Privacy policy

2. What we do with it

Run your account, credit your points, moderate your reviews and send the account emails you need, such as sign-in codes. Aggregate, anonymous statistics help us improve the site.

3. What we never do

Sell or rent your data. Share your name, email or proofs with a prop firm. Use advertising cookies. Send promotions you did not opt in to.

4. Who sees it

PFR staff with a need, our email provider Resend, our payment provider for cashback, and our hosting provider. Each provider is under a data-processing agreement. Resend stores customer data, including message content and delivery logs, in the United States. The region email is sent from does not change that storage location. Firms see your published review with its byline (first name and initial), never your email or proof.

5. Your rights

To get a copy of your data, or to object to, correct, restrict or delete it, write to privacy@propfirmsranking.com. To request a copy of your account data or ask to delete your account, open Your data in Settings. Available downloads and the status of your requests appear there. To object to, correct or restrict the use of your data, or ask a privacy question, write to privacy@propfirmsranking.com from the address on your account. You can withdraw any of your reviews yourself from My reviews. The PFR extension has its own download and delete controls (section 7).

6. Retention

Account data until the account is deleted. PFR’s clean-up removes the IP address and location from click analytics older than 13 months, and the personal details of newsletter, quiz and waitlist sign-ups 24 months after they unsubscribe. A withdrawn review leaves public pages immediately.

7. The PFR browser extension

The PFR extension for Chrome, Edge and Brave works on its own on the prop firms PFR lists, where it reads their checkout and order-confirmation pages, and on another prop firm’s site only when you click the PFR button there. On listed firms’ other pages PFR may show a small hint, at most once a week per firm. The icon changes on sites in PFR’s public list; nothing is read or sent. Before you allow, PFR only checks on your device whether a listed firm’s page is a checkout, so it can ask at the right moment. Nothing is sent: PFR only notes on this device when it asked, and when another site’s referral link brought you, so it doesn’t ask again too soon or get in that site’s way. What it keeps (settings, paused sites, when it last showed a hint, a cache of your saved firms and PFR’s public list of other prop firms) stays on your device and is never synced. Before you allow, it keeps only when it asked you (by firm, and by site for the visit, never a page’s address), your “Not now” answers until you allow, and a 24-hour note when another site’s referral link brought you, so it stays out of that site’s way.

On a listed firm’s checkout it reads the plan, price, code field and total. On each visit it sends PFR the checkout’s host and path (never the rest of the address) and the plan name, size and price it read, to find that plan’s rules and codes; when you open PFR on one of the firm’s other pages, only its host. These lookups carry no account, token or ID; PFR counts them per firm and per day. A code you type is compared on the page and never saved or sent.

If you turn on “Offer to claim points after a purchase”, it reads the order number, plan, size, amount, code, date and time on the firm’s order-confirmation page, and sends them only when you press Send claim, to credit points to your PFR account.

If you connect your PFR account, the extension keeps a connection token for that browser and shows your name, points and saved firms. PFR stores only a hash of the token and of the random install ID your browser made for the connection. You can disconnect in the extension or in Settings › Security › Connected apps.

With “Offer help on prop firms PFR doesn’t list” on (agreeing in the extension turns it on; you can turn it off in its settings), clicking the PFR button on another site checks that page’s address on your device against PFR’s public list of prop firms, which the extension downloads every hour with no account, token or ID. A firm on that list shows the codes it publishes on its own pages, marked “Not reviewed by PFR”; PFR earns nothing from them. For a prop firm PFR doesn’t know, the extension sends only the site’s name (for example example.com), and only when you press “Look for this firm’s own codes” or “Suggest this firm to PFR”. PFR then reads that firm’s public homepage for codes it publishes, and may check the site and, if it is a prop firm, add an Unlisted page about it (section 9). That request carries no account, token or ID, and is never shown, counted publicly or used to contact the firm.

If you turn on “Share code results” (off by default), it sends which codes PFR suggested applied, under a random report ID that is never linked to your account or install ID, and per-firm counts of which PFR parts you open, with no ID and no time of day. When you click “Tell PFR this page changed”, it sends a fingerprint of the page’s structure, never its content.

It never reads a site PFR doesn’t list unless you click the PFR button there, never reads your browsing history, and never reads passwords, card details, your name, email or address.

In the extension’s settings, Data and privacy has Download my extension data (what it keeps on this device) and Delete my data, which clears this device and deletes the code results sent under this browser’s report ID. Your PFR account and points stay.

Retention: code results and layout reports from listed firms are deleted after 90 days. A browser’s connection is deleted 30 days after it ends (you disconnect it, or it goes unused for 90 days). Answers to the short question PFR asks after you remove the extension are kept for 365 days. Daily per-firm counts hold no person and are kept. Claims you send are account data (section 6). For prop firms PFR doesn’t list, the answer to a look-up is kept for 1 hour, the daily count of requests per site name and results for 90 days, and the emails firms send to remove or add their own codes for 180 days. Connect links expire after 10 minutes and are cleared within two days, as are the keyed hashes of network addresses PFR uses to limit requests.

8. Limited Use

The use of information received from the PFR extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

PFR uses it only to show a listed firm’s rules, prices and codes on its checkout, to show the codes another prop firm publishes itself when you click PFR there, to try codes when you click, and to credit points for purchases you claim. It is never sold, used for advertising or used to decide credit. Listed firms see only totals for their own checkout, such as how often the panel showed, never anything about you. Site names members ask about and results on firms PFR doesn’t list are never shown to firms. PFR may use aggregate request counts to prioritise internal reviews of potential partner programmes. These totals contain no person or page address. How many days members asked about a site may decide how soon PFR’s robot checks it; PFR never tells the firm. People at PFR read a claim you send only to review it, and see other extension data only as totals.

