Privacy policy

Last updated October 18, 2026

1. Who runs PointsFinch

PointsFinch (pointsfinch.com) is a small independent service. In this policy, “we” means whoever runs it. Questions, requests to see or delete your data, and anything else about privacy: [email protected].

2. What we collect

Your account

• Your name and email address.
• Your password. We keep only a one-way hash of it, never the password itself.
• Optionally, your typical monthly spend (used to flag sign-up bonuses that would be hard to reach).

What you enter or import

• Credit cards: the card, its issuer, the last 4 or 5 digits, the dates opened and closed, fees, credit limit, benefits, sign-up bonus and progress, whether autopay is set up, your cancel-by date, and any notes you write. We never ask for a full card number, expiry date or security code.
• Miles and points accounts: the program, your balance and its history, member number, last activity and expiration dates, elite status and notes.
• People in your household (names), so cards and accounts can be tracked per person, and your settings (what a point is worth to you, reminder preferences).
• Offers you save or hide: the card-linked offers on your cards, the stores you favorite or block, and offers you type in yourself (those stay private to you).

What the browser extension reads and sends

The Chrome extension does nothing until you connect it to your PointsFinch account. After that it reads these pages, only when you are signed in to them yourself, and sends what it finds to your account:

• American Express, Chase, Bank of America and Citi (and Capital One, when you click the extension on its offers page): the list of your cards on that sign-in (card name, last 4 or 5 digits, whether it is a business or canceled card), the card-linked offers (store, offer text, expiry date, terms, whether you added it), points balances on Chase Ultimate Rewards, Bank of America deals, and the first name the page greets you with (used only to suggest whose sign-in it is).
• Loyalty program sites you point it at: when you click a balance on an airline, hotel or points page and choose “this is my balance”, the extension remembers where that number is on the page and sends the balance it reads there (and, where the balance belongs to a card, the card's last digits).
• On every other site: nothing is sent. To show your best card for a store, the extension downloads your card ranking and a list of stores from PointsFinch and compares the site you are on inside your browser. The sites you visit are not sent to us and we do not keep a browsing history.

The extension does not read or send your bank or airline passwords, the cookies or sign-in tokens of those sites, full card or account numbers, or statements. (When it asks Bank of America's own deals site for your deals, it uses that site's sign-in token in your browser, to that site only.) The extension's own connection to your account is a random token stored in the extension; we keep only a one-way hash of it, and you can disconnect it from the Browser extension page at any time.

Technical information

• A session cookie that keeps you signed in, and a security cookie that protects forms. They are needed for the site to work; we use no advertising or tracking cookies.
• Your network address, seen through our network provider (Cloudflare), and a short-lived record of recent sign-in and sign-up attempts per address and per email address, to stop password guessing and abuse.
• Basic server logs (errors and which pages were requested) for troubleshooting.

3. How we use it

• To show you your cards, balances, bonuses, offers, application-rule status (like Chase 5/24) and which card to use where.
• To send the reminder emails you have turned on: the weekly summary and cancel-by reminders.
• To keep the service secure and working, and to fix problems.
• To show a community signal on offers (see section 4), as counts only.

We don't use your data for advertising, to build profiles to sell, or to decide anything about your creditworthiness or eligibility for credit.

4. Who else sees it

• Other PointsFinch users: no one sees your cards, balances, notes or people. Two things are shared on purpose. The offers an issuer shows are kept in a shared catalog (store, offer text, terms) so each person doesn't have to be the first to read them; the catalog says nothing about who has them. And offers show a count such as “starred by 3 users” from users' stars, hearts and always-hidden stores. These are counts only, never names.
• Service providers that handle data only to provide the service: Cloudflare (our network connection and protection against attacks, which sees traffic to the site) and an email delivery provider (currently Zoho Mail), which receives your email address and the text of the reminder emails.
• The service runs on a server we manage; data is not sent to advertisers, data brokers or analytics companies.
• If the law requires it, or to protect the service and its users from fraud or abuse, we may disclose what is necessary.

5. The Chrome extension

The extension is built to do one thing: bring your credit card, points and offers information from the sites you are signed in to into your PointsFinch account, and show your best card as you shop. Its permissions are used only for that. In line with the Chrome Web Store user data policy:

• We use the information the extension handles only to provide and improve those features.
• We don't sell it or transfer it to others except as described in section 4.
• We don't use or transfer it for advertising, or to determine creditworthiness or lending eligibility.
• Nobody reads your data by hand except where you ask us to help with a problem, where it is needed for security or abuse, or where the law requires it.
• The extension runs no code downloaded from the web.

6. How long we keep it

• Your data stays while your account exists. Deleting a card, account, person or offer in the app removes it.
• If you ask us to delete your account, we delete it and everything attached to it (cards, accounts, people, offers, tokens, settings) within 30 days. Database backups are rotated and kept for about two weeks at most, so the data also leaves the backups within that time.
• Removing the extension from Chrome deletes what it stored in your browser. Disconnecting it on the Browser extension page revokes its access to your account.

7. Security

Connections to PointsFinch use HTTPS. Passwords and extension tokens are stored only as one-way hashes. Sign-in cookies can't be read by page scripts, the site restricts what scripts and requests it allows, and sign-in attempts are rate-limited. Access to the server is limited to the people who run it. No system is perfectly secure, so please use a strong, unique password.

8. Your choices

• Edit or delete your cards, accounts, people and offers in the app whenever you like.
• Turn the weekly and cancel-by emails off in Settings.
• Disconnect the extension, or remove it from Chrome, at any time.
• Ask us for a copy of your data, to correct it, or to delete your account: email [email protected]. We'll reply within 30 days.

9. Children

PointsFinch is for adults managing their own credit cards and points. It is not directed at children under 13 and we don't knowingly collect their information.

10. Where your data is

The service is run from the United States. By using it you accept that your information is processed there, and by the providers named in section 4 where they operate.

11. Changes to this policy

If we change what we collect or share, we will update this page and its date above, and email account holders about changes that matter before they take effect.

12. Contact

[email protected]