Privacy Policy

This Privacy Policy explains how FreebieAgent ("FreebieAgent," "we," "us," or "our") handles personal data when you use freebieagent.com, create an account, ask us to claim an offer, contact support, receive notifications, or use the FreebieAgent plugin in ChatGPT or Codex (collectively, the "Services").

FreebieAgent is responsible for the personal data it processes under this policy. OpenAI and any third-party website you choose to visit process data under their own privacy policies.

FreebieAgent and TrySpree (tryspree.com) are run by the same company on one shared system. One account works on both sites: your login, profile, and shipping details are stored once and used by both, and accounts with the same email address on both sites were joined. Comments and other community activity stay on the site where you posted them. Deleting your account deletes it on both sites.

The plugin is a public, read-only free-sample finder. It does not require a FreebieAgent account, connect to your FreebieAgent profile, claim offers, submit forms, make purchases, or change data outside the conversation.

Tool inputs we receive: Tool-by-tool data map

search

Receives optional search keywords, category, sort choice, and result limit. Returns a summary and up to 10 matching public offer records. It does not attach the widget.

fetch

Receives one numeric public listing ID. Returns a summary and that public offer record when it exists. It does not fetch or return a user record.

render_freebie_finder

Receives the same optional fields as search. Returns matching public offer records and attaches the FreebieAgent finder widget.

find_similar_freebies

Receives one public listing ID and an optional result limit. Returns a summary and similar public offer records. This tool can be invoked from the widget.

Listing-image request

When the widget displays an image, it requests our same-origin image proxy with the public listing ID. The proxy returns the listing image or a placeholder; it does not receive profile data.

Each tool call also contains the ordinary MCP/JSON-RPC fields required to process it, such as a request identifier, method name, and declared arguments. Search text is trimmed, normalized, and limited to 80 characters; result limits are capped at 10. OpenAI selects and sends these fields from your request. FreebieAgent does not receive your full conversation unless you put conversation content into a tool argument.

Tool outputs we return

The plugin returns public offer information from our catalog: a listing ID, title, description, category, quality or rating signals, listing date, image URL, FreebieAgent detail-page URL, and, when available, the public offer URL and its host. It also returns a short result summary. It does not return FreebieAgent account, profile, claim-history, support, analytics, or advertising data.

The inline widget HTML contains FreebieAgent code and styling. The widget may call the similar-results tool, open a selected FreebieAgent or public offer link at your direction, and display same-origin images. It does not ask for authentication, set a FreebieAgent cookie, query account or profile tables, or collect form data.

Purposes, recipients, and retention

• Purpose: We use tool inputs only to search our public catalog, retrieve the requested listing, rank or filter results, render the finder, prevent abuse, and troubleshoot failures.
• Recipients: OpenAI transmits the tool call and receives the tool response; Vercel hosts the endpoint and same-origin image proxy; and Supabase stores and serves the public offer catalog. The embedded plugin does not load Google AdSense, Google Analytics, Google Tag Manager, FullStory, or other advertising or session-recording scripts.
• Retention: We do not write plugin search text, tool inputs, or tool outputs to our application database or AI-usage ledger. They are processed to answer the request and then discarded by the application. Our hosting and security systems may retain limited request metadata, such as IP address, request path, time, user agent, response status, and error details, for up to 30 days for security and reliability. The public catalog is retained as editorial product data, not as a record about the plugin user. OpenAI applies its own retention rules to ChatGPT and Codex conversations and tool calls.
• User controls:You may choose not to invoke the tools, remove or disconnect the plugin in ChatGPT or Codex, avoid entering personal data in a search, clear or delete the surrounding conversation using OpenAI's controls, and contact us using the privacy-request process below.

Selecting a FreebieAgent result opens a link only when you choose it. A FreebieAgent detail page is covered by the website practices below. If you continue to a brand or retailer, that third party receives the ordinary web request and handles any data you provide under its own policy.

