Privacy Policy

Last updated: 31 October 2026

DealHunters ("we") respects your privacy and processes personal information in line with the Protection of Personal Information Act, 2013 (POPIA).

What we collect

• Account details: your email address and a one-way hash of your password (we never store your password itself).
• Saved deals: the products you save and the price when you saved them.
• Alerts: if you turn on browser alerts, your alert settings and the push address your browser gives us (it doesn't identify you outside DealHunters). Turn alerts off at any time on the Alerts page.
• Shared list: only if you choose to share your saved list, a random link that you can switch off at any time.
• Security data: sign-in session records (time, IP address, browser type) and hashed rate-limit counters, used to protect accounts against abuse.

Browsing deals doesn't require an account. We don't sell your information or use advertising trackers.

Why we use it

To run your account, show your saved deals, send essential emails (email confirmation, password reset), and keep the service secure. The lawful basis is performing our service for you and our legitimate interest in security.

Password checks

When you choose a password we check whether it appears in known breaches using the Have I Been Pwned "range" service. Only the first 5 characters of a hash of the password leave our server; your password and email are never sent.

Cookies

• pr_session: keeps you signed in (essential, httpOnly, expires after 30 days or when you sign out).
• pr_kd: remembers that this device has signed in before, so a stranger's failed attempts can't lock you out (essential).
• theme: remembers light/dark mode.

We don't use analytics or advertising cookies.

Who we share it with

Operators that host and run the service for us: Railway (hosting and database), Resend (transactional email) and, if you turn on alerts, your browser's own push service (for example Google, Mozilla or Apple) to deliver them. They process data only on our instructions. Some of these operators are outside South Africa; we rely on their contractual data-protection commitments.

How long we keep it

Account data is kept until you delete your account. Session records expire and are purged; unconfirmed accounts may be removed after 30 days.

Your rights

You can access and correct your information, delete your account at any time from the Account page, object to processing, and complain to the Information Regulator (inforegulator.org.za). For any privacy request, contact us at the contact address shown on this page once published.

Security

Passwords are hashed with bcrypt; all traffic is encrypted (HTTPS); sessions can be revoked; and sign-ins are rate-limited.