Todin is a product of Tojago B.V., August De Feyterstraat 53, 1740 Ternat, Belgium — the data controller. Contact: privacy@todin.be. This page covers todin.be, todin.app and the Todin browser extension.
When you create an account or sign in — on our website or in the extension popup — we collect your email address, first and last name, an automatically generated username, the account creation timestamp, a unique UUID, and an optional referral code.
When you sign in with an email address and password, we collect and process that password. It is transmitted over an encrypted HTTPS connection and is never stored in readable form: it is stored only as a salted cryptographic hash, which cannot be reversed. We cannot see, retrieve or disclose your password, and it is never shared with any third party. In the extension the password is held only for the duration of the sign-in request — it is never written to browser storage and is never exposed to the websites you visit. If you sign in with Google or Apple, no password is collected by Todin at all.
After sign-in we issue a session token and a refresh token so your password need not be resent. In the extension these are stored locally in chrome.storage.local. The extension can also read the token and refresh_token cookies Todin sets on todin.app, so a session started on our website carries over; it reads no other site's cookies.
The extension retrieves your Todin wallet and reward balances from api.todin.app and caches them locally for display.
The extension runs a content script on the sites you visit. Its only function is to compare the current site's hostname against the Todin partner catalogue, locally inside your browser, against a pre-downloaded catalogue. We do not transmit your browsing history, the pages you visit, or their content to Todin. The extension contacts our servers about a site only when it is a Todin partner store.
To authenticate you, display cashback rates on partner stores, show your wallet balance, and attribute qualifying purchases so rewards can be credited. When you click “Activate rewards”, the extension routes that tab through a Todin tracked affiliate link carrying a per-user tracking identifier, so the purchase can be attributed to your account. This only ever happens after that explicit click — Todin never follows a tracked link on your behalf.
Todin participates in affiliate programs. We earn a commission from partner stores when you shop through an activated Todin link, and we share that commission with you as cashback. This is how the service is funded.
| Location | What is stored |
|---|---|
| Locally in your browser | Session and refresh tokens, cached account info, cached wallet balances, the partner catalogue, per-store activation state. Never your password. |
| Todin servers (Tojago B.V., api.todin.app, EU) | Account data, salted password hash, wallet and reward records. |
| Party | What is shared | Why |
|---|---|---|
| Tojago B.V. (our own infrastructure) | Account data, wallet and reward records | Operating the service |
| Affiliate networks: AWIN, Impact (impact.com), Tradedoubler, TradeTracker | A per-user tracking identifier and click data — no name, email or password | Attributing purchases so cashback can be credited |
| Google Analytics (website only, with consent) | Anonymised usage statistics | Improving the website |
We do not sell your personal data, and we share no data with advertisers.
| Permission | Why |
|---|---|
storage | Store your session tokens and cached catalogue locally |
cookies | Read the Todin session cookie on todin.app so you need not sign in twice |
alarms | Refresh the partner catalogue periodically |
activeTab | Identify the store you are currently viewing |
| Access to all websites | Required to detect whether the site you are on is a Todin partner store. This access is used only for that hostname comparison — never to read or collect page content on non-partner sites. |
It does not sell your data, inject advertising, modify page content other than showing the Todin rewards card, track your activity on non-partner websites, or store your password.
Account data is retained while your account exists. Locally stored tokens and caches are removed when you sign out or uninstall the extension. Under the GDPR you have the rights of access, portability, rectification, erasure, restriction, objection, and to lodge a complaint with the Belgian Data Protection Authority. To exercise any of these, contact privacy@todin.be.
The full GDPR policy, including cookies and legal bases, is available at todin.app/privacy.