Information we process
Browsing, analytics, and security
The site initializes Google Analytics for Firebase when the browser supports it. Google may process page visits, session and interaction information, browser and device details, approximate location derived from an IP address, and analytics identifiers. The site also uses the Meta Pixel to record page-view events for advertising measurement and audience building. Meta may receive the visited page URL, browser and device information, network information such as an IP address, and cookies or similar identifiers under its own configurations and policies.
Firebase App Check uses reCAPTCHA Enterprise to help distinguish legitimate requests from automated abuse. Google may process device, browser, application, and network signals and issue security tokens for this purpose. Hosting and network providers, including IONOS and Google Cloud, may also create ordinary request and security logs containing information such as an IP address, requested URL, timestamp, and user agent.
Referral submissions
When you submit a referral, we process the selected company, referral link or code, optional details, email address, requested placement tier, validation results, status, and timestamps. We also create one-way hashes and short-lived rate-limit histories to detect duplicates and enforce submission limits. If a referral is approved, its company, link or code, details, approval state, and placement information may be publicly available. The submitter email and ownership record are stored separately and are not intentionally displayed in the public interface.
Magic links and My Referrals
Firebase Authentication processes the email used to send and complete a magic link. The site receives a Firebase user identifier, verified email state, and authentication session so it can associate matching submissions with that signed-in user. My Referrals uses those records to list, edit, delete, and promote owned submissions. Editing an approved referral sends it back for review.
If you create a public profile, we process the permanent username you choose and privately associate it with your Firebase user identifier. The public profile displays that username and approved referrals associated with your account. It does not display your email address, user identifier, authentication details, payment information, or non-approved submissions.
Suggestions, problem reports, and newsletter
A company suggestion includes the company name, required email, and any optional website or note you provide. A problem report includes its category and description, plus any optional company, page reference, or email. These records are stored in private Firestore collections for authorized admin review and are not public listings.
A newsletter signup stores the normalized email address, subscription status, source, and timestamps. Duplicate and rate-limit records use one-way hashes. For suggestion, report, and newsletter throttling, the server derives a one-way network identifier; the application does not write the raw network address into those contribution records.
Payments and promotions
Stripe hosts Checkout and handles payment method information. Everette Affiliate does not receive or store a full card number. For a paid placement requested with a new public submission, Stripe saves the payment method. You are not charged unless the referral is approved. If approved, the server attempts the stated one-time charge and activates the placement only after Stripe confirms success. An approved referral owner purchasing from My Referrals is charged through Stripe Checkout before activation.
We retain operational Stripe references and transaction information such as Checkout session, customer, Setup Intent or Payment Intent identifiers, tier, price reference, amount, currency, status, failure details, and placement dates. Stripe may process information entered in Checkout even when Checkout is not completed, under Stripe's own privacy terms.
How we use information
We use this information to operate the directory, validate and moderate submissions, publish approved referrals, verify ownership, provide account tools, prevent fraud and duplicate activity, process and reconcile promotions, send service messages, maintain the newsletter list, review suggestions and reports, understand site usage, troubleshoot problems, and protect the service.
Service providers and disclosure
Everette Affiliate relies on Google Firebase and Google Cloud for authentication, Firestore, Cloud Functions, App Check, reCAPTCHA Enterprise, and analytics; Meta for advertising measurement and audience building; Stripe for payment setup and processing; Resend for transactional email; and IONOS for website hosting. Information is shared with each provider only as needed for its role and is also subject to that provider's terms and privacy practices. Magic-link messages are sent through Firebase Authentication. Submission approval, denial, and promotion-setup messages are sent through Resend.
We may also disclose information when reasonably necessary to comply with law, respond to valid legal process, prevent abuse, protect users or the service, or complete a business transfer. The current implementation does not sell or rent submitter, account, suggestion, report, or newsletter email addresses.
Browser storage and cookies
Everette Affiliate uses local storage for the email entered during magic-link sign-in, same-origin sign-in and payment handoff signals, and the seven-day newsletter-banner dismissal. It may use BroadcastChannel for same-origin tab communication. Firebase Authentication may use browser storage to maintain a signed-in session. Firebase Analytics, App Check, reCAPTCHA Enterprise, the Meta Pixel, Stripe, and hosting infrastructure may use cookies or similar technologies under their own configurations and policies. Clearing browser data can sign you out or reset these local preferences and handoffs.
Retention and your choices
The current system does not apply one universal automatic deletion period. Records are kept for as long as reasonably needed to provide the feature, support moderation and payment records, enforce security and duplicate controls, resolve disputes, and meet legal obligations. Providers may retain their own records under their policies and backup schedules.
Signed-in users can delete their referral through My Referrals. That removes the primary referral and submitter ownership records, but related payment, anti-abuse, email-idempotency, security-log, or backup records may remain where needed. To request access, correction, newsletter removal, or deletion of other information, use Report a Problem and provide an email that can be used to verify the request. Do not include card numbers or other sensitive payment details.
Security
Access controls include Firebase Authentication, verified-email ownership checks, App Check, server-side callable validation, admin authorization, and Firestore rules that deny direct client writes. No online service can guarantee absolute security.
External sites and changes
Referral links, company websites, and Stripe Checkout lead to independent services with their own privacy practices. Review their notices before providing information. We may update this notice when the service or its providers change; the date above will identify the latest version.
Questions
For privacy questions or requests, use Report a Problem or review the options on the Contact page. Use of reCAPTCHA Enterprise is also subject to the Google Privacy Policy and Google Terms of Service. Provider details are available from Firebase, Stripe, and Resend.