Privacy Policy

1. Who We Are

RewardArchitect is a credit card benefit and rewards optimization tool. It helps you track the benefits, sign-up bonuses, and annual value of credit cards you already hold, based on information you enter yourself.

Data Controller:
Quarterdeck Software LLC, doing business as Reward Architect
120 Jefferson Ave, 12018 Miami Beach, FL 33139
Email: info@rewardarchitect.com

2. Important: What RewardArchitect Does NOT Collect

Because transparency matters most in a financial-adjacent product, we state this first:

• We never collect, request, or store credit card numbers, CVVs, expiration dates, or full account numbers for the cards you track in the Service. You identify cards by product name only (e.g., “Chase Sapphire Preferred”).
• We do not connect to your bank or card accounts. The Service does not use account aggregation services (such as Plaid, Finicity, or Yodlee) and never asks for your online banking credentials. All spending and benefit-usage data in the Service is entered manually by you.
• We do not collect precise geolocation, contacts, photos, microphone, camera, or health data. The optional Lounges Near Me feature in the mobile apps uses your device’s approximate location on your device only; your location is never sent to us (see Section 3.4).
• We do not sell your personal information, and we do not share it for cross-context behavioral advertising. The Service contains no third-party advertising.
• We do not use third-party advertising or tracking SDKs in our mobile applications.

3. Information We Collect

3.1 Information You Provide Directly

• Account information: Email address and password (passwords are stored only in salted, hashed form; we cannot read them). Optionally, a display name.
• Card portfolio data: The credit card products you choose to track (by product name), the dates you opened or plan to close them, and annual fees.
• Benefit and spending data you enter: Benefit usage you log (e.g., “used airline credit”), spending amounts you record for optimization or sign-up-bonus tracking, lounge visits you log, and notes you attach. These are self-reported figures you type in; they are not drawn from any financial institution.
• Communications: If you contact us for support, we receive the contents of your message and your email address.
• Free downloads: If you request a free resource (such as our annual fee audit checklist), we collect your email address and how you found us, and may occasionally email you card-value tips. You can unsubscribe at any time by replying “unsubscribe” or emailing info@rewardarchitect.com.

3.2 Information Collected Automatically

• Log and device data: When you use the Service, our servers automatically record standard technical information: IP address, browser or device type, operating system, app version, pages or screens accessed, and timestamps. We use this for security, debugging, and to operate the Service.
• Cookies and similar technologies: The website uses strictly necessary cookies to keep you signed in and maintain session security. We do not currently use third-party analytics or advertising cookies. If that changes, we will update this Policy and, where required, request your consent.

3.3 Payment Information

Paid subscriptions purchased through our website are processed by Stripe, Inc. Your payment card details are transmitted directly to Stripe and are never stored on our servers. We receive from Stripe only limited information necessary to manage your subscription (e.g., subscription status, last four digits of your card, and billing country). Stripe’s handling of your payment data is governed by its own privacy policy, available at https://stripe.com/privacy.

Subscriptions purchased in our iOS app are processed by Apple through the App Store under Apple’s privacy policy; we never receive your payment details. We use RevenueCat, Inc. to manage these in-app subscriptions. RevenueCat receives your RewardArchitect account identifier (a random ID, not your name or email), your purchase and subscription status from Apple, and basic device information, and tells us which plan you have. RevenueCat’s privacy policy is available at https://www.revenuecat.com/privacy. If subscriptions are offered as in-app purchases on Android in the future, those payments would be processed by Google in the same way.

3.4 Approximate Location (Mobile Apps, Optional)

The Lounges Near Me feature in our iOS and Android apps can use your device’s approximate location to find the airport you are at and show its lounges. How it works:

• Only when you ask: The app requests location permission only when you tap “Find lounges near me,” and reads your location only while the app is open. It never tracks your location in the background.
• Approximate, not precise: The app requests approximate location (accurate to roughly a kilometer), which is enough to identify an airport. On Android, the app does not request precise location at all.
• Stays on your device: Your location is matched to nearby airports on your device using an airport list built into the app. Your location is not sent to us or to any third party, and we do not store it. Only the airport code you select (for example, “JFK”) is sent to our servers to look up that airport’s lounges, exactly as if you had typed the code yourself.
• Optional: You can decline or later revoke location permission in your device settings at any time. You can still search any airport by code without it.

4. How We Use Your Information

We use the information described above to:

1. Create and maintain your account and authenticate you;
2. Provide the core features of the Service — benefit tracking, spend optimization, sign-up bonus and retention tracking, lounge value analysis, and annual card-value reports — all of which operate on data you entered;
3. Generate AI-assisted results you request, such as answers to questions about your wallet, retention-call briefs, balance-transfer and transfer-bonus checks, and airport lounge summaries (see Section 5);
4. Process and manage your subscription (via Stripe);
5. Send transactional and service communications, such as password resets, subscription receipts, benefit-deadline or bonus-deadline reminders you have enabled, and material changes to the Service or this Policy;
6. Respond to your support requests;
7. Monitor, secure, and debug the Service, including detecting fraud, abuse, and unauthorized access;
8. Comply with legal obligations.

We do not use your personal information for third-party advertising, and we do not use the financial figures you enter for any purpose other than providing the Service to you.

Legal bases (EEA/UK users): Where the GDPR or UK GDPR applies, we process your data (a) to perform our contract with you (providing the Service you signed up for); (b) for our legitimate interests in securing and improving the Service, balanced against your rights; (c) with your consent, where required (e.g., optional marketing emails); and (d) to comply with legal obligations.

