العربية

Privacy policy

This page explains what information the Khasmak website handles, why, and the choices you have. We wrote it to match what the website actually does today.

KhasmakLast updated

Who runs this website

www.khasmak.online (“Khasmak”, “we”, “us”) is run personally by Ahmed Wael Abdelhafeez, an individual based in Egypt. Khasmak is not a registered company.

Contact for anything in this policy: [email protected]

The short version

  • You can use the whole website without an account. There is no sign-up, no form and no newsletter, and we never ask for your name, phone number or payment details.
  • The website sets no cookies of its own. Google Analytics and the TikTok Pixel run automatically on every page; there is no consent banner and nothing to click, and they set their own cookies (section 4). They stay off if your browser sends Global Privacy Control (section 4). There is no Meta (Facebook) Pixel and no Snapchat pixel. We do not sell information about anyone (section 4).
  • We count visits and button presses with our own simple counter. It stores no identifier for you: no cookie, no internet (IP) address and no daily code (section 2).
  • When you shop with one of our codes or through one of our affiliate links, we may earn a commission. It costs you nothing extra (section 5).

1. Information you give us

“Did the code work?” After you use a code, the page may ask whether it worked. If you answer, we record your answer, the code, the page and the details listed in section 2. We use the answers to remove codes that stop working and, once there are enough of them, to show how many shoppers reported a code as working.

Email. If you email us, we receive your email address and your message. We use them only to reply, and we keep them only as long as we need to deal with your message.

2. Information collected automatically: our own visit counter

When a page loads, and when you press “copy code”, the button that takes you to a store, or a “did it work” answer, your browser sends a small record to our own server, which runs on Cloudflare. Each record contains only:

  • what happened (a page view, a copied code, a store button, or a “did it work” answer);
  • the page and, where relevant, the code;
  • the country your connection comes from, as estimated by Cloudflare from your internet (IP) address;
  • a general label for how you reached us, such as “google”, “chatgpt”, “direct” or the name of one of our own social media channels. We keep the label, never the address of the page you came from;
  • the market you chose in the site’s country filter, or the country version of a store you opened, if you chose one;
  • if you arrived through one of our campaign links, the labels written in that link (for example utm_campaign and utm_content, which name our campaign and the version of the ad), and whether they match a campaign we registered. These describe the link, not you, and they do not show that you saw an advertisement;
  • a random number for each record, different every time, so a record that arrives twice is counted once. It is not kept on your device and cannot connect two records;
  • whether the record was sent while we were testing the site, so that tests never count.

We do not record your name, your browser’s identity string, your IP address, or any cookie or device ID. Earlier versions of our counter also made a daily code from your IP address, the date and a secret key. We no longer make it, and the older records that contain it delete themselves within about three months of being made.

If your browser sends the Global Privacy Control signal, our counter records nothing and the optional services in section 4 are not used.

How long: these records are kept by Cloudflare Workers Analytics Engine for about three months and then deleted automatically. We keep longer only summaries made from them (for example “120 visits from Saudi Arabia this week”), which describe no individual visitor.

Why: to keep the site working and useful, to see which channels bring visitors, and to catch codes that stop working. These are our legitimate interests in running the site.

3. What your browser keeps on your device

The website does not set cookies of its own (Google Analytics and the TikTok Pixel set theirs, section 4). It keeps a few small items in your browser’s own storage:

  • the codes you have already answered “did it work” about, up to 40, so we don’t ask twice. Kept until you clear your browser data;
  • the market you chose in the country filter. Kept until you close the tab;
  • the general label of the first outside site that sent you here, and our campaign tag if the link had one (for example “threads-post”), so a visit is counted once under the right source. Kept until you close the tab;
  • the campaign labels of the link that brought you here, if it had any. Kept until you close the tab, and for at most 24 hours; a later visit from another site clears them;
  • a setting our own team uses to leave its own visits out of the counts, and one it uses to mark its test visits. Only our staff set them.

You can remove all of these at any time by clearing your browser’s site data for www.khasmak.online.

4. Services we rely on

Cloudflare (hosting). Cloudflare delivers the website and protects it from attacks. To do that it processes technical information such as your IP address and browser type. Cloudflare may set a strictly necessary security cookie if it needs to check that a visitor is not an automated attack. Cloudflare also inserts two small scripts into our pages. The first is an email-protection script that hides our address from spam robots and collects nothing. The second is its Web Analytics script, which Cloudflare designs to work without cookies. Our site’s security settings currently stop browsers from running that script. Cloudflare’s privacy policy: cloudflare.com/privacypolicy.