We do not ask the plugin for your name, email address, mailing address, phone number, birthday, account credentials, payment information, government identifiers, health information, precise location, contacts, files, photos, or full chat history. Please do not put personal or sensitive information in a free-text search.

Depending on how you use the Services, we collect the following categories:

Account and authentication

Email address, username, authentication records, account ID, role, and account timestamps. Supabase processes your password or sign-in credential; FreebieAgent does not receive a readable copy of your password.

Profile and shipping information

Details you choose to provide, including first and last name, phone number, birthday, street address, apartment or unit, city, state, ZIP code, avatar, and notification categories.

Claim and consent records

The offer you asked us to claim, claim status and time, required or missing fields, consent version and time, retry or failure reason, and limited technical diagnostics such as the post-submit URL, response status, and a short page-text excerpt used to verify the result. We do not request or store payment-card data for sample claims.

Saved items and community content

Public listing IDs you save, comments and ratings you submit, and the username and account ID associated with that activity. Your username, comments, ratings, and posting time are visible to other visitors.

Support communications

Name, email, topic, message, page path, user agent, support status, and any information you choose to include in your request.

Email and push notifications

Email preferences, delivery and suppression records, push-subscription endpoint and encryption keys, selected categories, and engagement with notifications.

Usage, device, and diagnostics

Pages and listings viewed, website search text, sorting choices, clicks, claims and shares, browser and operating-system information, IP address, user agent, approximate location derived by service providers, session interactions, performance measurements, crash or error information, and security logs.

Advertising, affiliate, and referral activity

Advertising identifiers and cookie data collected by advertising partners; outbound offer or affiliate link, source page, listing ID, click ID, user agent, optional signed-in account ID, referral code, and conversion status or amount when reported to us.

Data stored on your device

Authentication and preference cookies, a 30-day referral cookie, session-only page-depth and admin-state values, and local values used to remember the last viewed sample and when advertising may load.

AI feature and operations data

Website search text sent to create a semantic-search embedding; public offer and source-page content used for research, classification, scoring, copy, and image generation; generic prompts used for usernames and notifications; and, only when deterministic checks cannot verify an authorized claim, a redacted post-submit URL and page-text excerpt. We keep an internal usage record containing provider, model, feature, timing, token or item counts, estimated cost, status, and limited error details; it does not store prompt or completion bodies.

Administrative activity

For authorized staff actions, we may record actor account ID and email, action, affected record, limited change metadata, IP address, user agent, and time for accountability and security.

We collect this data from you; your browser or device; OpenAI when the plugin is invoked; our hosting, authentication, analytics, advertising, email, security, AI, and browser-automation providers; and brands, retailers, or affiliate partners when they report a result or conversion to us. We also derive limited data, such as offer scores, search embeddings, approximate location, and aggregate performance metrics.

We use the categories above to:

• Provide, secure, maintain, and troubleshoot the Services.
• Create and authenticate accounts and save user preferences.
• Search, rank, display, and verify public free-sample offers.
• Generate semantic-search embeddings from website search text.
• Complete a specific third-party sample-request form only after a signed-in user explicitly authorizes that claim.
• Record claim status, prevent duplicate submissions, and diagnose failures.
• Send requested email or push notifications and honor opt-outs.
• Respond to support, privacy, safety, and legal requests.
• Measure service performance and improve usability.
• Measure referrals, affiliate activity, and advertising performance.
• Generate and edit public catalog images, descriptions, and marketing copy.
• Detect, investigate, and prevent fraud, abuse, security incidents, and violations.
• Comply with law and protect users, FreebieAgent, and others.

Where applicable, we rely on performing the service you request, your consent, compliance with law, and our legitimate interests in operating, securing, and improving the Services. You may withdraw consent where consent is the basis, although that does not affect earlier processing.

