Privacy Policy

We never ask for your bank login. We don't know your account numbers, your balances, or what you actually spent. You tell us which cards you carry, and we tell you which one to tap.

Location is read when you ask for a recommendation — and, if you switch on Store Alerts, when your phone notices you have arrived somewhere. For Store Alerts we are sent your position to build the list of shops your phone watches for; after that the matching happens on your device, and we are not sent the shop or where you were when an alert fired. We do record that an alert fired and what kind of place it was, so we can tell whether the feature works. We don't sell your data to anyone.

Your account. Your email address, and — if you sign in with Google — the name and email on that Google account.

Your beta signup. If you join the beta list on this site, we keep your email address and which of our pages you signed up from — a card page or Points 101, say — so we can tell which pages are useful. Nothing else about your visit is stored with it.

Your wallet and preferences. The credit cards you add — and, on a card that lets you choose which categories earn its bonus, the ones you chose — whether you prefer travel or cashback, the spending categories you tell us are your biggest, and any loyalty programs or account conditions you tell us about. This is what makes a recommendation possible.

Your location, only on request. When you tap "Check this spot"; or use the location button in Search, we read your device's coordinates once, use them to work out which store you're at, and show you a recommendation. The reading happens on demand and is never stored. We keep what we learn about the place — that a café exists on that corner — but nothing about where you personally have been.

A count of your place lookups. We keep a per-day tally against your account, with the time of the first and last, so one account can’t run up the bill on the places service we pay for. It records how many, never where.

Store Alerts, only if you turn it on. Store Alerts asks for “Always” location so your phone can notice when you arrive at a shop near you and remind you which card to use. To build the list of places worth watching, your phone sends us its current position — when you switch the feature on, and again when you move far enough that the list is out of date, which can happen while the app is closed. We use that position to answer the question and nothing else: it is not stored and is not attached to your account. The list comes back to your phone, and from then on your device does the watching and the matching itself — the alert is decided on the phone, and we are never sent the shop, its address or your coordinates. What does reach us is a note that an alert fired or was held back, with the kind of place it was — “groceries”, say — and the time, tied to your account, so we can tell whether the feature works. Store Alerts is off until you enable it, and turning it off or refusing the permission stops the monitoring completely; the rest of the app carries on working.

To recommend a card, to identify the store you are at, to improve how well the app recognises places, and to send you the emails described below.

We do not sell your personal information, and we do not build a history of your movements.

We send a confirmation when you sign up for the beta, an invite when a spot opens for you, a welcome message when your account is confirmed, and sign in codes when you request them.

Our marketing email supports your mail app’s one click unsubscribe, and we honour it: once you unsubscribe we stop sending, and that record outlives your account so signing up again does not quietly re-subscribe you. Sign in codes and other essential messages are not marketing and cannot be unsubscribed from while you hold an account.

Supabase hosts our database and handles sign-in. Resend delivers our email. Sentry receives crash and error reports, configured not to send your email or the contents of your screen; some server side reports carry your account’s internal id so a single failure can be traced. PostHog receives product analytics — which features you use, which cards you add or remove, and how a flow went — tied to your account's internal id and to your email address. PostHog also records sessions, in the app and on this site, so we can see where people get stuck. Google provides sign in and the map you see in the app. Apple and Google also run the beta testing programmes. While the beta is running, we give them the email address of anyone we invite, which is what lets you install the app. Google also answers "what businesses are near this point?" when our own database doesn’t already know the spot — it receives a coordinate, never anything that identifies you. Vercel hosts this website.

Some of these process data outside Canada, including in the United States.

You can turn off location permission for the app at any time in your device settings; the rest of the app keeps working, and you search for stores by name instead. You can delete your account, which removes your profile, your cards and your preferences.

Some things outlive a deleted account, on purpose. If you have unsubscribed from email, that record stays — otherwise signing up again would silently re-subscribe you. And the place information we learned along the way stays, because it describes a business, not you: nothing in it links back to the person who looked it up.

You have the right to ask what we hold about you, to have it corrected, and to have it deleted. Email us and we will action it.

Bank or card credentials. Card numbers, expiry dates or security codes — we store only which card model you carry. Transactions or statements. A history of where you have been: the position we use to pick which shops to watch answers that one question and is not kept, and arrivals reach us only as a category, never a shop name or a coordinate.

PointsMaxxing is operated by 14494466 Canada Inc., a corporation incorporated federally in Canada with its registered office in Ontario. That company is accountable for the information described on this page.

If we change how we handle your information in a way that matters, we will update this page and the date at the top, and — where the law requires it — ask for your consent again rather than assume it.

Questions, requests, or complaints: support@pointsmaxxing.app