Skip to content
bundlescan

Privacy policy

Last updated October 25, 2026

BundleScan has no accounts and no forms, and sets no cookies of its own. Pages show ads from Google AdSense, which does use cookies (see Ads), and count page views with Cloudflare Web Analytics, which doesn't (see Counting page views). Apart from that, the only things BundleScan records about visitors are a short log of clicks on store links, of searches made on the site, of which sites visitors arrive from and of which pages they read, and the reactions people leave on deals. This page explains exactly what is collected, by whom, why, and what you can do about it.

Who we are

BundleScan (bundlescan.com) is run by the company below, which is responsible for the data described here (the "controller" under the GDPR):

SC Master WebTools SRL
sat. Dezmir, str. Cloșca 74C, Cluj, Romania, 407039
CUI RO30089574 · Trade Register J12/1089/2012
Email: [email protected]

Reading pages

Pages are plain files delivered by Cloudflare. Fonts and images come from bundlescan.com itself. Two scripts come from other companies: Google's ad script, described under Ads, and Cloudflare's page counter, described under Counting page views. BundleScan itself also records which pages you read, as described under Following visits.

To deliver pages and protect the site from attacks, Cloudflare processes your IP address and the usual details your browser sends with each request. See who else receives data.

Counting page views

To see which pages people read and how fast they load, pages run Cloudflare Web Analytics. When a page opens, its script sends Cloudflare:

  • the page's address. Cloudflare drops anything after a question mark, so nothing you typed into the search box is kept;
  • the website you came from, if any;
  • how long the page took to load and to respond, as measured by your browser;
  • the usual details your browser sends, from which Cloudflare takes your country, your browser and operating system, and whether the device is a phone, tablet or computer.

The script sets no cookies and stores nothing in your browser, and Cloudflare doesn't use your IP address, user agent or anything else to recognise you, so page views can't be linked to each other or to you. We see only totals, such as how many times a page was viewed from each country. Ad blockers often stop the script, and nothing else on the site depends on it.

The legal basis is our legitimate interest in running and improving the site (GDPR article 6(1)(f)), and you can object at any time.

Following a store link

Links to stores go through a short BundleScan address (bundlescan.com/r/…). When a browser follows one, we record:

  • which link it was, and when;
  • the BundleScan page it was on and the spot on that page, such as "deal page, sidebar". The page is its address without anything after a question mark, so nothing you typed into the search box is included;
  • your country, as a two-letter code from Cloudflare;
  • whether the device is a phone or a computer;
  • the website the link was clicked on, as a site name only (such as bundlescan.com);
  • whether the request looked like a regular browser or an automated tool;
  • a visitor code: a one-way code made from your IP address, your browser's user agent and the date, mixed with a secret key;
  • a click reference: a random code made for this click, which says nothing about you.

The visitor code lets us count how many different people clicked on a given day. It changes every day, so clicks can't be linked from one day to the next, and without the secret key it can't be turned back into an IP address. The key stays with Cloudflare; we keep no copy of it.

We don't store your IP address or your full user agent. Clicks from link checkers, search engine crawlers and other tools that name themselves as bots are not logged at all.

Links to Humble Bundle are affiliate links run by Impact (impact.com), the network that tracks Humble Bundle's affiliate sales. When you follow one, the address you're sent to carries the link's ID, the button you clicked and the click reference, so Impact's sales reports can tell us which link a purchase came from. Nothing else about you is added.

Searching

When you search on BundleScan, the page sends us what you typed once you stop typing, with how many results it found and any filters you picked. We record that with the same country code, phone-or-computer, visitor code and browser check as a store click (listed above), so we can see what people look for and what the site is missing. Searches from bots and other automated tools are not recorded. Please don't type personal details into the search box.

Arriving from another site

When you open a BundleScan page by following a link on another site, or a link carrying campaign tags (such as the utm_source=chatgpt.com that ChatGPT adds to its links), the page tells us where you came from: the other site's address without the page on it (for example chatgpt.com; your browser doesn't send us more), the campaign tags in the link (utm_source, utm_medium, utm_campaign and ref) and the BundleScan page you landed on. Nothing else from the link is recorded. We record that with the same country code, phone-or-computer, visitor code and browser check as a store click (listed above), so we can see which sites and AI assistants send people here. A page reports it once per browser tab, and not at all when you arrive from a bookmark or type the address. Visits from bots and other automated tools are not recorded.

