Account information: When you sign in via Google, we receive your name, email address, profile picture, and a unique user ID from Google Firebase Authentication. Your email address is also recorded in our server logs when you make authenticated requests.
Credit card details: For each card you add, we store: a card identifier (card key), the last four digits, card provider (e.g. Visa, Mastercard, Amex), expiry date, and last statement date. We do not collect or store full card numbers, CVVs, PINs, or banking credentials.
Transaction records: When you log a transaction, we store: merchant name, amount, currency, transaction date and time, transaction type (physical, online, or mobile pay), category, region (local or international), payment network, MCC code, and a name and description you provide.
Reward data: We calculate and store cashback, miles, and reward amounts earned per transaction, along with a detailed audit trail of which reward rules were applied. Billing cycle summaries (total spend, miles, cashback per period) are also stored.
Website URLs: When you open the extension on a webpage, the current tab's URL is sent to our servers to identify the merchant and determine the appropriate reward category. URLs are used solely to resolve the merchant and are not retained after the request completes.
Merchant search queries: When you use the manual merchant lookup, the merchant name and selected currency are sent to our servers. These are not stored against your identity.
Local browser storage: The most recent merchant suggestion result is cached locally in your browser. This data does not leave your device except as part of the normal requests described above.
Server request logs: Our servers log every incoming request, including: timestamp, HTTP method, request path, and your IP address. These logs are used for debugging and security monitoring.
