Privacy Policy

We never ask for your bank login. We don't know your account numbers, your balances, or what you actually spent. You tell us which cards you carry, and we tell you which one to tap.

Location is read when you ask for a recommendation — and, if you switch on Store Alerts, when your phone notices you have arrived somewhere. Store Alerts does that matching on your device: we are not told where you are, we keep no history of where you have been, and we don't sell your data to anyone.

Your account. Your email address, and — if you sign in with Google — the name and email on that Google account.

Your wallet and preferences. The credit cards you add, whether you prefer travel or cashback, and any loyalty programs or account conditions you tell us about. This is what makes a recommendation possible.

Your location, only on request. When you tap "Check this spot"; or use the location button in Search, we read your device's coordinates once, use them to work out which store you're at, and show you a recommendation. The reading happens on demand and is never stored. We keep what we learn about the place — that a café exists on that corner — but nothing about where you personally have been.

Store Alerts, only if you turn it on. Store Alerts asks for “Always” location so your phone can notice when you arrive at a shop near you and remind you which card to use. Your device holds the list of nearby places and does the matching itself — the alert is decided on the phone, and your coordinates are not sent to us, not stored, and do not leave the device. Store Alerts is off until you enable it, and turning it off or refusing the permission stops the monitoring completely; the rest of the app carries on working.

To recommend a card, to identify the store you are at, to improve how well the app recognises places, and to send you the emails described below.

We do not sell your personal information, and we do not build a history of your movements.

We send a confirmation when you join the waitlist, a welcome message when your account is confirmed, and sign in codes when you request them. Marketing email carries a one click unsubscribe link and we honour it. Sign in codes and other essential messages are not marketing and cannot be unsubscribed from while you hold an account.

Supabase hosts our database and handles sign-in. Resend delivers our email. Sentry receives crash and error reports, configured to exclude personal data and with Sentry's own session recording deliberately disabled. PostHog receives product analytics — which features you use and how a flow went — identified by your account's internal id only, never your email or your name. PostHog also records app sessions so we can see where the app is confusing to use. Those recordings mask anything you type, every image, and the screens that show your cards and their values; we turn a recording off for any surface that would reveal your wallet. Google provides sign in and the map you see in the app. Geoapify answers "what businesses are near this point?" when our own database doesn't already know the spot — it receives a coordinate, never anything that identifies you. Vercel hosts this website.

Some of these process data outside Canada, including in the United States.

You can turn off location permission for the app at any time in your device settings; the rest of the app keeps working, and you search for stores by name instead. You can delete your account, which removes your profile, your cards and your preferences.

You have the right to ask what we hold about you, to have it corrected, and to have it deleted. Email us and we will action it.

Bank or card credentials. Card numbers, expiry dates or security codes — we store only which card model you carry, which keeps us entirely outside the scope of card industry data rules. Transactions or statements. A history of where you have been — when Store Alerts is on, your phone watches for arrivals and decides on the device, and the coordinates behind that never reach us.

Store location data is © OpenStreetMap contributors, used under the Open Database License. Nearby-place lookups are powered by Geoapify, also built on OpenStreetMap data.

If we change how we handle your information in a way that matters, we will update this page and the date at the top, and — where the law requires it — ask for your consent again rather than assume it.

Questions, requests, or complaints: support@pointsmaxxing.app