Privacy

What we collect

• Account details: email address, display name and username, a securely hashed password, and an optional avatar.
• Content and activity: deals you post, comments, votes, reports, saved deals, retailers you follow, and alerts and reminders you set.
• Engagement and usage data: what you view and click. Click records store your IP address only as a non-reversible hash used for deduplication. Clicks on deals carrying a DealHive affiliate link are flagged so the affiliate program can be measured (see the affiliate disclosure).
• Security data: IP address, browser user-agent, and event details when you sign up, log in, change your password, or manage MFA. Visible to you on /profile/security.
• Preferences and consents: email digest frequency, local-deals cities, location and commercial-data opt-ins, and an audit record of each consent you give or withdraw (timestamp, IP address, user-agent, document version).

How we use it

• Running the site: the feed, your profile and reputation, notifications, and the features you use.
• Security and moderation: preventing account takeover, rate-limiting spam, deduplicating votes and clicks, and automated AI checking of submissions.
• Analytics and measurement: understanding how the site is used so we can improve and grow it. We use our own first-party analytics and may use third-party analytics services (such as Google Analytics).
• Personalisation and advertising: local deals and content based on the cities you pick or, if you opt in, your approximate IP-based location (roughly 50km accuracy, never precise GPS), including personalised local advertising.
• Communications: digests, alerts, and reminders you opt into.
• Commercial data products: aggregated insights (for example category and engagement trends) built from the activity of members who opt in via the “Help DealHive grow” toggle on your profile settings. These may be published, licensed, or sold.

Cookies and similar technologies

• Session cookies: set by our login system to keep you logged in. HttpOnly, SameSite=Lax.
• Analytics cookies: third-party analytics services we use (such as Google Analytics) may set their own cookies to measure site usage.
• Advertising cookies: may be introduced when advertising launches; this section will be updated when they are.
• Browser storage: used for interface preferences.

Sharing and overseas disclosure

• Service providers: our database, authentication, and hosting providers, an email delivery service, AI services used for moderation and deal sourcing, and analytics providers. Some are located overseas, including in the United States and other countries; by using the site you consent to that processing.
• Public content: your display name, username, reputation, deals, and comments are visible to everyone. Your email address and private settings are visible only to you and site admins.
• Commercial partners: aggregated or de-identified insights built from opted-in members' activity may be shared with or sold to commercial partners.
• Law enforcement and regulators: where required or authorised by law.
• We do not sell data that directly identifies you (such as your email address or named account history) without asking for your specific consent first.

Your rights and choices

• Access and correction: view and edit your details, preferences, and opt-ins on your profile and settings pages.
• Deletion: delete your account via /profile/account. Your content remains as part of the public record with the author shown as “[deleted]”.
• Export: request a data export or your consent history via the contact form; we respond within 30 days (APP 12).
• Opt-outs: every opt-in can be toggled off at any time on the page where you enabled it, effective immediately for future activity.
• Complaints: contact us first and we will respond promptly. If unresolved, you can complain to the OAIC at oaic.gov.au.

Retention

We keep account data while your account exists. Raw security logs (including IP addresses) are kept for 180 days, then reduced to aggregate counts. Engagement records (with hashed IPs) are retained for analytics. Consent records are kept for the life of your account. Data we no longer need is deleted or de-identified.

Security

HTTPS everywhere, content-security-policy headers, CSRF protection on mutations, row-level security on user-data tables, and secrets kept out of the codebase. To report a vulnerability, use the contact form and mark it as a security report; we ask for a reasonable window to fix issues before public disclosure.

Changes to this policy

We may update this policy as the site evolves. Material changes will be flagged with a notice on this page for at least 14 days. Earlier versions are retained and available on request.

Contact

Questions, complaints, or requests for data access, export, or deletion: use the contact form. Data-rights requests are actioned within 30 days.