Privacy Policy

The Caramel extension talks only to Caramel's own server (grabcaramel.com). The extension itself contains no ads, no analytics and no third-party trackers.

Whether or not you are signed in

• The website you are on. Whenever you load a web page (http or https) or switch to a tab, the extension sends that page's hostname (for example, "amazon.com") to our server to check whether we have coupons for it, show the number on the toolbar icon, and load the store's codes. Only the hostname is sent for this, never the full page address or the page's contents, and the toolbar-icon check is sent without your sign-in token.
• Cart page details. When some of a store's codes only apply to certain products, the extension sends a short summary of the cart page so we can tell which codes fit: the store's hostname, the page path, the page title and description, the store name, and the names of up to 6 items in your cart. It never sends payment card details, your address, your order number or order history, or passwords you type into a store.
• Finding the promo-code box on a cart page. When a store's known rules do not locate its promo-code box, the extension looks for it on the page, on your device. Nothing new is sent to Caramel for that, except that the extension reads Caramel's feature switches from our server. If that also fails, and only after you tap to apply codes, the extension sends one request to our server (at most once per store in a browser tab). The request contains the store's hostname and a trimmed outline of the cart page's buttons, links, headings and form-control labels. Each name in the outline is cut to at most 100 characters, every digit is replaced with "#", email-shaped text is replaced with a placeholder, and every word that is not on a fixed list of common interface and coupon words is dropped. The request never contains text you typed into fields, the page text outside that outline, or the page's address path or query. Its contents are the same whether or not you are signed in; the extension attaches its usual sign-in token as it does on other requests, but our server does not use it to identify you for this request. Our server asks an AI model which control on the page is the code box (see "Who Do We Share It With?" below), and records the outcome, the timings, the store's hostname and the model's name as an event in our self-hosted analytics, not tied to you or your account.
• Coupon results. Which codes worked or failed at a store, and the store's error message when a code is rejected (for example, "This code has expired").
• Your settings. Whether auto-apply is on, the sites where you paused Caramel, and your savings-sync and checkout-sharing choices.
• Anonymous usage diagnostics, only if you opt in. If you press Allow on the extension's "Help improve Caramel?" card, or switch on "Send anonymous usage diagnostics" in its settings (it is off by default; Firefox also asks for its own permission), the extension sends anonymous diagnostics when you are at checkout on a supported store: which store, whether the code-sharing offer appeared, and why a code wasn't shared, along with the extension version and your browser. These events go to our self-hosted analytics under a random ID created on this device when you opt in, not linked to your account or install ID. They never include your codes, your cart, the other pages you visit, or anything that identifies you. You can change this anytime in the extension's settings. Switching it off deletes this device's random diagnostics ID; anything already sent can't be linked back to you.

If you create an account or sign in

• Account details. Your email address, name and profile picture. If you sign in with email, your password is sent to our server to sign you in and is stored only as a one-way hash. If you sign in with Google or Apple, we receive your name, email address and profile picture from that provider.
• Sign-in session. A session token kept in the extension so you stay signed in. Our server records the session along with the IP address and browser type it was created from.
• How you first found Caramel. Our website keeps a small first-party record of the campaign, link or site that first sent you to it, and the first page you landed on, and links it to your account when you sign up. If you sign in from the extension, it sends us the same record, which it reads only from grabcaramel.com, together with a random install ID, so your account is attributed the same way.
• Favorite stores you mark in the extension or on the website.
• Coupon results linked to your account, at most once per code per day, to keep results honest and stop abuse.
• Savings history, only if you turn on savings sync (it is off by default): the store, the code, the amount saved, the currency and the date.
• Coupon codes you choose to share. If you're signed in, you can add a code on a store page, and, if the extension's "Share codes I enter at checkout" setting is on, the extension sends a code you typed yourself once the store accepts it. We store only the code, the store, and your account (to limit abuse); never your cart, order or payment details. Shared codes are shown publicly to other shoppers without your name. You can turn checkout sharing off at any time in the extension's settings.

On our website

When you visit grabcaramel.com we collect usage analytics and error reports as described under "Website Analytics & Cookies" below.

If you use our store-request form we collect the store address you enter, your browser type, and your email if you give one (or your account email if you are signed in), and keep it so we can add the store and tell you when it is supported. If you contact support we collect your message, the page you were on and, if you want a reply, your email; it is emailed to our support inbox and logged in our self-hosted analytics. If you add a coupon code on a store page, we store the code and the store linked to your account, as described above.

We use the information above only to:

• Find coupon codes for the store you are on, show how many we have, and apply them at checkout.
• Rank codes by whether they actually work, and retire codes that have expired.
• Work out which codes fit the items in your cart (an AI model reads the cart page summary described above).
• Run your account: sign-in, favorite stores and, if you turn it on, your savings history.
• Publish codes you choose to share so other shoppers can use them.
• Keep Caramel secure and working: limit abuse, and find and fix errors.
• Find the promo-code box on a cart page when a store’s known rules cannot (an AI model reads the cart-page outline described above).