We disclose data only as described here and for the stated purposes:

OpenAI

Transmits FreebieAgent plugin tool inputs and receives tool outputs. Separately, OpenAI processes website search text to create semantic-search embeddings and may process prompts used to generate public catalog images. OpenAI handles the surrounding ChatGPT or Codex conversation and account data under its own terms and privacy policy.

Supabase

Provides database, authentication, and storage services for accounts, profiles, preferences, claims, comments, support records, public offer data, and operational records.

Vercel

Hosts the website, plugin endpoint, scheduled jobs, and local automated-claim browser; provides Speed Insights; and processes network, server, performance, and security data needed to deliver and operate them.

Amazon Web Services

Amazon Simple Email Service sends service and marketing email and processes delivery, bounce, complaint, and unsubscribe information.

Google

Google Analytics measures website activity, including event fields such as website search terms, listing names or IDs, claim events, and referral or affiliate interactions; Google AdSense serves and measures website advertising. These services may also receive page, device, cookie, advertising, and approximate-location data. Google Gemini processes public offer content, non-personal editorial or notification prompts, and redacted post-submit page excerpts used as a fallback to verify an authorized claim. These services are not embedded in the ChatGPT/Codex plugin widget.

FullStory

When enabled, records and analyzes interactions on non-admin website pages to diagnose problems and improve usability. For signed-in users, FreebieAgent identifies the session to FullStory with account ID, email, and admin status. FullStory may receive page content, clicks, scrolling, browser and device data, and other visible interactions, subject to its masking and privacy controls.

Cloudflare and browser push services

Cloudflare Turnstile receives CAPTCHA and network data to protect the support form. Your browser's push service receives the endpoint, encryption keys, and notification payload needed to deliver notifications you enable.

Brands and retailers

When you explicitly authorize an automated website claim, we transmit only the profile fields needed by that offer (such as name, email, mailing address, phone number, or birthday) to the third-party form. Their policy governs their subsequent use and retention.

Affiliate and referral partners

When you choose an outbound affiliate link, we may send a click identifier and offer attribution parameters to the named network or destination so a conversion can be credited. The destination also receives ordinary web-request data.

Browserbase

Renders public offer and source pages and may retain operational browser-session data when our internal systems discover offers, inspect product images, or record reusable claim scripts with a FreebieAgent test identity. Most user-authorized claims replay in a temporary browser on Vercel. If an offer requires a residential proxy or Browserbase-managed anti-bot handling, the authorized claim may instead run in a temporary Browserbase session, where Browserbase can process the profile fields entered into the brand's form and the resulting page content.

CAPTCHA-solving services

When enabled and a supported CAPTCHA blocks an authorized claim, our configured solver (2Captcha by default, or another API-compatible provider) receives the destination page URL, public CAPTCHA site key, CAPTCHA type, and ordinary network metadata and returns a solution token. We do not send the solver the user's FreebieAgent profile fields, and we do not retain the solution token after the claim attempt.

Recorder email provider

Google Gmail or another configured mailbox provider may process messages sent to FreebieAgent's synthetic test inbox when we verify that a recorded public offer generated a confirmation or verification message. This process uses a FreebieAgent test identity, not access to a user's personal inbox.

AI service providers

OpenAI, Google, and Anthropic may process website search text, public offer content, and prompts used for catalog images, editorial copy, notification copy, offer research, scoring, categorization, and other internal operations. Google may also receive a post-submit URL and page-text excerpt only when deterministic checks cannot verify an authorized claim. Before that fallback call, we redact known profile values, email addresses, and phone-like strings; unexpected content produced by a third-party page could still contain personal data. FreebieAgent stores usage metadata, not prompt or completion bodies, in its AI-usage ledger.

Other visitors

Your chosen username, comments, ratings, and posting time may be displayed publicly with the applicable offer. Do not include personal or sensitive information in public comments.

Authorized personnel

A limited number of authorized FreebieAgent personnel or contractors may access support requests, account administration, claim failures, audit records, and operational diagnostics when needed to operate, secure, support, or improve the Services.

