Auto-Postback — Privacy Policy

Last updated: 15 October 2026

Auto-Postback (“the extension”) is published by Aff Labs. This policy describes every piece of data the extension touches, why it touches it, and where it goes.

The short version: the extension has no server. Nothing it reads is transmitted to us, to an analytics service, or to any third party. It works inside the partner’s own browser, and the only sites it sends requests to are two the partner is already logged into: their affiliate cabinet and, for a Keitaro user who asks for it, their own Keitaro.

What the extension handles

1. Website content

The extension reads pages in three places, each tied to a setup the partner has started.

In the affiliate cabinet (pocketpartners.com, gamechange.partners, and their subdomains) the wizard is part of the page: the browser loads it on every cabinet page, as the extension’s manifest declares, and it shows its panel there until the partner closes it. Once the partner has started a setup and reached the cabinet step, it reads the postback creation form: the form’s address, its CSRF token, the list of campaigns on the account, and the campaign link shown in the page’s link preview; and, from the cabinet, the parameters each conversion event can carry. These are the fields a person would otherwise fill in and submit by hand on that same screen.

When the partner asks for a new campaign rather than an existing one, it also reads the options of the cabinet’s campaign form — the link types, campaign types and offers the account can choose from, and the account’s own promo codes — the way the cabinet’s Links page fills that form. Once the campaign is created, it reads the new campaign’s id and tracking link from the cabinet’s reply.

A partner who comes from the Postback Bot’s page arrives at the cabinet with their Postback Bot links in the page address, after a #. The wizard reads them from there, removes them from the address bar at once, and treats them as if the partner had pasted them (see 3). The part of an address after # is never sent to the cabinet’s server.

On a tracker tab it reads two things, and only after the partner has told the wizard which tracker they use: the address in the browser’s address bar, and the tracker’s postback key. The key is taken from the page’s own configuration object; if it is not there, the visible text of the page is searched for a postback receiver address already displayed on it. To tell that the tab is that tracker, it checks a few of the page’s own markers, such as its title and the names of its scripts, and keeps none of them. Before the partner has named their tracker, no page outside the cabinet is inspected at all.

On the partner’s own Keitaro, for the offer step (see 4), it reads the names and ids of the offers already there, and, if one of them has the same name as the offer it is about to create, that one offer’s URL. It reads them once, only to avoid creating a duplicate, and does not keep the list.

Outside the affiliate cabinet, nothing is read on any tab the partner has not clicked the extension’s icon on.

2. Authentication information

The tracker’s postback key — the secret segment of the tracker’s receiver address — is stored in the browser’s local extension storage so the wizard can compose postback URLs from it. It is written into the postback URLs created in the partner’s own affiliate cabinet, which is its purpose. It is sent nowhere else.

Where the tracker keeps an API key alongside the postback key in the same configuration object, the extension does not read it. The postback key is matched specifically and the API key is excluded. The extension never reads the partner’s Keitaro password, session cookie or API key.

3. Configuration the partner enters

The tracker choice, a receiver address typed by hand, Postback Bot links pasted into the wizard or handed over from the bot’s page, the selected conversion events, the campaign selection, and, for a new campaign, its name, link type, promo code and, for a CPA or Hybrid campaign, its offer. Held in local extension storage so that moving between the tracker tab and the cabinet tab does not lose the partner’s place.

A Postback Bot link carries the partner’s personal token for the bot. The link is the address the postbacks are sent to, so it is written into them, and it goes nowhere else.

The wizard also keeps what it has created in the current setup — the new campaign’s id, name and link, and the outcome of the Keitaro offer step with the offer’s id — so that repeating a step finds what already exists instead of creating it twice.

4. What the extension creates

The extension writes in two places, and only when the partner asks it to.

In the affiliate cabinet it creates the postbacks the partner reviewed: every postback URL is shown in full on the review screen before anything is created. When the partner asks for a new campaign, the same confirmation first creates that campaign, with its tracking link, so the postbacks have a campaign to belong to. That request carries the campaign name the partner typed, the link type, the promo code they chose or none, and, for a CPA or Hybrid campaign, the offer they picked.

In the partner’s own Keitaro it creates one offer, and only when, after a setup, the partner clicks the extension’s icon on a tab of their own Keitaro admin; a click anywhere else creates nothing. The offer’s name is the campaign’s name in the cabinet, and its URL is the campaign’s tracking link with &click_id={subid} appended, so that every visit Keitaro sends carries its own click id. The offer is created with a placeholder payout of 0 USD; a real payout, if the partner wants one, is set in Keitaro by them. If an offer with that name already points at the same URL, it is reused and nothing is written; if it points elsewhere, the partner is told and nothing is written. The extension never edits or deletes an offer.

5. The cabinet and Keitaro sessions

The cabinet session. Requests the extension sends to the affiliate cabinet carry the browser’s existing cookies for that site, exactly as the cabinet’s own pages do; the ones that submit a form also carry the page’s CSRF token, as the cabinet’s forms do when the partner presses SAVE. The extension does not read, copy, store or transmit the cookie itself; the browser attaches it.

The Keitaro session. The offer requests are made from the Keitaro admin page itself, on the same origin, so the browser attaches the partner’s existing Keitaro session cookie to them as it does to the admin’s own requests. The extension does not read, copy, store or transmit that cookie, and without a logged-in Keitaro admin tab no offer is created.

Where the data goes

Nowhere outside the partner’s browser, except to two places the partner is already logged into. Every request goes to the same origin as the tab the partner has open, and each is a request that site’s own interface already makes.

The extension contacts no server operated by us. It contains no analytics, no telemetry, no crash reporting, no advertising code and no third-party SDK of any kind. It loads no remotely hosted code: every line it runs ships inside the package.

The Postback Bot page

One file in the extension, a two-line stylesheet, is made loadable by pages on partner-bot.affpartners.io, the Postback Bot’s own site, and by no other site. The bot’s hand-over page loads it to tell whether the extension is installed, so that it can show the right next step. All that page learns is that the stylesheet loaded: the extension does not run on that site, reads nothing there and sends nothing to it.

Retention and deletion

Everything named above lives in the browser’s extension storage, on the partner’s own device. We hold no copy, because we never receive one.

Uninstalling the extension erases all of it. Postbacks, campaigns and the offer the extension created belong to the partner’s cabinet and Keitaro, like anything created there by hand, and are managed there.

What we do not do

Changes

If the extension’s data handling ever changes, this policy is updated before the change ships and the change is described in the extension’s store listing.

Contact

dev@affpartners.io