Why Your Promo Codes Vanish in Four Seconds

You post: "10 codes for my new app, first come first served!" with the codes in plain text.

Four seconds later every one is redeemed. You have no new users you can name, no feedback, no email addresses, and a reply guy asking if there are any left.

Nobody who follows you got one.

---

What actually took them

App Store and Google Play promo codes have a recognisable shape — fixed-length alphanumeric strings, often in a predictable format. That makes them trivially matchable with a regular expression.

There are accounts and scripts whose entire function is to watch X, Reddit, and Discord for text matching that pattern and redeem anything they find. Some resell the results. Some are hobbyist scrapers. Either way, they are polling continuously and they redeem in the time it takes you to switch tabs.

You are not competing with your followers for those codes. You are competing with software that never sleeps and reads faster than any person.

---

Why the usual workarounds do not work

"I'll post an image of the codes instead." OCR is a solved problem and has been for years. This buys you seconds.

"I'll break up the code with spaces." Scrapers normalise whitespace. This mainly annoys humans.

"First 20 to DM me." This does work against scrapers, and it costs you two hours of copy-paste, gives you no record of who got what, and rewards whoever happened to be awake in your timezone. You have replaced a bot problem with a labour problem and a fairness problem.

"I'll use a Google Form." Better — there is a gate now. But a Form has no idea how many codes are left, cannot stop one person submitting fifteen times with plus-addressing, and will happily keep collecting entries after the last code is gone. You still hand out codes manually afterwards.

---

What actually stops it

The pattern that works is simple: never put the code in public text. Put a link in public, and let the code be handed out one at a time, behind a gate, from a store you control.

That gives you three defences that compound:

A challenge. A CAPTCHA-style check — Cloudflare Turnstile and similar — costs a real person nothing and stops naive automation dead. This alone removes most of the problem.

One code per person, enforced server-side. Not "please only take one." The claim has to be an atomic operation: check availability, mark it taken, hand it over, all in one transaction that cannot run twice for the same person. Deduplicate on email, normalising for the tricks — name+1@gmail.com and name@gmail.com are the same inbox.

Rate limiting per IP. Someone hammering the endpoint forty times a minute is not a person deciding whether they want your app.

None of this is exotic. It is just work that has to exist somewhere, and a text post has none of it.

---

The part worth internalising

The bot problem and the email problem are the same problem.

Every defence above requires a gate. Once you have a gate, you may as well capture the address — the user is already there, and it costs them four seconds. And once you are capturing addresses, running out of codes stops being the end of the campaign and becomes the start of a waitlist.

Posting codes in plain text does not just lose you the codes. It loses you everything you would otherwise have learned about the people who wanted them.

---

Promo Code Queue does the whole gate: bot challenge, one code per person enforced server-side, rate limiting, and email capture that keeps working after the last code is claimed.