9. Prop firms PFR finds, and firms’ requests

To find new prop firms, PFR reads public certificate-transparency logs and, where PFR has accepted a list’s terms, lists of newly registered domain names. It keeps only names that look like a prop firm’s, drops the rest at once and never collects WHOIS contact details. For each possible prop firm, PFR’s robot reads robots.txt, the homepage and at most a few more public pages (PFR’s robot page lists them); PFR keeps facts and fingerprints from them, never the page text. A site that isn’t a prop firm is kept as a name for 30 days, then only as a one-way fingerprint for 365 days so it isn’t read again; sites waiting for a later look are kept up to 180 days, check records 180 days, and the robot’s log of each request (address, time and result, no content) 90 days.

An Unlisted page shows business information from the firm’s own website. Where a firm is one person trading under their own name, some of it can be personal data, and this section is the notice Article 14 of the GDPR asks for: PFR publishes it on the basis of its legitimate interest in showing traders which prop firms exist and what they say about themselves (Article 6(1)(f)), names no other person and, as soon as the person asks through “Ask PFR for a change” (personal details), hides the legal entity, social links and quoted description on the page; the page keeps the firm’s name while PFR’s team decides. Facts on a page are deleted 12 months after the page is taken down, unless a legal hold applies.

When you ask PFR to check a website from its search, or enter one in the Unlisted directory, PFR receives only the site name. It counts requests per site and day, keeps those counts for 90 days and keeps no account, device ID or network address with them; the keyed hashes of network addresses that limit how often anyone can ask are cleared within two days. A site name the PFR extension sends (section 7) is handled the same way. Your request is never shown, counted publicly or used to contact the firm.

When a firm adds itself, PFR keeps the firm’s name, its website and the work e-mail address given to confirm it. A submission nobody confirms closes after 30 days, and the e-mail address is deleted 180 days after a submission closes.

When someone claims a firm’s page, PFR keeps the claim with their PFR account, the domain, the proof they chose and, for the e-mail code, the work address it went to; the code itself is kept only as a keyed hash, works for 15 minutes, and PFR’s copy of the e-mail that carried it is deleted a day after it is sent. A check of the file or the tag on the firm’s site is one robot request, logged for 90 days. A claim waiting with no new proof for 60 days and no check for 30 days is closed; the claimant’s work address and the proof records are deleted 180 days after a claim closes, and kept while the claim holds the page.

A firm’s request about its page (“Ask PFR for a change”) needs a work e-mail address at the firm’s domain. PFR keeps it with the request, the message and the evidence link while the request is open and for 180 days after it closes (3 years for a legal notice); after that only the decision record stays: the kind, the domain, the outcome, the dates and who at PFR decided. A request nobody confirms closes after 30 days.

PFR’s own copies of the e-mails it sends for these requests, in its mail queue and its mail log, are deleted on the same schedule, counted from the e-mail: 180 days (3 years for a decision on a legal notice). A copy that carries a code or a single-use link is deleted a day after it is sent, or once the link has expired if it was never sent.

To date a firm’s domain, PFR may look it up in the public domain registration database (RDAP). It keeps only the registration and expiry dates, the registrar, the status and the name servers, never names, e-mail addresses, phone numbers or postal addresses, and refreshes them once they are 90 days old.

You can object to any of this, or ask for a copy, a correction or deletion, through “Ask PFR for a change” or by writing to privacy@propfirmsranking.com.

10. Firms’ own pages PFR reads, and what changed

As PFR’s rule & price reader, PFR’s robot reads the public pages of the prop firms PFR lists and of those with an Unlisted page: their prices, rules, help centre and FAQ, terms, and payout and refund policies (PFR’s robot page says what it reads, how often and how to stop it). These pages are about the firms’ business, but they can name a person, such as a support agent who signed a help article.

PFR keeps a private, dated copy of the text of each version of a page, to read its facts, see what changed and quote it. Before a copy is stored, e-mail addresses, phone numbers and social media handles are masked; names and postal addresses are not, and the page as PFR received it (its HTML) is kept unmasked for 30 days, unless it is the evidence of a change PFR published (then as long as that version, below). Only PFR’s staff see the copies. PFR keeps the current and the 2 previous versions of every page, other versions for 180 days, and a version that is the evidence of a change PFR published for as long as PFR shows that change and 3 years after.

An AI model reads the stored text, through PFR’s AI provider, to find the facts in it. It gets only the firms’ public page text, never anything about PFR’s members, and every fact it finds must quote the exact sentence it came from. When the model runs through OpenRouter, PFR asks only for providers that don’t store or train on what they read. PFR keeps a record of each AI request (what it was for, the model, its size and cost, and the facts it returned with their quotes, never the page it read) for 13 months, then only monthly totals, and facts read from a page that were later replaced or turned down are kept for 13 months. The robot’s log of each request (address, time and result, no content) is kept 90 days, or 30 days for a page that hadn’t changed.

PFR compares each new version with the one before to find changes to a firm’s prices, rules and FAQ. What it finds is kept for 2 years (180 days for what PFR dismissed as noise). Once PFR shows changes publicly, a published change shows the before and the after, each at most 300 characters quoted from the firm’s page with the link and the date, and stays in PFR’s change history, with PFR’s corrections marked.

A firm can stop PFR’s robot reading its site with robots.txt or a request (PFR’s robot page says how). You can object to any of this, or ask for a copy, a correction or deletion, through “Ask PFR for a change” or by writing to privacy@propfirmsranking.com.