Legal, safety, and business recipients

We may disclose information to advisers, authorities, or other parties when reasonably necessary to comply with law, enforce terms, protect rights or safety, investigate abuse, or complete a merger, financing, acquisition, reorganization, or sale subject to appropriate protections.

We do not sell personal data for money. Website advertising and cross-context personalized advertising may be considered a "sale" or "sharing" under some privacy laws; the controls below explain how to limit that activity.

We keep personal data only for the periods below, then delete or de-identify it unless a longer period is required by law, needed to resolve a dispute, or necessary for an active security or fraud investigation.

Plugin tool requests

Tool inputs and outputs are not saved in our application database. Limited hosting and security metadata may be retained for up to 30 days.

Account, profile, preferences, claims, and comments

Kept while your account is active and deleted when you delete the account or we approve a verified deletion request. Public comments and saved items linked by cascading account identifiers are also deleted. Records designed to survive account deletion are de-linked from the account. Residual copies may remain in encrypted backups for up to 90 days before being overwritten.

Temporary automated-claim browser data

Held only for the individual claim attempt. The temporary browser profile is deleted when the attempt ends. The receiving brand or retailer applies its own retention policy to data submitted to it.

Claim and security diagnostics

Routine server logs are kept up to 30 days. Claim-status and limited failure records tied to an account are kept for the life of the account; de-identified operational diagnostics may be kept for up to 24 months.

Website search and AI operations

FreebieAgent does not store raw website search text, claim-verification excerpts, or other prompt bodies in its AI-usage ledger. Those inputs are processed by the named provider under its retention terms. AI usage and cost metadata and administrative audit records may be kept for up to 24 months. Public catalog content, generated images, scores, and embeddings may be kept while the applicable listing remains in our catalog.

Browser automation records

Temporary local user-claim browser profiles are deleted when each attempt ends. A proxy-routed claim or synthetic recording may be processed in a temporary Browserbase session. Reusable claim scripts and synthetic recording diagnostics may be kept while an offer remains active and for up to 24 months afterward for reliability and audit purposes. Browserbase session data and CAPTCHA-solver job data are retained under each configured provider's terms. FreebieAgent does not retain CAPTCHA solution tokens after the attempt.

Support requests

Kept while the request is open and for up to 24 months after it is resolved, unless a longer period is needed for an active dispute or legal obligation.

Email and push data

Push subscriptions are kept until you unsubscribe, the endpoint becomes invalid, or your account is deleted. Email delivery logs are kept up to 24 months. Suppression records are kept as long as needed to honor an unsubscribe, bounce, or complaint.

Website analytics and session recordings

Identifiable analytics events and FullStory recordings are retained for no more than 14 months. Aggregated or de-identified measurements may be retained longer.

Affiliate and referral records

Kept for up to 24 months for attribution, reconciliation, abuse prevention, and accounting. Records required for tax, financial, or legal compliance may be kept for up to seven years.

Administrative audit records

Kept for up to 24 months for access review, security, accountability, and incident investigation, unless a longer period is required for an active investigation or legal obligation.

Cookies and local device storage

Session values expire when the session ends; the referral cookie expires after 30 days; other values remain until their stated expiry, you clear site data, or the relevant provider deletes them under its policy.

The website uses essential authentication cookies, local preferences, analytics and session-replay technologies, and advertising cookies. Google and its partners may use cookies or device identifiers to serve and measure ads based on activity on this and other sites. The ChatGPT/Codex plugin widget does not load these website advertising or session-replay technologies.

Essential

Supabase authentication cookies maintain sign-in and security. A referral cookie attributes a later signup. Disabling essential cookies may prevent account features from working.

Local and session storage

FreebieAgent stores page-depth counters, a remembered sample path, an advertising page-view counter, and temporary admin UI state in the browser.