Following visits

Each page tells us when it is read: its address without anything after a question mark, and the BundleScan page whose link brought you there, if any. We record that with the same country code, phone-or-computer, visitor code and browser check as a store click (listed above).

Because the visitor code is the same for everything you do on BundleScan in one day, we can see a visit as a whole: which pages were read and in what order, and whether it ended with a click to a store. We use that only to see how people find their way around the site and where they give up. The visitor code changes every day and can't be turned back into your IP address, so visits on different days can't be linked, and nothing in them says who you are. Pages read by bots and other automated tools are not recorded.

Reacting to a deal

Deal pages let you react to a deal (Hot, Good deal, Bought it, Meh or Skip). When you do, we record which deal, your reaction, the time, whether the request looked like a regular browser, and the same daily visitor code as a store click (listed above), so each visitor counts once per deal. Your browser also remembers your reaction in its local storage so the page can show it next time; that copy stays on your device. If you follow a store button and come back to the deal page, it may ask whether you bought it: your answer is saved as a reaction like any other, and your browser notes in the same storage that it asked, so it asks only once. The totals for each deal are shown to everyone; single reactions never are. Unlike clicks and searches, reactions stay in Cloudflare's database while BundleScan runs, because the totals on each page are counted from there.

Showing prices in your currency

If you pick a currency in the menu at the top of the page, your browser remembers that choice in its local storage so the next page uses it too. It stays on your device and is never sent to us. The exchange rates are the European Central Bank's, included in the page itself, so picking a currency contacts no one.

Ads

Pages show ads served by Google AdSense, run by Google Ireland Limited for visitors in the European Economic Area, the UK and Switzerland, and by Google LLC elsewhere. To choose, show and measure ads and to prevent fraud, Google receives your IP address and the usual details your browser sends, and Google and its partners may set and read cookies or similar identifiers in your browser.

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet. Without those cookies, ads are chosen from the page you are reading instead.

In the European Economic Area, the UK and Switzerland, ads are personalised only if you consent to it in the message Google shows on this site, and you can change that choice later through the same message. Elsewhere, you can turn off personalised ads in Google's My Ad Center, or opt out of other vendors' personalised ads at aboutads.info.

Google decides how it uses this data, as an independent controller. See how Google uses information from sites that use its services and Google's privacy policy. We receive only totals, such as how many ads were shown and what they earned, never data about you.

Emailing us

If you email us, we use your address and message to reply, and keep them only as long as the conversation needs.

Why we record clicks, searches, arrivals and visits

To see which deals, links and searches people find useful, what they look for that the site doesn't have yet, which sites and AI assistants send people here, how people find their way around the site, to catch broken links and automated traffic, and to understand which pages earn the affiliate commissions that pay for the site (see the affiliate disclosure).

The legal basis is our legitimate interest in running and improving the site (GDPR article 6(1)(f)). We keep the data to the minimum that purpose needs, and you can object at any time.

How long we keep it

Click, search, arrival and page-view records stay in Cloudflare's database for up to 7 days. They are then copied to our own systems and deleted from Cloudflare. We keep the copies for long-term statistics for as long as BundleScan runs. They contain no IP addresses.

Page-view data stays with Cloudflare. It is kept in full for 7 days; after that, only a sample of about one in ten page views is kept, for the totals. It contains no IP addresses or visitor codes.

Who else receives data

  • Cloudflare, Inc. hosts the site, runs the store-link redirect, holds the click records and counts page views for us, as our processor. Cloudflare is based in the United States and is certified under the EU-U.S. Data Privacy Framework.
  • Google serves the ads, as described under Ads.
  • Stores and affiliate networks. Once you reach a store, it receives the usual details from your browser and may set its own cookies. For an affiliate link, the network that tracks sales for the store (Impact, for Humble Bundle) does the same, so the sale can be credited to BundleScan. Their own privacy policies apply. The commission reports we receive list each sale's amount, our commission, the country and the link details above, never your name, email address or payment details.

We don't sell data or share it with anyone else.

Your rights

Under the GDPR you can ask us for access to your data, or to correct, delete or restrict it, and you can object to how we use it. Write to the email address above.

Because we don't store IP addresses and can't recreate the visitor code, we usually can't tell which click records are yours (GDPR article 11). If you contact us, we'll tell you what we can do.

You can also complain to a data protection authority. In Romania that is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (dataprotection.ro). You can also go to the authority in the EU country where you live.

Children

BundleScan doesn't ask for anyone's age and collects nothing beyond what's described above, for visitors of any age.

Changes

When this policy changes, the date at the top changes with it.