Google Fonts. Our pages load their fonts from Google’s servers. To send the fonts, Google receives your IP address and browser details. Google’s privacy policy: policies.google.com/privacy.

Google Analytics 4 (runs automatically). Google Analytics loads on every page, without asking, and records the pages you view, when you open a store page, copy a code or press a store button, the campaign labels of the link that brought you, and technical information such as your device, browser, approximate location and the page that sent you. Google receives your IP address to do this. Google Analytics sets its own cookies on our site (_ga and _ga_…), which we limit to 180 days. We have turned off Google signals and ad personalization. We never send your name, email or phone number. Google keeps this data for the period set in our account, at most 14 months. Google’s privacy policy: policies.google.com/privacy.

TikTok Pixel (runs automatically). TikTok’s pixel loads on every page, without asking, so we can see whether our TikTok ads bring visitors. It records the pages you view and when you open a store page, copy a code or press a store button, with technical information such as your IP address, browser and device. If you came from a TikTok ad, it reads the click identifier TikTok adds to the link. It sets its own cookies on our site (such as _ttp). TikTok’s automatic matching of email or phone numbers is off, and we never send your name, email or phone number. TikTok keeps this data under its own policy: tiktok.com/legal/privacy-policy.

Neither service receives a “purchase” from us: copying a code or opening a store is not a purchase, and we never report one as such.

Opting out. We show no consent banner, and these two services start without any action from you. They do not start at all if your browser sends the Global Privacy Control signal. You can also stop them by blocking third-party scripts or cookies in your browser, by using Google’s opt-out add-on (tools.google.com/dlpage/gaoptout), or by managing ad personalization in your TikTok settings. You can ask us to stop at [email protected]. Information they already received is kept under their own policies, and blocking them does not affect how the website works.

These providers may process information outside your country, wherever they run their services, including in the United States and other countries. Khasmak itself is run from Egypt.

5. Discount codes, affiliate links and commissions

Khasmak works with affiliate networks that manage discount codes and affiliate links for online stores. The codes on this site currently come through four: Growthnity, DigiZag, Marketeers and DCMnetwork. Khasmak may earn a commission in two ways, and you pay nothing extra in either case:

  • Coupon codes: when you enter one of our codes at a store’s checkout, the store, usually through its affiliate network, may pay us a commission on that order.
  • Tracked affiliate links: some links we share, on this website, in our social media posts or in our Telegram channel, may be tracked affiliate links. When you open one, the affiliate network or the store records that you came from Khasmak. Usually it does this with a cookie or a similar identifier on its own website. If you then buy, we may earn a commission on that order even if you did not use a coupon code.

Khasmak’s own website does not set cookies (section 3). Any cookie or identifier used to credit an affiliate link is set by the store or the affiliate network on their own websites, under their privacy policies. Once you are on a store’s website, the store’s own privacy policy and cookies apply.

For orders credited to us through a code or a link, the networks send us reports. These contain information such as the order date, the store, the code or link used, the country, the order value and our commission. They do not include your name, contact details or payment information.

6. Our social media accounts and Meta

We publish posts about discount codes on our own accounts on Facebook, Instagram and Threads (Meta), X, TikTok, Snapchat and Telegram. We use a Meta app called “khasma-publisher” only to publish posts to our own Facebook Page and Instagram account. The app offers no “Log in with Facebook” to visitors. It does not collect, receive or store information about people who see or interact with our posts.

Links in our posts and advertisements may carry a short label (for example “?c=threads-post”) and campaign labels (such as utm_campaign), so our visit counter can tell which channel or campaign a visit came from (section 2). When you use those platforms, their own privacy policies apply.

7. Deleting your information, including data deletion for Meta

We keep no accounts and no names, so in most cases we cannot link a stored record to you. Visit records delete themselves after about three months. To ask us to delete something, for example an email you sent us, or to ask about information connected to our Facebook or Instagram accounts, email [email protected] with the subject “Delete my data”. We will reply within 30 days. Our Meta app does not collect information from Facebook or Instagram users, so we hold no Facebook data about you to delete. We will still answer your request.

8. Your rights

Depending on where you live, data-protection laws may give you the right to ask what information we hold about you, and to have it corrected or deleted. Examples are Egypt’s Personal Data Protection Law (Law No. 151 of 2020) and Saudi Arabia’s Personal Data Protection Law. Email us at the address above, and we will answer within 30 days, as fully as we can within the limits explained in section 7.

9. Children

The website is meant for adult shoppers. It is not directed at children, and we do not knowingly collect information from children.

10. Changes to this policy

If we change what the website collects, we will update this page and its “last updated” date before the change goes live.