send them your account details.
When you press Get deal, we count the click so we know which deals people use. We record only the deal and the time, not who clicked or your IP address, and we delete these counts after 2 years.
Deal images are shown directly from the retailer's own website (for example Amazon or Argos). To display them, your browser connects to that retailer, which – as with any image on the web – receives your IP address and browser type. We only allow images from a list of known retailers.
4. International transfers
Cloudflare runs a global network, so some technical data (like your IP address) may be processed outside the UK, including in the United States. Resend, our email delivery service, and Google (for Google Analytics, only if you accept analytics cookies) are also based in the United States. Where this happens, it is protected by UK-approved safeguards such as the UK–US data bridge or the UK International Data Transfer Addendum to standard contractual clauses.
5. How long we keep it
- Your account: until you delete it. When you delete your account, we immediately remove your email address and password, replace your username with an anonymous one, and hide everything you posted.
- Deleted or removed deals and comments: hidden from the site straight away. We keep the hidden text for up to 12 months (so we can handle complaints, appeals and legal requests) and then erase it automatically.
- Content we must report to the authorities: if we report content to the National Crime Agency (for example child sexual abuse material) or the police ask us to preserve it, we keep a copy of that content and the related account details (username, email address, sign-up date) for at least 1 year, and the report reference number for 5 years, as UK law requires. This applies even if the content is removed or the account is deleted.
- Deals: expired deals stay on the site (marked “Expired”) so the discussion remains available, unless they are deleted.
- Reports and moderation records: up to 2 years, then deleted automatically.
- Login sessions: 30 days, or until you log out.
- Password reset links: work once and expire after 1 hour; deleted within 24 hours.
- Email confirmation links: work once and expire after 3 days; deleted within 24 hours after they expire.
- Unfinished social sign-ups (you continued with Google, Microsoft or Facebook but didn't finish creating an account): deleted within 1 hour.
- Security records (scrambled email and IP address): 24 hours.
- Saved deals: until you remove them or delete your account.
- Deal alerts: while you are subscribed. If you don't confirm your address, we delete it after 7 days. After you unsubscribe, we delete your details from our database within 30 days; Resend keeps a record that you unsubscribed so you are never emailed by mistake. Deleting your account does not unsubscribe you – use the link in any deal alert email.
- Deal notifications: while they are turned on. When you turn them off (or your browser tells us the device no longer accepts them) we delete your details straight away; if our notifications keep failing to reach a device, we delete its details after 10 failed attempts.
- Votes: kept without any link to you after you delete your account, so deal temperatures stay accurate.
- Technical logs held by Cloudflare: a short period, usually a few days.
- Emails you send us: up to 2 years after the matter is closed.
6. Cookies
We only use cookies that are strictly necessary for the site to work, so we don't need to ask for consent:
| Name | Purpose | Lasts |
|---|---|---|
| dab_session | Keeps you logged in. Only set when you log in or sign up. | 30 days, or until you log out |
| dab_oauth | Only when you press “Continue with Google”, “Microsoft” or “Facebook”: a random security code that makes sure the sign-in you come back with is the one you started. | 10 minutes |
| dab_signup | Only the first time you continue with Google, Microsoft or Facebook: remembers your sign-in while you choose a username. | 1 hour |
We also keep a few small settings in your browser's storage (not cookies, and never sent to us). They stay until you clear your browser data:
- dab_welcome_closed remembers that you closed the welcome message on the home page, so we don't show it again.
- dab_alerts_signed remembers that you signed up for deal alerts, so we stop inviting you.
- dab_alerts_nudge remembers that you closed the deal alerts invitation, so we don't show it again for 7 days.
- dab_deal_views counts how many deals you opened during this visit (deleted when you close the browser), so the deal alerts invitation appears only after you've looked at a couple of deals.
- dab_install_nudge and dab_push_nudge remember that you closed the invitation to add DealsAndBobs to your home screen or to turn on notifications, so we don't show it again for 30 days.
Analytics cookies – only with your consent. If you click “Accept analytics” in the cookie message, we use Google Analytics to understand how the site is used. If you click “Reject”, or make no choice, Google Analytics is not loaded at all. You can change your choice at any time with the Cookie settings link at the bottom of every page.
| Name | Purpose | Lasts |
|---|---|---|
| _ga | Google Analytics: a random ID that tells visits from the same browser apart. | 13 months |
| _ga_9S4SVR8SBV | Google Analytics: keeps track of the current visit. | 13 months |
Your cookie choice itself is saved in your browser's storage as dab_analytics_consent for 12 months, so we don't ask on every page. We don't use advertising or social media tracking cookies.
We also use Cloudflare Web Analytics, which counts page visits without cookies and without identifying you.
7. Your rights
Under UK data protection law, you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data erased – you can do this yourself by deleting your account in My account;
- restrict or object to how we use your data (in particular where we rely on legitimate interests);
- data portability – receive the data you gave us in a common, machine-readable format.
To use any of these rights, email from the address linked to your account. We will reply within one month (this can be extended in complex cases – we'll tell you if so). It's free.
Deleting data from Google, Microsoft or Facebook login
If you logged in with Google, Microsoft or Facebook and want us to delete that data:
- Log in and open My account.
- At the bottom, under Delete my account, type your username and press Permanently delete my account. This erases your email address and the link to your Google, Microsoft or Facebook account straight away.
- You can also remove DealsAndBobs from the apps connected to that account (for Facebook: Settings & privacy → Settings → Apps and websites).
Can't log in any more? Email from the same email address and we'll delete it for you within one month.
8. Complaints
If you're unhappy with how we use your personal data, please complain to us first at with the subject "Data protection complaint". We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.
You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, helpline 0303 123 1113.
9. Children
DealsAndBobs is not for children. You must be at least to create an account. If you believe a child has created an account, tell us and we will delete it.
10. Security
Passwords are stored as strong, salted one-way hashes, so nobody – including us – can read them. The site only works over an encrypted connection (HTTPS), and the login cookie can't be read by scripts on the page. After several wrong passwords, logging in to that account is paused for a short time, and we email you whenever your password is changed. No system is perfectly secure, but if we ever had a data breach that put you at risk, we would tell you and the ICO as the law requires.
11. Changes to this policy
We will update this policy if the way we use data changes – for example, if we start sending emails or use analytics. The date at the top shows the latest version, and we will tell members on the site about important changes.