AwardBroker privacy policy

Effective October 12, 2026.

AwardBroker is a website where members pass on travel awards, and a Chrome extension that connects a member's own Hyatt account to it. The extension reads the awards in a Hyatt account that is already signed in through Chrome. The member signs in directly on Hyatt; AwardBroker never asks for a Hyatt password.

Hyatt checks

After the member gives consent and grants optional access to hyatt.com, the extension makes fixed profile and award requests in an open Hyatt tab, or in one it opens briefly in the background. For each check it sends an allowlisted set of temporary Hyatt session headers over HTTPS to the AwardBroker verifier, hosted through Vercel and Modal. These authentication headers can grant broader Hyatt account access. The verifier uses them only for fixed, read-only Hyatt profile and award requests.

Session headers and full Hyatt responses are processed temporarily in memory. The application does not deliberately write them to extension storage, verifier records, analytics, or application logs. JavaScript cannot promise immediate erasure of every in-memory copy. Vercel, Modal, Hyatt, and their infrastructure providers process requests and ordinary connection metadata as part of delivering the service.

Hyatt session expiry

The extension uses Chrome's cookies API to read Hyatt's HttpOnly oscar sign-in cookie locally, after the member grants Hyatt access. It stops requests 60 seconds before the token's declared expiry or, if earlier, Chrome's cookie expiry. It reads the current cookie before each direct profile or award request. Page-driven checks and automated gift actions use the deadline captured at the start; the verifier also checks token expiry before each Hyatt read. This applies to sign-in watching, checks and gift preparation. It does not assume a fixed login duration or extend an old token's deadline when it is read again. If expiry cannot be determined or the deadline is reached, the member opens Hyatt normally to refresh their sign-in before retrying. Normal Hyatt navigation may refresh a token while the member remains signed in.

The expiry guard processes cookie and token contents temporarily. It adds no stored cookie values or authentication data transmission beyond the temporary session headers described above.

Use of data

AwardBroker does not sell personal data, use it for advertising, or use it for lending or credit decisions. The extension includes no advertising or analytics SDK. Data is used only to provide and improve the disclosed award checks and marketplace features.

Marketplace

The website at award-marketplace.vercel.app shows awards members offer to sell, and runs a live checkout between a buyer and a seller. Anyone can see the listed awards without an account. The local marketplace preview contains synthetic data only; it shows test sign-in codes and sends no email.

Signing in

Members sign in with a one-time code sent to their email address, with Google, or with Facebook. There are no AwardBroker passwords. Supabase Auth, operated by Supabase Inc., confirms the email address: it stores the account's email address, the sign-in methods used and sign-in timestamps, and sends sign-in code emails through the configured email provider. With Google sign-in, Google authenticates the user and shares the account's verified email address and basic profile with Supabase; AwardBroker uses only the email address. With Facebook, Facebook authenticates the user and shares the account's email address, name, profile photo and an identifier for AwardBroker with Supabase, which stores them with the account. When that Facebook account isn't connected to a member yet, AwardBroker uses its email address to find the member's account, or to create one, as it does for Google sign-in.

Member names and Facebook

Every member has an anonymous member name that AwardBroker makes up, such as Member 7KQ3. A member can connect Facebook, by signing in with it or from the account menu. AwardBroker then keeps their Facebook first name, the first letter of their last name, a copy of their Facebook profile photo, a keyed hash of the identifier Facebook gives AwardBroker, and the times they connected it and last signed in with it. It doesn't keep their full last name, the identifier itself or any Facebook access token, and it never posts to Facebook. Their Facebook email address is kept only if it is also their account's email address. A connected member's first name, last initial and photo replace their anonymous name. Anyone who visits the website sees these names and photos on listings, signed in or not, and in a checkout each member sees the other's. AwardBroker serves the photo copy from its own address, so visitors' browsers don't contact Facebook.

Marketplace records

Member records (email address, anonymous member name, sign-in times, the payment details a seller chooses to show their buyers, and a connected member's Facebook details and photo copy), listings, checkouts, check results and moderation records are encrypted by the AwardBroker service (AES-256-GCM) before they are stored in a Supabase-hosted Postgres database in the United States. The database stores only ciphertext with opaque record identifiers; the encryption key is held by the AwardBroker service, not by Supabase. Vercel, Modal and Supabase process requests and ordinary connection metadata as part of delivering the service.

Marketplace checks require a one-time consent in the extension, given in a small AwardBroker window before Chrome's own Hyatt permission prompt. The consent record (the marketplace address, the disclosure version and the time) stays in Chrome's extension storage until the member disconnects or removes the extension's Hyatt access; it survives browser restarts and extension updates. While a member uses the marketplace (opening the sell sheet, keeping a checkout open, or choosing a check), the website may ask the extension for a check; an open checkout page asks about every 30 seconds while it's visible. Each check temporarily sends the same limited set of Hyatt session headers described above to the verifier. Only fixed profile and award requests are made; the website does not receive those headers. If no Hyatt tab is open, the extension opens Hyatt in a background tab for that read and closes it afterwards; if Hyatt needs the member to sign in, it opens Hyatt's own sign-in page in a new tab and, while the member signs in, reads only the Hyatt profile in open Hyatt tabs to notice when the sign-in is complete. To show whether Hyatt is still signed in, the extension may read only the Hyatt profile in an open Hyatt tab, and it keeps the resulting state and the masked account (last four characters) in Chrome session storage. When a buyer shares their Hyatt details in a checkout, the extension reads the Hyatt profile in an open Hyatt tab (or in a background tab it then closes) and gives that page the buyer's first name, last name and full member number for that request only; the website sends them to AwardBroker, which keeps them with that checkout. Disconnecting does not delete earlier check results or a checkout's record.