Analytics and replay

Google Analytics, Vercel Speed Insights, and, when enabled, FullStory measure visits, performance, and interactions on the website.

Advertising

Google AdSense may load after repeat page views on eligible website pages and may use cookies or device identifiers for ad delivery, frequency, fraud prevention, personalization, and measurement.

Meta Pixel

On TrySpree, the Meta (Facebook) Pixel records page views so we can measure and improve our ads on Facebook and Instagram. Meta may use cookies and device data under its own policy.

You can block or delete cookies in your browser, use supported device or browser privacy controls, and adjust personalized advertising through Google's My Ad Center or participating-industry controls at YourAdChoices. Blocking essential storage may prevent sign-in or saved preferences from working.

You may also email us with the subject "Opt Out of Sale or Sharing"to request that we apply any legally required opt-out associated with information we can reasonably identify. Browser "Do Not Track" signals do not have a single accepted standard, so we do not respond to them uniformly.

Our listings and plugin results may link to independent brand, retailer, affiliate, or other third-party sites. We do not control their privacy practices. Review their policies before providing information.

Depending on where you live, you may have the right to:

• Access, know about, or receive a portable copy of your personal data.
• Correct inaccurate profile information.
• Delete your account and associated personal data.
• Withdraw consent or object to or restrict certain processing.
• Opt out of marketing email, push notifications, or certain targeted advertising.
• Opt out of a sale or sharing of personal data where applicable.
• Limit certain uses of sensitive personal data where applicable.
• Appeal a decision we make about a privacy request.
• Not receive discriminatory treatment for exercising a privacy right.

Signed-in users can update profile and notification settings and can permanently delete their account from the profile page. Marketing emails include an unsubscribe link, and push notifications can be disabled in FreebieAgent or browser settings. You may disconnect the plugin through ChatGPT or Codex settings.

To exercise a privacy right, email info@freebieagent.com with the subject "Privacy Request". Include the email address associated with your account, the right you want to exercise, and enough detail for us to identify the relevant data. Do not email a password or other authentication secret. We may verify your identity before acting. We aim to respond within 45 days or the shorter period required by applicable law. You may use an authorized agent where local law permits.

Account deletion removes the authentication account and data that is configured to cascade with it. Some records may be retained without an account link, for example, suppression entries needed to honor an unsubscribe, financial records, security or fraud evidence, and support or operational records subject to the limits above. We will explain any material exception that applies to a verified request.

During the preceding 12 months, FreebieAgent may have collected the categories described in Section 3: identifiers and contact information; account and profile records; commercial and claim activity; internet or electronic-network activity; approximate geolocation; public user content; and inferences such as offer interests or preferences. The sources, business purposes, and recipient categories are listed in Sections 3 through 5.

We do not sell personal data for money. Google AdSense and related advertising technology on the website may qualify as selling, sharing, or targeted advertising under some state laws. We do not knowingly sell or share personal data of people under 16. Eligible residents may submit access, correction, deletion, portability, opt-out, limitation, and appeal requests using Section 8. We will not discriminate against you for exercising an applicable privacy right.

We use administrative, technical, and organizational safeguards designed to protect personal data, including encrypted transport, access controls, row-level database security, restricted service credentials, and data minimization. No internet or storage system is completely secure.

FreebieAgent and its service providers may process data in the United States and other countries where they operate. Those countries may have different data-protection laws from your location. Where required, we use legally recognized safeguards for international transfers.

Accounts are for people 18 and older. The Services are not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided personal data to us, contact us so we can investigate and delete it where appropriate.

We may update this policy as the Services or legal requirements change. We will post the revised policy here, update the effective date, and provide additional notice when required. Material changes to the FreebieAgent plugin's data practices will be reflected in this policy before the changed tools are submitted or published.

For privacy questions, requests, appeals, or general support, email info@freebieagent.com or use our support form.

FreebieAgent is operated by TrySpree, Inc.