clover

I was watching a video, and partway through it broke for the sponsor. The sponsor was Honey.

Which is the whole thing in one moment. Honey pays creators to recommend it, people install it because someone they trust told them to, and then it sits in the browser waiting for a checkout. When a creator sends you to a shop through their link, they earn a small commission from the shop, not from you. Honey was accused of swapping that link for its own at the last second, so the commission went to Honey instead of the person whose video sent you there. In one test it took a thirty five dollar commission while the creator got eighty nine cents. Including on videos from the creators who advertised Honey in the first place. They get paid once for the ad, and lose the commission on every sale their own audience makes afterwards.

So it was never taking money out of shoppers' pockets. The coupon part works. It finds codes, it applies them, you save money. That part is fine. The part that is not fine happens afterwards, in a place you cannot see, to someone who is not you.

That seemed worth building the opposite of. Not a bigger coupon list, a more honest one. Codes visible instead of hidden behind a button. A count of who it actually worked for instead of a badge that means nothing. Codes that retire themselves when they stop working. Creator deals offered rather than swapped in, and not offered at all if somebody already sent you.

The part that still makes me laugh is that halfway through building this I watched another video, and the sponsor was Honey.

December 2024. Honey opened a hidden tab at checkout to claim credit for the sale, replacing the link of whoever sent you there. On one test the creator's link was worth thirty five dollars and Honey's rewards paid eighty nine cents. Partner shops could also tell Honey which codes to show, so a thirty percent code could be sitting behind a five percent one.

December 2025. The database held a hundred and eighty one thousand shops and only thirty five thousand had agreed to anything. Codes were taken from users and handed to strangers, including staff discounts and refund codes never meant to be public. Shops asking to be removed were reportedly told to become paying partners instead. The millions of codes in the advertising turned out to be roughly sixty two percent typed in by people.

Thirty days later. The part that matters most. Researcher Ben Edelman found Honey behaved differently when it thought it was being watched. It read other sites' cookies to work out whether you had ever logged into an affiliate dashboard, and if you had, it followed the rules properly. If you looked like an ordinary shopper, it did not. As Edelman put it, there is no reason for a shopping plugin to care about that, except to hide. A week after he published, the behaviour quietly disappeared from the settings.

Where it stands. Honey had twenty million Chrome users before the first video and was down to about fourteen million by July last year. In January the affiliate networks acted: Rakuten threw Honey out and cut it off from around two thousand shops, Impact and Awin suspended it days later. Then in May, Rakuten published a tool that makes standing down properly automatic, Honey installed it, and was let straight back in with no penalty. There are more than twenty class actions still going.

None of this needed a coupon site to be dishonest about coupons. It only needed one to be dishonest about everything around them.

The whole record, point by point →

A second video came out at the end of last year called The Honey Scam is Worse Than I Thought. It builds on research by Ben Edelman, who studies this kind of thing for a living, and the finding that stuck with me is about why nobody caught it sooner. The claim is that the extension could tell when it was being examined, and behaved differently when it was. If that holds up, it means the thing was not just quietly taking commissions, it was quietly avoiding the people who might notice.

There is also the question of what it was collecting while it sat there. Honey says it only gathers data on shopping sites it supports, that none of it identifies you personally, and that it never sells any of it. A German privacy group tested that in 2020 by having two members request their own data under GDPR, which is a right you have and almost nobody uses. What came back did not match the policy. They found browsing history collected at scale, with timestamps, location and the addresses of pages visited, all tied to a user id, including for someone who had never even made an account. They filed complaints with the data protection authorities. Around the same time Amazon put a warning on its own site saying the extension tracks your private shopping behaviour and can read or change your data on any website you visit, and told people to uninstall it. Amazon had its own reasons to say so, PayPal having just bought Honey for four billion dollars, but the warning was specific rather than vague.

The other half of the story is what the founder did afterwards. Ryan Hudson co-founded Honey, sold it to PayPal for about four billion dollars in 2020, and left in 2022. He then started Pie, an ad blocker that blocks ads and pays you cash for the ones you choose to let through. It passed a million users within months. The company later spun out an ad network for AI chatbots called ZeroClick, which raised fifty five million dollars from a lot of the same investors who backed Honey.

Two details are worth knowing if you use any of this. Pie also ships a shopping extension that applies coupons automatically and runs a cashback programme, so the person who built Honey is building coupon software again. And during setup, Pie offers to switch off your other ad blockers for you. Click the button and uBlock Origin, AdGuard and Adblock Plus are gone.

The part that surprised me most was the size of the thing. Honey sold itself as scanning millions of codes from across the internet. When people went through the actual database, that turned out not to be the picture. Most of the codes were not scraped from anywhere clever. Around sixty two percent came from users and from people typing them in by hand. The database listed a hundred and eighty one thousand shops, but only thirty five thousand of those had any agreement with Honey at all, which means around a hundred and forty six thousand shops were in there without having agreed to anything. Some of the codes were never meant to be public either, staff discounts and refund codes and one off promotions, and shops that asked to be taken out were reportedly told they could leave by becoming a paying partner.

So the enormous coupon library was, to a large extent, other people's codes. Collected from users, presented as a vast machine that went out and found deals for you. Clover has a few hundred codes across a few dozen shops, and the number at the top of this page is counted from the list rather than typed in. It is small and it is real, and every one of them can be read without clicking anything.

Clover takes none of this. There is no account, no analytics, no server to send anything to. The extension reads the checkout page you are already on, looks at the promo box and the total, and that is the end of it. The little shop marks on this page are drawn here on your machine rather than fetched from an icon service, because fetching them would tell that service every shop you looked at.

I am not going to tell you Pie is doing what Honey did. I do not know that, and there is a difference between a pattern and a proof. What I will say is that an extension which can turn off the tools you installed to protect yourself is worth reading carefully before you install it, whoever built it. That goes for Clover too. It is why the code is all in one file you can open and read.