5. How We Share Information

We share personal information only in the following limited circumstances:

• Service providers: With vendors that perform services on our behalf and are bound to use your data only for that purpose. Currently these are:
  • Supabase and Vercel: database, authentication, and website hosting;
  • Stripe: subscription payments made on our website (see Section 3.3);
  • Apple and RevenueCat: in-app subscription payments and subscription management in our iOS app (see Section 3.3);
  • Anthropic: AI processing. When you use an AI-assisted feature (for example, asking a question about your wallet or requesting a retention-call brief), the card, benefit, points, and usage information relevant to that request is sent to Anthropic’s API to generate the result. AI features run only when you request them;
  • Google: reCAPTCHA spam protection on our support form, and email delivery for support messages.
• Legal compliance and protection: If required by law, subpoena, or other legal process, or where necessary to protect the rights, safety, or property of RewardArchitect, our users, or others.
• Business transfers: If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction; we will notify you before your information becomes subject to a different privacy policy.
• With your direction: If you explicitly ask us to share something.

We do not sell personal information, and we have not sold personal information in the preceding 12 months. We do not “share” personal information for cross-context behavioral advertising as those terms are defined under California law.

6. Data Retention

We retain your account and the data you have entered for as long as your account is active. If you delete your account, we delete your personal information and entered data within 30 days, except for limited records we are required to retain (e.g., payment/tax records held by or via Stripe, security logs) or data retained in routine encrypted backups, which are overwritten on a rolling basis within 90 days. Aggregated or de-identified data that can no longer reasonably be linked to you may be retained.

7. Account and Data Deletion

You can delete your account and all associated data at any time:

• In the app / on the website: Settings → Account → Delete Account; or
• On the web without the app: Visit https://rewardarchitect.com/delete-account; or
• By email: Send a request to info@rewardarchitect.com from the email address on your account.

Deletion is permanent and cannot be undone. Deleting your account automatically cancels a subscription purchased on our website (through Stripe). A subscription purchased in our iOS app can only be canceled by you, through your Apple ID’s subscription settings (Settings → your name → Subscriptions); deleting your account does not cancel it.

8. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights: to access the personal information we hold about you, to correct inaccurate information, to delete your information, to receive a portable copy of it, to opt out of sale/sharing/targeted advertising (not applicable — we don’t do these), and to not be discriminated against for exercising your rights.

To exercise any right, use the in-app tools described above or email info@rewardarchitect.com. We will verify your request using the email address associated with your account and respond within the time required by applicable law (generally 45 days in the U.S., 30 days in the EEA/UK). You may use an authorized agent where the law permits; we will require proof of authorization.

8.1 California Residents (CCPA/CPRA)

In the last 12 months we collected the categories of personal information described in Section 3: identifiers (email, IP address), internet/network activity (log data), and financial-adjacent information you voluntarily entered (self-reported card products, spending, and benefit usage). We collected it from you directly and automatically from your device, for the purposes in Section 4, and disclosed it only to the service providers in Section 5. We do not sell or share personal information, we have no actual knowledge of selling or sharing the personal information of consumers under 16, and we do not use or disclose sensitive personal information for purposes requiring a right to limit. California residents may exercise their rights via the methods above; because we do not sell or share data, no opt-out link is required, but we honor the Global Privacy Control (GPC) signal as an opt-out where applicable.

8.2 Other U.S. State Privacy Laws

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other states with comprehensive privacy laws may exercise the rights listed above using the same contact methods. If we deny a request, you may appeal by replying to our decision email with “Appeal” in the subject line.

8.3 EEA, UK, and Switzerland

You additionally have the right to object to processing based on legitimate interests, to restrict processing, to withdraw consent at any time (without affecting prior processing), and to lodge a complaint with your local supervisory authority. Our processing is described in Sections 3–5; we do not engage in automated decision-making that produces legal or similarly significant effects.

9. International Data Transfers

RewardArchitect is operated from the United States, and your information is stored on servers located in the United States. If you use the Service from outside the U.S., you understand that your information will be transferred to and processed in the U.S., where data protection laws may differ from those in your jurisdiction. For transfers from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses with our service providers where required.

10. Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect your information, including encryption of data in transit (TLS), password hashing, access controls, and hosting with reputable cloud infrastructure providers. Because you enter card products by name only and we hold no card numbers or bank credentials, the sensitivity of the data at risk is deliberately minimized by design. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you and regulators as required by applicable law.

11. Children’s Privacy

The Service is a financial planning tool intended for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18 years of age (and in no event under 13, or under 16 in the EEA/UK without parental consent). If we learn that we have collected personal information from a child, we will delete it promptly. If you believe a child has provided us information, contact info@rewardarchitect.com.

12. Do Not Track and Opt-Out Preference Signals

We honor the Global Privacy Control (GPC) browser signal as a valid opt-out request where required by law. Because we do not track users across third-party websites or serve targeted advertising, browser “Do Not Track” signals do not change how the Service operates.

13. Push Notifications and Reminders

The mobile apps do not currently send push notifications. Reminders about expiring benefits, upcoming annual fees, and expiring points are shown inside the Service (for example, on the Alerts screen). If we add push notifications in the future, we will ask for your permission on your device first and update this Policy, and any notification tokens would be used solely to deliver notifications you requested.

14. Third-Party Links

The Service may reference or link to credit card products, issuer websites, or airport lounge information. We are not affiliated with any card issuer, and those third-party sites have their own privacy policies. RewardArchitect provides informational tools only and does not provide financial advice.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes — especially any change to the categories of data we collect or how we share it — we will notify you by email or in-app notice before the change takes effect and update the “Last Updated” date above. Continued use of the Service after the effective date constitutes acceptance of the revised Policy.

16. Contact Us

Questions, concerns, or rights requests:

Quarterdeck Software LLC, doing business as Reward Architect
120 Jefferson Ave, 12018 Miami Beach, FL 33139
Email: info@rewardarchitect.com
Web: https://rewardarchitect.com