Privacy and terms

In short

• No account is needed to read the site, use the tools or call the API.
• We store what you send us (an email to subscribe, a form, an API key request) and nothing is sold or shared for advertising.
• Google Analytics counts page views and a few interactions. In the EEA, the UK and Switzerland it runs without cookies. There is no cookie banner; blocking it does not break anything.
• Your My free AI list, compare picks and theme stay in your browser.
• To delete anything, email contact@aifree.dev.

What we store, by feature

Only when you use the feature. Everything is kept in our database (PostgreSQL hosted by Supabase).

Email newsletter and alerts

Your email address, the topics and digest frequency you pick, language, a confirmation token and an unsubscribe token, and timestamps. Double opt-in: nothing but the confirmation email is sent until you click it.

Kept: "Unsubscribe from everything" turns sending off and removes your topics; the address stays marked as unsubscribed so it is never mailed again. Ask us to delete it completely.

Browser push notifications

The push token your browser's Firebase Cloud Messaging service gives us, your chosen topics, only the browser and operating system family such as "Chrome/Android" (for debugging; no version, device or full user-agent string), and when it was created and last seen.

Kept: Deleted when you turn notifications off here or when Firebase reports the token as no longer valid.

Free API key

A SHA-256 hash of the key (the key itself is shown once and never stored), its first 8 characters, the label you choose, an optional email for deprecation notices, request counts per day and route, last use, and any webhook URL and signing secret you add.

Kept: Until you ask us to delete it. Revoking a key in the account console stops it working but keeps its usage history.

Submit an offer, report a change, report a scam, propose a comparison

What you type, the optional email you leave, and for the first three a truncated SHA-256 hash of your IP address and user agent so repeat spam can be grouped. The raw IP is not stored.

Kept: Kept for the review history. An email you leave on the submit form is used once, when the offer goes live, and never added to a list.

"Still works?" votes

The offer, your vote and a salted SHA-256 hash of your IP address and user agent, so one browser counts once per offer. Only the totals are public.

Kept: Kept with the offer; a new vote from the same browser replaces the old one.

Ask aifree

The question text (no account, IP or cookie attached), the generated answer and its cost. Questions are sent to Anthropic to generate the answer.

Kept: Answers are reused for 24 hours; the row stays as a cost record.

Claim clicks and the eligibility quiz

For a click on an offer's claim link: the offer and which part of the page it was on, with a timestamp. For a finished /unlock quiz: the answers and the computed result. No IP address, user agent or cookie is stored with either.

Kept: Kept as anonymous counts.

Explain lesson answers

For each question you answer in an English /explain lesson: the lesson, the question and whether the answer was right, added to a daily count. No IP address, user agent, cookie or visitor id is stored.

Kept: Kept as anonymous daily counts.

Stored only in your browser

These use your browser's local storage and never reach our server: the My free AI tracker and its requirement checklist, offers picked for comparison, light or dark theme, your time zone on the DeepSeek peak-hours tool, whether you dismissed the push prompt or a claim reminder, and the API key you choose to save in the account console. A shared /my/card link carries only offer names (slugs). The calendar export on /my is built in your browser.

Cookies and analytics

• Google Analytics 4 receives page views and these events: claim clicks, site searches (including the words you search for on aifree.dev), filters, subscribes, snippet copies, shares, the quiz, tracker changes and list shares, each with the offer and the part of the page. Email addresses and long numbers typed into a search are replaced before they are sent. Google receives your IP address with every request, as with any site you load from Google.
• In the EEA, the UK and Switzerland Google Analytics runs in Consent Mode with analytics and ad storage denied: it sets no _ga cookie and only sends cookieless pings with no visitor ID. There is no banner and no setting to turn cookies on there. Google decides the region from your IP address.
• Everywhere else Google Analytics sets its own cookies (_ga) to count returning visits.
• Admin session: the aifree_session cookie is set only for the site's editors when they sign in.
• aifree.dev sets no other cookies itself. Cloudflare may set its own security cookies when it checks traffic or runs Turnstile.

Spam protection, rate limits and logs

• Cloudflare Turnstile checks that a person is sending the forms that write data (API key, votes, submit, report a change, scam report, comparison proposals, editor sign-in). Cloudflare receives your IP address and browser signals for that check, and we pass your IP address to Cloudflare when we verify the token.
• Rate limits count requests per IP address in the server's memory for between a minute and a day. These counters are never written to the database and disappear when the window ends or the server restarts.
• Cloudflare sits in front of the site as a CDN and firewall, and our server keeps ordinary process logs; both see request data such as IP address, user agent and URL.
• Sentry receives error reports (the page, browser, error and stack trace) and a sample of performance traces. It is set not to send personal data, and session replay is off.

Services that process data for us

• Supabase: database hosting.
• Cloudflare: CDN, firewall and Turnstile.
• Resend: sending confirmation, digest, alert and submission emails.
• Google Firebase Cloud Messaging: delivering push notifications.
• Google Analytics: usage statistics.
• Sentry: error monitoring.
• Anthropic: answering Ask aifree questions and reviewing changes on providers' public pricing pages (no visitor data in the latter).
• Telegram and Discord: if you message our bot or use its commands, the platform delivers the message; we answer it and do not store it.

We do not sell personal data and do not share it for advertising. Claim links go straight to the provider; we add no affiliate tracking of our own.

Your choices and deletion

• Email: every email has a one-click unsubscribe link and a link to manage topics; you can also ask us to delete the address.
• Push: turn notifications off with the bell; the token is deleted.
• API key: revoke or rotate it in the account console; email us to delete it with its usage.
• Anything else (a form you sent, a vote, a subscriber record): email contact@aifree.dev from the address involved, or say which item it is, and we delete it and confirm by reply. Requests are handled by a person.
• Browser-only data: clear this site's storage in your browser.

Terms of use

• The catalog, the report and the API data are published under CC BY 4.0: reuse them, including commercially, with a credit and a link (see the press & link kit).
• Offers belong to their providers. We check each one, but terms change without notice: the provider's own page and terms of service are what count when you sign up. aifree.dev is provided as is, without any guarantee that an offer is available, accurate or suitable for you.
• aifree.dev is independent and not affiliated with the providers it lists. Listing is free and placement is never paid for.
• Please respect the API rate limits and do not use the forms to send spam, personal data of others or automated submissions; we may block keys or addresses that do.

Changes and contact

When what we store changes, this page changes with it and the date at the top moves. Questions or requests: contact@aifree.dev.