Privacy.

Nothing, for most visits. You can run a full check-up, build a stack from scratch, and browse offers without an account. Your answers live in your own browser’s session storage until you close the tab, unless you sign in and save them.

With an account: your email address (used for sign-in links and nothing else unless you opt in), and any check-ups you choose to save.

When you help us: feedback you submit — a thumbs verdict, an optional comment, and the run it judged so we can replay the exact numbers you saw. Feedback works without an account and is stored without one.

Operational signals: when you click an outbound link, say whether an offer worked, or report that a perk changed, we record the event with a salted hash of your IP address and browser — enough to count honestly and stop abuse, not enough to identify you. The raw values are never stored. To ask whether an offer worked on your next visit, your browser remembers which offers you opened; that list stays on your device.

We do not sell or share your personal information, for money or otherwise. Our only always-on analytics is cookieless page-view counting (Vercel Web Analytics): no cookies, no fingerprinting, no personal identifiers, no cross-site tracking — we learn that a page was visited, not who you are. One advertising script exists — Google’s ads tag, which measures whether our own ads led you here — and it loads only if you chose “allow future extras” in the cookie banner; choose “essential only” and it never runs. Sign-in tokens are stored only as SHA-256 hashes. And by architecture, not policy: the code that builds your recommendation cannot read our affiliate or payout data — a test in the build fails if anyone ever wires those together.

By default we set only strictly necessary, first-party cookies: a session cookie when you sign in, and a record of your cookie choice itself. No advertising or analytics cookie is set unless you allow it.

Google’s advertising tag does load on every page, in a consent-denied state (Google Consent Mode). Until you choose “allow future extras” it may not store anything on your device, may not receive any advertising identifier, and may not personalise advertising to you; what it sends is an anonymous, cookieless signal that Google uses only for aggregate estimates. If you do allow extras, it sets its own cookies and measures conversions from our ads in the ordinary way. The banner is the switch either way, and you can change your choice here.

When we link to a streaming provider, the link may earn us a commission. Where applicable, every such link is clearly labeled at the link. Commissions have no input into what we recommend; rankings are computed before any affiliate decoration is applied, and the recommendation engine is firewalled from revenue data entirely.

goldi is built for adults. We do not knowingly collect or maintain personal information from individuals under the age of 16. If we discover that a child under 16 has provided us with an email address or personal data, we will delete it from our systems immediately.

Wherever you live, you can ask us to show you what we hold about you, correct it, export it, or delete it — deleting your account removes your saved runs and disconnects your email. We answer every request the same way regardless of jurisdiction.

California — Do Not Sell or Share: we do not sell or share personal information as the CCPA/CPRA defines those terms, so there is nothing to opt out of. This paragraph is the notice.

EU/UK: the lawful bases we rely on are contract (running the service you asked for) and legitimate interest (abuse prevention, the hashed operational signals above). Nothing is profiled for advertising.

To exercise any of these rights, email privacy@goldi.stream — it goes to a human, not a queue.

Saved check-ups live until you delete them or your account. Feedback rows live until the issue they describe is resolved and regression-tested. Click and vote hashes age out with the operational logs. Nothing is kept for the sake of keeping it.