Listed awards show the award's name, expiry date, price, when it was last checked, and who is selling: the seller's anonymous member name, or their Facebook first name, last initial and photo. They do not show email addresses, full Hyatt membership numbers or certificate numbers. Account bindings and certificate references are stored as keyed hashes; a seller may see a short certificate suffix to tell their own awards apart. Inside a checkout, the buyer sees the seller's payment details and the last four characters of the seller's Hyatt number. The seller sees the buyer's first name, last initial and the last four characters of their Hyatt number, and, only at the send step, the buyer's last name and full member number, to gift the award. Do not put passwords, card details or bank credentials in payment details.

Payment is arranged directly between members. AwardBroker does not receive payment credentials, hold funds, process refunds or infer payment from a member's confirmation. Members' own confirmations ("I've paid", "Payment received", "I received it") are kept apart from what Hyatt checks show. AwardBroker emails a seller once when a buyer is ready in their checkout, and both members when a checkout completes, through its email provider, Resend. These emails name the award and price and link to the checkout; they never include member numbers or payment details. No marketing emails are sent.

Gift preparation

When a seller asks for it in a checkout, the extension prepares the Hyatt gift in the seller's own Hyatt tab: it opens Hyatt's own "Gift Your Award" form on that award and fills in the buyer's membership number and last name, taken from the checkout's record on AwardBroker's server, never typed by the seller and never read from a web page. The seller reviews Hyatt's confirmation and presses Send Award themselves; the extension never sends a gift. It then notes what Hyatt showed after that click (that the gift was sent, an error code, or no result) and reports only that to AwardBroker. The gift request travels directly from the member's browser to Hyatt: the AwardBroker service never sends it and never holds the certificate code. If Hyatt asks for a code it emails the member, the member enters it; the extension does not see it.

Support chat

The marketplace website has a chat button for questions and feedback, provided by Crisp (crisp.chat). Crisp's chat loads only after you select the button, or in the background on a device that has used the chat before, so that replies can reach you. Crisp stores the messages and files you send and the details of your visit its chat needs (such as your IP address, browser and the page you're on), and sets a cookie on this website so a conversation continues across visits. When you're signed in, AwardBroker also gives Crisp your email address and member identifier, so we know who we're talking to. When you choose Need help? in a checkout, the chat also carries that checkout's identifier. Signing out starts a new conversation on that device. Don't send passwords, card details, bank credentials or Hyatt member numbers in the chat.

Product analytics

The marketplace website uses PostHog, provided by PostHog, Inc., to see how members use it and where they get stuck. PostHog's script is served from this website, and what it records goes directly to PostHog's servers in the United States.

On each visit it records:

• the pages you open, the buttons you press and what you search for in the listed awards;
• the steps you reach, such as signing in, adding the extension, connecting Hyatt, listing an award and each step of a checkout;
• errors the page shows and how fast pages load;
• your browser, device and screen size, and your approximate location from your IP address.

It keeps a random identifier in a cookie and in your browser's storage, so visits from the same browser are counted together. It also records sessions: what the page showed and where you clicked, so a visit can be replayed when something went wrong. Everything typed into a field is masked in those recordings, and your email address, payment details, Hyatt names, Hyatt member numbers and the support chat are left out of them.

When you're signed in, AwardBroker gives PostHog your member identifier, email address and member role. AwardBroker's server also tells PostHog about the marketplace steps you take, tied to your member identifier: signing in, connecting Hyatt or Facebook, listing, repricing or unlisting an award, and each step of a checkout with its award and price. It never sends Hyatt session details, payment details, Hyatt member numbers or sign-in codes.

If your browser sends Do Not Track or Global Privacy Control, the website doesn't load PostHog, so nothing about your visits is recorded; the server's records of marketplace steps still go to PostHog. PostHog keeps events for one year and recordings for 30 days. AwardBroker doesn't sell this data or use it for advertising. A deletion request (see Retention and deletion) also deletes your data in PostHog.

Facebook data

To remove your Facebook details from AwardBroker, choose Disconnect Facebook in the account menu. AwardBroker immediately deletes your stored Facebook first name, last initial, photo copy, the keyed hash of your Facebook identifier, and the times you connected and last signed in with Facebook, and your listings and checkouts show your anonymous member name again. Removing AwardBroker in your Facebook settings, under Apps and websites, stops Facebook from sharing anything new, but doesn't delete what AwardBroker already has; disconnect here as well, or email williezhou@gmail.com to have it deleted. Supabase keeps the details Facebook shared with your sign-in account until that account is deleted, which you can also ask for by email.

Retention and deletion

Marketplace records are kept while the member's account is active and while a checkout they are part of remains open, because the other member relies on its record. Automatic deletion is not yet in place. A member can ask for their account and personal details to be deleted by emailing williezhou@gmail.com; where another member's checkout record depends on it, personal details are removed or replaced and the minimal record needed for that checkout is kept. Sign-in sessions expire after seven days and unused sign-in requests after ten minutes. Infrastructure backups follow the providers' retention schedules.

The early-access waitlist has closed; sign-up is open on the marketplace website.

AwardBroker is independent of Hyatt. Questions and deletion requests can be sent to williezhou@gmail.com.