Privacy Policy

CardRewards.ai ("we," "us," or "our") operates the website at cardrewards.ai, the CardRewards.ai mobile app for iOS (the "App"), and related services (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, and your choices regarding that information. It applies to the website and the App alike; section 3 covers what is specific to the App.

Information You Provide

• Account information: If you create an account, we collect your email address and any profile information you choose to provide.
• Sign in with Apple or Google:If you sign in with Google, Google shares your name, email address and profile picture with us. If you sign in with Apple, Apple shares your email address and, if you choose to share it, your name, which Apple provides only the first time you sign in. If you choose Apple's "Hide My Email," we receive a private relay address that Apple forwards to you, not your real email address. We do not receive your Apple or Google password.
• Profile picture: If you choose to set a profile picture, we store the image you pick with your account. It is served from a web address that is not listed anywhere but can be opened by anyone who has it. You can remove it at any time.
• Spending preferences: Categories and amounts you enter when using our recommendation engine, and the answers you give during onboarding (such as spending categories, monthly spend, home airports, travel and dining habits, and a self-reported credit score range). This data is used solely to generate personalized card recommendations.
• Cards and activity you save: The cards you add to your wallet, the benefit use you record, and the restaurants you save. You choose cards from our catalogue; we never ask for or store card numbers, and we do not connect to your bank or card accounts.
• Contact form submissions: Name, email, and message content when you contact us.

Information Collected Automatically

• Usage data: Pages visited, search queries, recommendation results viewed, and interaction patterns.
• Device information: Browser type, operating system, screen resolution, and device identifiers.
• Log data: IP address, access times, and referring URLs.
• Approximate location from your IP address: We use the city your IP address points to, as reported by our hosting provider, to suggest nearby restaurants and airports. We use it to answer that request and do not save it to your account.
• Cookies: See our Cookie Policy for details.

The App is part of the Service, and everything in this policy applies to it. The App asks for device permissions only when you use the feature that needs them. You can change any of them later in your device's Settings, and the rest of the App keeps working without them.

• Location (while using the App only):The App asks for your location only when you tap a location control, such as "Use my location," the map's locate button, or sorting restaurants by distance. It never reads your location in the background. Your location is used only to show restaurants near you. Choosing the nearest city and centring the map happen on your device. When restaurants are sorted by distance, the App sends your position, rounded to about 1 km, to our servers with that search so the results can be ordered by distance. We do not save it to your account or our database, though like any request it can appear briefly in our hosting provider's request logs. Once you have allowed location, the restaurants section on the App's Home screen uses it in the same way.
• Photos: The App asks for access to your photos only if you choose to set a profile picture, and uploads only the photo you pick. The App does not use your camera or microphone.
• Benefit reminders: Reminders you set for a card benefit are notifications scheduled on your device. The App asks for notification permission only when you set one. We do not send push notifications, and your reminders are not sent to our servers.
• Stored on your device: The App keeps some data only on your device: your sign-in session (encrypted, with its key in the iOS Keychain), the last restaurant city and airport you viewed, your comparison list, an unfinished onboarding draft, your banking plan (state, direct deposit and how much you would keep deposited), and cached catalogue data so screens load quickly. We do not receive this data unless you save it to your account.
• App updates:The App downloads updates to its own code from Expo, our app update provider, without going through the App Store. To find the right update, it sends Expo the App's version, platform and update channel, a random identifier created for this installation of the App, and, like any internet request, your IP address. It does not send your account information.
• Maps:Maps in the App are provided by Apple Maps on iOS. Apple's privacy policy covers the map data your device requests from Apple.

• Generate personalized credit card recommendations based on your spending inputs.
• Operate, maintain, and improve the Service.
• Respond to your inquiries and provide customer support.
• Send transactional emails (account confirmation, password resets). We do not send marketing emails unless you opt in.
• Analyze aggregate usage patterns to improve our recommendation engine and content.
• Detect and prevent fraud or abuse.

We do not sell your personal information. We may share information in the following limited circumstances:

• Service providers: Third-party services that help us operate the Service (hosting, analytics, email delivery, and Expo for App updates). These providers are contractually obligated to protect your data.
• Sign-in providers: If you sign in with Apple or Google, the sign-in itself goes through that provider, under its own privacy policy.
• Legal requirements: When required by law, subpoena, or to protect our rights, safety, or property.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users.

We retain your account information for as long as your account is active. Spending preference inputs used for recommendations are processed in real time and are not stored permanently unless you save them to your account. You may delete your account at any time, in the App (Settings, under Danger Zone) or in your account settings on the website, and we will remove your personal data within 30 days. If you signed in with Apple, you can also stop using Sign in with Apple for CardRewards.ai in your Apple account settings; the App then signs you out.

We use industry-standard security measures to protect your information, including encryption in transit (TLS) and at rest, secure authentication, and regular security reviews. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Object to or restrict certain processing.
• Data portability (receive your data in a structured format).
• Withdraw consent where processing is based on consent.

To exercise these rights, contact us at privacy@cardrewards.ai.

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, request deletion, and opt out of the sale of personal information. We do not sell personal information. To make a request, contact us at privacy@cardrewards.ai.

If you are accessing the Service from outside the United States, your information may be transferred to and processed in the United States. By using the Service, you consent to this transfer.

The Service is not intended for children under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy, contact us at:

• Email: privacy@cardrewards.ai
• Contact form: cardrewards.ai/contact