PointMaxxerPrivacy Policy
What stays on your device
The app saves the following in your browser's local storage (the extension uses chrome.storage.local; the web app uses localStorage). Unless you turn on sync (see below), it is never uploaded to us:
- The cards you add to your wallet (product names only; never card numbers, expiry dates, security codes or account details).
- Your settings: point values, category choices, spending profile, appearance and accessibility options.
- Statement credits you mark as used, and offers the app has recorded for you.
- The date you first opened PointMaxxer. It stays on your device (and in the encrypted sync copy, if you use sync); we don't receive it. It lets us tell early users from later ones if we ever change how the product is offered.
You can erase all of it at any time with Settings → Reset everything (which also turns off sync and deletes the cloud copy if sync is on), or by removing the extension or clearing the site's data.
What the app downloads
To keep card rates current, the app requests the public data feed at pointmaxxer-data.pages.dev: a small version file, and the card data when the version changes. These requests contain no information about you, your wallet or your browsing. As with any web request, the hosting provider (Cloudflare) sees your IP address and standard request headers in its server logs. We do not receive or use that information to identify you.
The web app is hosted at app.pointmaxxer.app (and pointmaxxer.pages.dev) on the same provider, and the marketing page is at pointmaxxer.app.
Optional: sync between your devices
Sync is off until you turn it on in Settings. When you do, the app creates a random 12-character sync code and shows it to you. You type that code on your other devices to link them.
- What is copied: your wallet (card names), custom cards you created, point values, category choices, spending profile, statement credits you marked used, and offers the app recorded for you. Never card numbers, expiry dates, security codes, logins or account numbers. Appearance settings stay on each device.
- Encrypted before it leaves your device. The app encrypts that copy with a key derived from your sync code, then uploads the result. We never receive the code or the key, so we cannot read your data, and neither can the hosting provider.
- What our server stores: an identifier derived from your code, a hash of a password derived from your code, a version number, a timestamp, and the encrypted data. Nothing that identifies you.
- Hosting: the server runs on Cloudflare (Pages Functions and D1). As with any web request, the host sees your IP address and standard request headers in its logs. We do not use them to identify you.
- Anyone with the code can read and change the synced data, so keep it private, like a password. If you lose every device and the code, the data cannot be recovered, because we cannot decrypt it.
- Deleting it: Settings → Turn off and delete my data erases the cloud copy immediately. Your data stays on your devices. Copies that go unused for 12 months are deleted automatically.
Browser extension permissions
| Permission | Why it is needed |
|---|---|
tabs | Reads the address of the tab you are on so the extension can match it to a known merchant (for example, Amazon) and show the best card. This happens on your device. The address is not stored or sent anywhere. |
storage | Saves your wallet and settings locally. |
alarms | Checks for new card data and statement-credit reminders on a schedule. |
notifications | Shows optional reminders when a statement credit is about to expire. You can turn these off in Settings. |
scripting and optional site access | Used only for the optional offers feature below. |
Optional: card offers on your bank's website
The extension can optionally add merchant offers on your card issuer's offers page for you. This is off by default. It runs only after you grant access to specific bank sites (Chase, Citi, U.S. Bank, Bank of America and its deals service, American Express) in your browser's own permission prompt, and you can revoke it at any time. When you use it:
- You sign in to your bank yourself. The extension never sees, reads, stores or sends your username, password or any account number.
- It reads the offers your bank's page shows and loads (merchant, value, minimum spend, cap, expiry, and whether you've added it) and clicks the "add" buttons when you ask it to. What it records stays on your device.
- On some banks (currently all of them) it can ask the bank's own service, from inside your signed-in page and using that page's own session, for your cards' offers and to add the ones you choose. It talks only to that bank's own address, and the session details stay in the page's memory: they are never stored or sent anywhere.
- Nothing from your bank's pages is sent to us or anyone else.
Automating a bank's website may be restricted by that bank's terms. The feature is optional and you use it at your own discretion.
What we do not do
- We do not collect personal information, financial account information or browsing history on our servers. We do not operate user accounts. The only thing we store is the encrypted copy you choose to sync, which we cannot read.
- We do not use analytics, advertising or tracking tools, and we do not sell, rent or share your data.
- We do not use data for credit decisions or lending.
Payments
PointMaxxer does not take payments today. If we add paid access in the future, this policy will be updated before it takes effect to describe exactly what is sent (for example, a license key) and to whom.
Children
PointMaxxer is not directed at children under 13 and does not knowingly collect information from them.
Contact
Questions or requests about this policy: [email protected].
Changes to this policy
If this policy changes, the date above will change, and for material changes we will say so in the app or on the store listing.