Privacy Policy

1. Information We Collect

CardLookout collects only the information necessary to provide credit card perk tracking, reward calculations, and Authorized User card sharing:

• Account Identification: When signing in with Google OAuth 2.0 via Supabase Auth, we receive your email address, unique user ID, and basic profile metadata.
• Portfolio Selections: Credit card types you select from our catalog, custom card nicknames, and card open dates stored in your wallet.
• Perk & Benefit Tracking: Benefit usage timestamps, monthly/annual statement credit claims (user_benefits), and disabled perk preferences.
• Card Sharing Invites: Recipient email addresses you invite to share card perks as Authorized Users (wallet_shares).
• AI Advisor Messages: Queries and conversation history sent to the AI Card Advisor (chat_messages).
• Voluntary Feedback: Bug reports, feature suggestions, and contact messages submitted through our feedback widget (user_feedback).

2. How We Use Your Information

We use the collected information strictly for service operations:

• Calculating reward category multipliers and computing the best card to use for specific purchase categories.
• Tracking recurring statement credits and alerting you before monthly, quarterly, or annual deadlines expire.
• Synchronizing card perks and benefits with designated Authorized Users who sign in with their matching email address.
• Generating contextual AI recommendations through the Google Gemini API based on your active card portfolio.
• Sending transactional notifications via Resend when a card is shared with you or when you submit feedback.

3. Local Storage & Cookies

CardLookout uses essential first-party cookies and browser local storage:

• Session Cookies: Supabase authentication cookies maintain your signed-in state.
• Browser Local Storage: Keys prefixed with cardlookout_* temporarily cache your card list, used benefit status, and local chat messages for speed and guest browsing.
• Automatic Cleanup: When you sign out from CardLookout, all local storage keys containing user data are cleared immediately from your browser.

4. Third-Party Service Providers

We partner with trusted third-party providers who process data in accordance with their strict privacy and security standards:

• Supabase: Managed PostgreSQL database, authentication, and Row Level Security infrastructure.
• Google Cloud / Gemini API: Processes queries sent to the AI Card Advisor to generate credit card comparison answers.
• Resend: Transactional email service used to dispatch card sharing invitations and support messages.

5. Data Retention, Deletion & Contact

You retain full control over your data. You may remove individual cards from your wallet, revoke Authorized User sharing links at any time in Settings, or clear your AI Advisor chat history.

To request complete deletion of your account and all associated database records, please contact us at jnicoara11@gmail.com. We process deletion requests within 30 days.