Expiring CodesPrivacy policy
Last updated: October 7, 2026
Expiring Codes is run by Tofu Labs (PT Kodecut Digital Media), Menara Karya 28th Fl, Jl. HR Rasuna Said Block X-5, Kav 1-2, South Jakarta 12950, Indonesia. This page says what we store and why. Contact: tofulabs.apps@gmail.com.
What we store
| What | Why |
|---|---|
| Your Kit account ID, name, email address and time zone | To know which account a request is for, to show deadlines in your time zone, and to contact you about the app |
| Kit access tokens (encrypted) | To write codes into your subscribers' custom fields |
| Your Stripe or Paddle API key (encrypted) | To create the discount codes in your account |
| For each code: the Kit subscriber ID, the offer name, the code and its deadline | So a subscriber who passes the step again gets the same code instead of a new one, and so you can see recent codes in your settings |
| A monthly count of codes made | For your plan's limit |
| Your plan and Paddle subscription ID | Billing |
What we don't store
We never receive or store your subscribers' email addresses, names or other fields. Kit sends us only subscriber ID numbers. We don't see card details: Paddle handles payments for our plans, and your own customers pay through your Stripe or Paddle checkout.
The codes we write into Kit custom fields (named like offer_code, offer_expires_at and offer_expires_text) stay in your Kit account and are covered by your agreement with Kit. Tell your subscribers in your own privacy notice that you send personal discount codes.
Who processes it
Cloudflare hosts the app and its database (United States). Paddle processes payments for our plans as merchant of record. Kit, Stripe and Paddle receive the requests needed to do the job: we ask Kit to save fields and ask Stripe or Paddle to create codes. We don't sell data, show ads or use tracking cookies. The one cookie we set keeps you signed in to your settings.
How long we keep it
Code records are deleted 90 days after the code expires. When you uninstall the app in Kit, we stop using your tokens at once and delete your account data within 30 days. Disconnecting a checkout deletes its key straight away. To have everything deleted sooner, email us.
Your rights
You can ask to see, correct, export or delete your data at tofulabs.apps@gmail.com. We reply within 30 days. If you're in the EU or UK you can also complain to your data protection authority.