Privacy Policy
What stays on your device
The app saves the following in your browser's local storage (the extension uses chrome.storage.local; the web app uses localStorage). Unless you turn on sync (see below), it is never uploaded to us:
- The cards you add to your wallet (product names only; never card numbers, expiry dates, security codes or account details).
- Your settings: point values, category choices, spending profile, appearance and accessibility options.
- Statement credits you mark as used, and offers the app has recorded for you.
- A random id this device made up for the anonymous usage counts below (it is not linked to your sync code or anything else, and Reset everything deletes it).
- The date you first opened PointMaxxer. It stays on your device (and in the encrypted sync copy, if you use sync); we don't receive it. It lets us tell early users from later ones if we ever change how the product is offered.
You can erase all of it at any time with Settings → Reset everything (which also turns off sync and deletes the cloud copy if sync is on), or by removing the extension or clearing the site's data.
What the app downloads
To keep card rates current, the app requests the public data feed at pointmaxxer-data.pages.dev: a small version file, and the card data when the version changes. These requests contain no information about you, your wallet or your browsing. As with any web request, the hosting provider (Cloudflare) sees your IP address and standard request headers in its server logs. We do not receive or use that information to identify you.
The web app is hosted at app.pointmaxxer.app (and pointmaxxer.pages.dev) on the same provider, and the marketing page is at pointmaxxer.app.
Optional: sync between your devices
Sync is off until you turn it on in Settings. When you do, the app creates a random 12-character sync code and shows it to you. You type that code on your other devices to link them.
- What is copied: your wallet (card names), custom cards you created, point values, category choices, spending profile, statement credits you marked used, and offers the app recorded for you. Never card numbers, expiry dates, security codes, logins or account numbers. Appearance settings stay on each device.
- Encrypted before it leaves your device. The app encrypts that copy with a key derived from your sync code, then uploads the result. We never receive the code or the key, so we cannot read your data, and neither can the hosting provider.
- What our server stores: an identifier derived from your code, a hash of a password derived from your code, a version number, a timestamp, and the encrypted data. Nothing that identifies you.
- Hosting: the server runs on Cloudflare (Pages Functions and D1). As with any web request, the host sees your IP address and standard request headers in its logs. We do not use them to identify you.
- Anyone with the code can read and change the synced data, so keep it private, like a password. If you lose every device and the code, the data cannot be recovered, because we cannot decrypt it.
- Deleting it: Settings → Turn off and delete my data erases the cloud copy immediately. Your data stays on your devices. Copies that go unused for 12 months are deleted automatically.
Anonymous usage statistics
The app, the installed app and the extension count how they are used, so we can see what helps and what to build next. This is on by default and you can turn it off at any time in Settings → Preferences → Share anonymous usage stats. It is also off automatically if your browser sends Do Not Track or Global Privacy Control.
What is sent (nothing else): the name of an action from a fixed list, with at most one detail from a fixed set.
- That the app was opened, which screen you viewed (Best, Wallet, Benefits, Offers or Settings), and that you added or removed a card, created a custom card, marked a credit used, or turned on sync.
- A spending category you looked up (for example "grocery" or "dining"), never the shop or the amount.
- For the optional offers helper: which bank it was switched on for, and how many offers were added (for example "chase, 3"), never which merchants or offers.
- Where it ran (browser, installed app or extension), the app version, and a random id the device made up. The random id lets us count active devices and how many come back. It is not linked to your sync code, your wallet or any account, and Reset everything deletes it.
What is never sent: card names, your wallet, shops or websites you visit, amounts, offers, anything you type, sync codes, or your bank sign-in. The extension never reports which pages you browse.
How it is stored: on our own Cloudflare account, in daily counters and one row per active device per day. We do not store your IP address; Cloudflare tells our server the two-letter country, and only that is kept. Records older than 400 days are deleted. We do not share this data with anyone, and it is not used for advertising.
This website (pointmaxxer.app and the guides) uses Cloudflare Web Analytics for page views, referrers and performance. It does not use cookies or follow you across sites. It does not run in the app or the extension.
Browser extension permissions
| Permission | Why it is needed |
|---|---|
tabs | Reads the address of the tab you are on so the extension can match it to a known merchant (for example, Amazon) and show the best card. This happens on your device. The address is not stored or sent anywhere. |
storage | Saves your wallet and settings locally. |
alarms | Checks for new card data and statement-credit reminders on a schedule. |
notifications | Shows optional reminders when a statement credit is about to expire. You can turn these off in Settings. |
scripting and optional site access | Used only for the optional offers feature below. |
Optional: card offers on your bank's website
The extension can optionally add merchant offers on your card issuer's offers page for you. This is off by default. It runs only after you grant access to specific bank sites (Chase, Citi, U.S. Bank, Bank of America and its deals service, American Express) in your browser's own permission prompt, and you can revoke it at any time. When you use it:
- You sign in to your bank yourself. The extension never sees, reads, stores or sends your username, password or any account number.
- It reads the offers your bank's page shows and loads (merchant, value, minimum spend, cap, expiry, and whether you've added it) and clicks the "add" buttons when you ask it to. What it records stays on your device.
- On some banks (currently all of them) it can ask the bank's own service, from inside your signed-in page and using that page's own session, for your cards' offers and to add the ones you choose. It talks only to that bank's own address, and the session details stay in the page's memory: they are never stored or sent anywhere.
- Nothing from your bank's pages is sent to us or anyone else.
Automating a bank's website may be restricted by that bank's terms. The feature is optional and you use it at your own discretion.
What we do not do
- We do not collect personal information, financial account information or browsing history on our servers. We do not operate user accounts. We store the encrypted copy you choose to sync, which we cannot read, and the anonymous usage counts described above.
- We do not use advertising or cross-site tracking tools, and we do not sell, rent or share your data. The only analytics are our own anonymous counts above and Cloudflare Web Analytics on this website.
- We do not use data for credit decisions or lending.
Payments
PointMaxxer does not take payments today. If we add paid access in the future, this policy will be updated before it takes effect to describe exactly what is sent (for example, a license key) and to whom.
Children
PointMaxxer is not directed at children under 13 and does not knowingly collect information from them.
Contact
Questions or requests about this policy: [email protected].
Changes to this policy
If this policy changes, the date above will change, and for material changes we will say so in the app or on the store listing.