Partner program

The terms

Commission

35% lifetime, 50% at volume

35% of net revenue from every user you refer, for as long as they keep spending. 50% while your trailing-30-day attributed net revenue is at or above $1,000. Promotion is automatic and forward-only.

What "net" means

Settled revenue

What the processor pays us: the customer’s payment less processor fees, refunds and chargebacks. We would rather publish a smaller number against a base you can check than a bigger one against a base we never define.

Cookie window

90 days, then lifetime

A click sets a 90-day cookie. Whoever’s cookie is present when the account first binds holds that user for life — the window decides how long a click stays live, never how long you get paid. Of the seven programs in this category we surveyed, one publishes its window at all.

Rate changes

Never retroactive

Your rate is stamped onto the commission when it is earned. Crossing the volume threshold does not re-rate what came before it, and neither does a change to the published card.

Payouts

Weekly, $50 minimum

First payout held 14 days. Cash-flow speed matters more than a headline rate to everyone except the largest partners, and it is the term most programs in this category are worst at.

Clawbacks

The affected transaction only

A refund or chargeback reverses that one commission at the rate it was paid. No rolling reserve, ever — the standard complaint about adult networks, and the cheapest term on this page to get right.

Tracking

Sub-IDs and signed S2S postback

Pass s1, s2 and s3 on any link and they come back on every report. Server-to-server postback on signup and on commission, HMAC-signed with a secret that is yours alone, so you can tell our hits from anyone who has learned your postback URL. Deep-link to any page with ?to=.

How the volume rate works

Your rate is decided per commission, from your net revenue over the previous 30 days. Cross $1,000 and everything from that point earns 50%. Fall well below it and you go back to 35% — with a gap between the two thresholds, so a week spent hovering at the line does not flip your rate between individual transactions. Neither direction touches a commission already earned.

Verifying a postback

Every postback carries a sig parameter: an HMAC-SHA256 over the rest of the query string, keyed with a secret that is yours alone. Your postback URL travels through ad networks, browser history and your own support tickets, so anyone who has seen it could otherwise write conversions into your reporting. Check the signature and they cannot.

1. 1Parse the query string of the request you received into decoded name/value pairs, the way your framework already hands them to you, and drop the sig parameter. Everything else is signed — the fields we add and the ones that were already in your own postback URL. Work from the decoded pairs, not from the raw string: something between us may re-encode a character on the way, and re-encoding it yourself in the next step is what makes that harmless.
2. 2Percent-encode every remaining name and value to RFC 3986: only A–Z, a–z, 0–9 and - . _ ~ survive, and every other byte of the UTF-8 becomes %XX in uppercase. That is PHP rawurlencode, Python quote(safe="-._~"), Ruby ERB::Util.url_encode. It is not http_build_query and not JavaScript encodeURIComponent — both differ on characters you will eventually see in a sub-ID.
3. 3Write each pair as name=value, sort those strings byte-wise ascending, and join them with &. Sort them yourself rather than trusting the order they arrived in: your framework hands your handler a dictionary, and we make no promise about wire order.
4. 4Prefix that with the literal v1 and one newline (0x0A). Everything above is now the string to sign.
5. 5HMAC-SHA256 it with your secret, render the digest as lowercase hex, and compare it against sig with a constant-time comparison. The key is the 64-character secret exactly as we gave it to you — do not hex-decode it first. It looks like hex because it is easy to paste, not because it is meant to be turned back into 32 bytes.

secret   6f1d2c3b4a5968778695a4b3c2d1e0ff00112233445566778899aabbccddeeff
string   v1\namount=12.50&event=commission&ref=goodsite&s1=fall%20promo&ts=1788160000&txn=t-42&uid=fe40c8c0efd61bdf91533fa264c59420
sig      6081e824191224317221323b766511889f4ff3230e906a0542aac6d636fde518

ts is unix seconds and is inside the signature, so it cannot be edited without breaking it. A valid signature proves the request was ours, not that it is fresh — reject anything more than a few minutes off your own clock, and dedupe commissions on txn, which we send for exactly that.

Your secret is shown once, at the moment it is generated. We cannot read it back and neither can any of our dashboards. Lost it, or think it leaked? Ask for a rotation: the next postback is signed with the new secret and the old one stops verifying at that moment.

Traffic we will not accept

• Incentivized traffic, bots, or anything that pays a person to sign up.
• Bidding on our brand terms in paid search.
• Unsolicited email, SMS, or messaging spam.
• Any creative implying a real, identifiable person — every likeness on Flirtly is synthetic, and a partner’s creative may not say otherwise.
• Any creative that is minor-coded, or placed where the audience is not adults.

The last two are not house style. Every likeness on Flirtly is synthetic and always will be, and that is the thing the whole product is built around — a partner’s creative is the one place someone else could contradict it. Breach either and the account is closed and the balance forfeit.

Questions

How much does the Flirtly affiliate program pay?

35% of net revenue for the lifetime of every user you refer, rising to 50% while your trailing-30-day attributed net revenue is $1,000 or more. Net means settled revenue after processor fees, refunds and chargebacks.

What is the cookie window?

90 days, last click. After an account binds to you it stays yours for life regardless of the window.

When do partners get paid?

Payouts are not live yet. Flirtly has no checkout: the compliance gate that has to clear before the product takes a card also gates partner payouts, and we would rather say so on this page than accrue against a dashboard that implies otherwise. Commissions accrue from your first referred user and are paid from the day payouts open.

How do I join?

Apply with what you run. Applications are reviewed by a person — the program is not self-serve, because an instantly-live link is an instantly-live way to spend our inference budget on bots.