Privacy Policy

CardIQ (“CardIQ”, “we”, “us”) is a personal credit-card rewards and benefits manager operated by Tim O'Malley. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using CardIQ you agree to this policy.

Information we collect

• Account information. When you sign in with Google, we receive your name, email address, and basic profile information. We never see or store your Google password.
• Cards and benefits you add. The credit cards, benefits, and rewards balances you track in the app.
• Bank transaction data (via Plaid). If you choose to connect a bank, we use Plaid to access your card transactions only — date, amount, merchant, and account name/last-4. We use this to match spending to card benefits and rewards.

We do notcollect or store your bank login credentials, full account or card numbers, and we have no ability to move money. We request only Plaid's Transactions product.

How we use your information

• To provide the core service: tracking card rewards and benefits.
• To match transactions to benefits and surface missed opportunities.
• To send you reminder emails about benefits (if you opt in).
• To review feedback and respond to issues you report.
• To secure, maintain, and improve the service.

We use Anthropic's Claude API to help categorize and match transaction descriptors. We do not sell your personal information, and we do not use your financial data for advertising.

How we share information

We share data only with the service providers (“subprocessors”) needed to run CardIQ:

• Plaid — bank connectivity
• Neon — database hosting
• Vercel — application hosting
• Google — sign-in
• Resend — reminder emails
• Intercom — support chat when enabled; it receives your account identity and messages, but we do not automatically send card or transaction data to it
• Anthropic — transaction categorization

We do not sell your data. We may disclose information if required by law or to protect the rights and safety of our users.

Plaid

When you connect a bank, your information is also handled by Plaid in accordance with Plaid's End User Privacy Policy. We obtain your explicit consent before initiating any bank connection.

Data security

We encrypt your data in transit (TLS 1.2+) and at rest. Access to production systems is restricted and protected by multi-factor authentication. See our Information Security Policy for details.

Data retention and deletion

We keep your data only while your account is active. You can delete a single bank connection or your entire account at any time from within the app — account deletion permanently removes your profiles, cards, benefits, transactions, and bank connections, and instructs Plaid to invalidate the associated access tokens. You may also email us to request deletion. We honor verified deletion requests within 30 days.

Your rights

Depending on where you live, you may have rights to access, correct, or delete your personal information, and to withdraw consent. To exercise these rights, use the in-app controls or contact us at the address below.

Children's privacy

CardIQ is not directed to children under 13 and we do not knowingly collect their data.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above.

Contact

Questions about this policy or your data? Email tim.r.omalley@gmail.com.