Privacy Policy
CardCompass helps you manage the rewards and benefits on the credit cards you already hold. This policy explains what we collect, how we use it, who we share it with, how long we keep it, and the choices you have.
At a glance
- We do not sell your data or use it for advertising.
- We never receive your bank username or password. Plaid handles your bank login.
- Your cards and transactions are stored on your iPhone and sync through your own iCloud.
- When you use AI features, the information needed is sent to Anthropic (Claude) or OpenAI. They do not use it to train their models.
- You can delete your account in the app at any time, and we delete your account data right away.
1. Who we are
CardCompass LLC, a limited liability company registered in Wyoming, USA ("CardCompass," "we," "us"), operates the CardCompass iOS app and the website getcardcompass.com (together, the "Service"). This policy applies to the Service. Banks, card issuers and other third-party services you reach through the app are covered by their own privacy policies.
This policy is available in English and Chinese. If the two versions differ, the English version controls.
2. Your information
Your cards, transactions and bills are stored on your iPhone and sync through your own iCloud. We receive only the information we need to provide the Service, and nothing for advertising.
2.1 Stored on your iPhone
The cards you add, your notes, open dates and annual fee dates, and the transactions, statements and account details synced through Plaid are stored on your iPhone and sync through your own iCloud. If you allow location access, your location is used to recommend which card to use at places near you, which are found through Apple Maps.
2.2 What we receive
| Category | What it includes |
|---|---|
| Account | Sign-in information, such as your email address. |
| Support conversations | Messages, images and files you send us. |
| Notifications | Push notification token, language and time zone. |
| Subscription | Subscription status. We never see your payment card details. |
| Referral program | Referral relationships if you take part; for creators, a contact email and payout details. |
| Security | Device and network information needed to prevent fraud and abuse. |
2.3 Collected automatically
- Usage analytics through TelemetryDeck, to understand how features are used.
- Crash and error reports through Sentry, to fix problems.
- Service logs, kept for up to 90 days.
We do not collect your bank password, full card numbers or Social Security number.
3. Bank connections through Plaid
Plaid connects your bank with read-only access. We never see your bank password.
If you choose to connect a bank, we use Plaid Inc. Plaid verifies your login directly with your bank, and we never receive your bank username or password. Once connected, the following information syncs to your iPhone through Plaid:
- Transactions: up to 24 months of history (date, amount, merchant name, category and description), used to calculate rewards earned, track sign-up bonus progress and match benefit credits.
- Credit card statements: statement balance, amount due, due date, APR and payment history, used to show your bills and send reminders.
- Account details: account name, type, last four digits, balance and credit limit, used to match connected accounts with the cards in the app.
We do not use Plaid's Identity or Auth products, so we do not receive your name, address, phone number or full account number from your bank.
The access credential Plaid issues for your connection is encrypted before it is saved. Plaid handles your data under its End User Privacy Policy.
You can disconnect or delete a bank connection in the app at any time. When you delete a connection or your account, we revoke access through Plaid immediately. If you only disconnect, access stays in place until the end of the month so you can restore it, and is then revoked automatically. We may also remove connections that stop working or are no longer included in your plan.
4. AI features
To answer your questions, CardCompass sends the relevant information to AI providers. They do not use it to train their models.
4.1 What we send
When you ask CardCompass AI a question, we send the information needed to answer it: your question and recent conversation; the cards in your wallet (including last four digits, balances, credit limits and points) and their benefits; the country you are in; and the transactions relevant to your question (date, merchant, amount, card and category). We do not send your name, email address, bank login or full card numbers.
4.2 Who receives it
Anthropic (Claude) and OpenAI. They process this information only to generate answers for us, their terms do not allow them to use it to train their models, and they may keep it for a short time for safety and abuse monitoring.
To answer some questions, we may also look up public information from data partners, such as award flight availability or merchant details. These lookups contain only the search itself, such as a route or a merchant name.
4.3 What we keep
- Conversations: kept until you delete the conversation or your account.
- Wallet summary prepared for the AI: kept for 7 days.
4.4 Connecting your own AI assistant
If you connect your own AI assistant, such as Claude or ChatGPT, to CardCompass, that assistant can read the card and transaction information you authorize. To make this work, we prepare up to 12 months of your transactions for it, and delete them when you disconnect or after 30 days without use. How your assistant uses this information is governed by your agreement with that provider.
4.5 About AI answers
AI answers are generated automatically, may contain mistakes, and are not financial advice.
5. How we use information
Only to provide and improve the Service.
- Provide the features you use: reward tracking, sign-up bonus progress, benefit tracking, reminders, card recommendations and AI answers.
- Send the notifications you turn on.
- Respond to your support requests.
- Understand how the app is used, and find and fix problems.
- Prevent fraud and abuse, and keep the Service secure.
- Comply with legal obligations.
We do not sell your information, use it for third-party advertising, or build profiles for sale. We use your financial information only to provide the Service, not to infer other characteristics about you.