We do not use your information for advertising, we do not sell it, and we do not use it to decide creditworthiness or for lending. The use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

In your browser

• Your settings, kept in your browser’s extension storage. If you use your browser’s sync feature, your browser syncs them to your other devices.
• Your sign-in session token, your account name, email and profile picture (cached for the popup), a short log of your recent savings, a cached list of supported stores, and recent diagnostic timings, kept in the extension’s local storage on this device.
• While Caramel tries codes on a store page, the codes tried and the result are kept in that tab’s session storage, which your browser clears when you close the tab.
• Uninstalling the extension removes everything it stored in your browser.

On our servers

• Caramel’s servers are operated by Devino. Data travels to them encrypted over HTTPS.
• Account details, favorite stores, savings history and account-linked coupon results are kept until you delete them or ask us to delete your account.
• Sign-in sessions expire after 7 days (website sessions are extended while you stay active); signing out ends the session and deletes its record immediately. Records of sessions that expire without signing out, including their IP address and browser type, are kept until you delete your account.
• Cart page summaries are not stored in our database. They are processed to classify your cart, and the result is kept in temporary memory for up to 24 hours so the same cart is not processed twice.
• Cart-page outlines (see “Finding the promo-code box” above) are not stored in our database. The model’s answer, which control is the code box, is kept in temporary memory for up to 24 hours for that store and page shape so the same page is not processed twice, looked up by a one-way hash of the store and outline rather than by the outline itself. Your IP address is used to rate-limit these requests. The outcome event described above is kept in our self-hosted analytics.
• Coupon results are kept as per-code totals (when a code last worked or failed, and the store’s last error message). To stop fake reports from hiding or reviving a code, each “worked” or “didn’t work” report also keeps a one-way keyed hash of your IP address, or of your account if you are signed in. It cannot be turned back into your IP or account, and it is deleted after 30 days.
• Shared codes stay published while they are valid; deleting your account removes the link between a shared code and you.
• Server logs, which can include IP addresses and browser type, are kept for up to 90 days for security and troubleshooting.

We never sell your information. We share it only with the service providers we need to run Caramel, each for the purpose listed:

• OpenRouter, and the AI model provider it routes the request to (currently Anthropic's Claude model, which OpenRouter may serve through Anthropic or another hosting provider it uses): the store name and hostname, page title and description, and up to 6 cart item names, to work out which codes fit your cart. It is sent without your name, email address or account.
• Devino's own AI model proxy, which currently passes the request to NVIDIA's hosted model service (NIM): the store's hostname and the trimmed cart-page outline described above, to work out which control is the promo-code box. It is sent without your name, email address or account.
• Google and Apple: only if you choose "Sign in with Google" or "Sign in with Apple", to sign you in.
• Sendly (operated by Devino) and Amazon Web Services (Amazon SES): your email address, to deliver account emails such as sign-up verification and password resets, and replies to messages you send us.
• Cloudflare: our network provider, which passes requests (including your IP address) to our servers and protects them from attacks.
• Google Analytics: usage analytics on our website only, never from the extension.
• Other Caramel shoppers: coupon codes you choose to share are shown publicly, without your name.

Our error monitoring (Sentry) and product analytics (PostHog) are self-hosted by Devino on our own servers, so the data they receive is not shared with those companies. We may also disclose information if the law requires it, or to protect Caramel and its users from fraud or abuse.

• Sell or rent your personal information.
• Use it for advertising, or for creditworthiness or lending decisions.
• Read or collect payment card details, your address, your order number or order history, or passwords you type into stores.
• Send full page addresses or page contents of the sites you visit: for each page you load, the extension sends only its hostname (see above), and the cart summary only when described above.
• The only other page content the extension sends is the trimmed cart-page outline described under “Finding the promo-code box on a cart page”, and only as described there.
• Run code downloaded from the internet: everything the extension runs ships inside the extension package.

On grabcaramel.com (not in the extension) we use:

• Google Analytics: usage analytics.
• PostHog (self-hosted): usage analytics, linked to your account when you are signed in, including session recordings with every form field masked.
• Sentry (self-hosted): error monitoring, which includes session replay on a sample of sessions and on every session where an error occurs (form fields are masked).

Neither PostHog nor Sentry records a session replay when your browser sends a Global Privacy Control or Do Not Track signal.

The website uses cookies to keep you signed in and for the analytics above. You can block or delete cookies in your browser settings; you will then need to sign in again.

Data is encrypted in transit with HTTPS, passwords are stored only as one-way hashes, and access to our servers is restricted to the Devino team. No method of storage or transmission is perfectly secure, but we work to protect your information from unauthorized access, loss or misuse.

• Pause Caramel on any site, or turn auto-apply off, from the extension.
• Turn checkout sharing and savings sync on or off at any time in the extension’s settings.
• Download your data, or delete your saved Caramel data (savings, favorite stores and coupon results), from Profile → Data & privacy on grabcaramel.com.
• Ask us to access, correct or delete your account and everything linked to it by emailing hello@devino.ca from the address on your account. We act on deletion requests within 30 days; deleting your account removes your login, sign-in sessions, favorite stores, savings history and coupon results, and unlinks you from codes you shared.
• Uninstall the extension at any time; this stops all collection and removes what it stored in your browser.