6. How we share information
We do not sell your personal information or share it for advertising. We use the following service providers only to run the Service.
| Provider | Purpose |
|---|---|
| Plaid | Bank connections |
| Anthropic, OpenAI | AI model providers |
| DigitalOcean | Server and database hosting (United States) |
| Apple | Sign in with Apple, iCloud sync, App Store purchases, push notifications |
| Sign in with Google | |
| TelemetryDeck | App usage analytics |
| Sentry | Crash and error monitoring |
| Resend | Sending email, such as waitlist updates |
| Cloudflare | Content delivery |
These providers may use information only to provide services to us, and must protect it to the same standard as this policy. We may also disclose information when required by law, to protect the rights and safety of our users and the public, or as part of a merger, acquisition or sale of assets. If a business transfer happens, we will notify you.
7. How long we keep information
We keep information only as long as we need it, and we delete it when you delete your account.
| Information | How long |
|---|---|
| Account information | Until you delete your account |
| Cards and transactions on your device and in iCloud | Under your control, removed when you delete them |
| Bank connections | Until you delete the connection or your account; if you only disconnect, until the end of that month |
| AI conversations | Delete any conversation at any time; all are deleted when you delete your account |
| Wallet summary prepared for the AI | 7 days |
| Transactions prepared for your connected AI assistant | Until you disconnect, or 30 days without use |
| Support conversations | Until you delete your account |
| Push notification token | Until you delete your account |
| Usage analytics | Up to 12 months |
| Service logs | Up to 90 days |
| Crash reports | As long as needed to investigate and fix the related issue |
| Waitlist email | Until you unsubscribe or ask us to remove it |
| Creator commission records | As required for accounting and tax purposes, with contact and payout details removed when you delete your account |
8. Deleting your account
You can delete your account in the app at any time, and we delete your account data right away.
In the app, go to Account › Privacy & Security › Delete Account. When you delete your account, we immediately:
- delete your account and its data, including AI conversations, feedback and support conversations;
- disconnect your bank connections through Plaid;
- revoke Sign in with Apple.
A few records remain for a limited time: copies in backups and logs, which expire on their normal schedule within 90 days; a record that the deletion took place; and creator commission records needed for accounting, with personal details removed. Data on your iPhone and in your iCloud stays under your control, and you can delete it in iOS Settings. Subscriptions are managed by Apple and are not canceled when you delete your account. To cancel, go to iOS Settings › Apple Account › Subscriptions.
9. Security
We protect your information with encryption and access controls.
- Encryption in transit: all connections use TLS 1.2 or higher.
- Encryption at rest: data we store is encrypted at rest (AES-256), and bank connection credentials are encrypted again at the application level.
- Access control: each account can access only its own data, and access to production systems requires multi-factor authentication.
- Data minimization: we do not collect bank login credentials, Social Security numbers or other sensitive information we do not need.
No system is perfectly secure. If a security incident affects your data, we will notify you as required by law.
10. Your rights and choices
You can access, correct, export and delete your information.
Depending on where you live, including California and other states with privacy laws, you may have the right to:
- know what information we collect, how we use it and who we share it with;
- get a copy of your information, or export it in a portable format;
- correct inaccurate information;
- delete your information;
- opt out of the sale of your information or sharing for advertising (we do neither, so this right is always honored);
- limit the use of sensitive personal information (we use sensitive information, such as financial account details, only to provide the Service);
- appeal our decision on your request.
How to make a request
You can delete your account directly in the app. For other requests, email [email protected]. We will verify your identity through the email address linked to your account. You may also use an authorized agent, who must provide permission signed by you.
We will confirm receipt within 10 business days and respond within 45 days. If we need more time, we will tell you and may extend this by another 45 days. To appeal a decision, reply to our email with "Appeal" and we will respond within 45 days.
We will not treat you differently for exercising these rights. We recognize and honor Global Privacy Control (GPC) signals.
Choices in the app
- Turn notifications and location access on or off at any time in iOS Settings.
- Export your app data in Account › Privacy & Security.
- Disconnect or delete a bank connection at any time.
- Delete individual AI conversations.
11. Our website
Our website does not use cookies, advertising trackers or analytics scripts.
Your browser saves your language choice and whether you closed the top banner on your own device, and this is not sent to us. If you join the waitlist, we keep your email address, language and how you found us, along with a one-way hash of your IP address to prevent abuse. When you tap the TestFlight link, we count the click using the same kind of hash. We send email through Resend, and every email includes an unsubscribe link.
Because our website does not track visitors, browser Do Not Track signals do not change how it works.
12. Children
CardCompass is not intended for anyone under 18. We do not knowingly collect information from minors, and we delete it if we learn that we have.
13. International users
CardCompass operates in the United States and currently serves users in the United States. Your information is processed mainly in the United States. Some service providers may process information in other countries, with appropriate safeguards.
14. Changes to this policy
We may update this policy. We will notify you in the app or by email before material changes take effect. The effective date at the top of this page shows when the current version took effect.
15. Contact us
CardCompass LLC, Wyoming, USA
Email: [email protected]