Privacy Policy
Last Updated: November 9, 2026
1. Information Collected
We collect your email address; if you connect a bank through Plaid, your transactions and each account's name, type and last four digits; the spending estimates, cards and preferences you enter; the messages you send in chat; a record when you tap an Apply link; and any place-category corrections you make on the Scan map, or on a store you pick on the website. The iOS app also tells Meta when it's installed and opened (see § 5). On our homepage, our TikTok page and the website's sign-up page, we also record visits through PostHog: the pages you visit, the buttons you tap there, your browser and device type, an approximate location (country and city), the website or campaign link that brought you, and a visitor ID stored in your browser so a return visit is recognised. We don't record what you type, and nothing is recorded once you're signed in.
2. Use of Information
We use your data to provide the Service: recommendations, card values and answers in chat. We don't use your financial, account or chat data for advertising. The iOS app tells Meta when it is installed and opened, so we can measure which of our ads on Meta lead to installs (see § 5). We record when you tap Apply on the website, to measure which parts of the site lead people to apply. Poiiints isn't paid for these taps; if that ever changes, this policy and our Disclosures will say so first.
3. No Sale of Data
We do not sell personal or financial data to third parties. Your financial and account information (your bank connection, transactions, cards, spending estimates and chat) is never shared for marketing or advertising purposes. The only data used for advertising is the install and launch signal the iOS app sends to Meta to measure our own ads (§ 5).
4. Data Security
All data travels over HTTPS, and only your signed-in session can read your data.
5. Service Providers
We share data only with the providers that run the Service: Plaid (bank connections), Railway (server and database), Vercel (website), Resend (sign-in emails), OpenRouter (AI chat), Google (maps and store search), PostHog (measuring visits to our public web pages) and Meta (measuring installs from our ads). We use PostHog only to measure which pages and channels bring visitors, never for advertising. In the iOS app, Meta's software tells Meta when the app is installed and each time it is opened, with information about the device and app (such as the device model, iOS version and app version) and an identifier for the app on your device, and, if Meta's software itself crashes, a crash report. We use this only to measure which of our ads on Meta lead to installs. The app doesn't ask to track you and never sends Meta your advertising identifier, your account, your cards, your bank or Plaid data, your transactions, your spending or your chat. Meta's use of this data is subject to the Meta Privacy Policy (https://www.facebook.com/privacy/policy). Google's maps and store search are subject to the Google Privacy Policy (https://policies.google.com/privacy). To answer a chat message, we send it to OpenRouter, which passes it to a provider that runs the AI model (currently Claude Haiku 5.5, made by Anthropic). We set OpenRouter to use only providers that don't store or train on your data. When you use chat, we send your message, your last 10 chat messages, and a summary of your data: your total spending, your top five spending categories with their totals, your 50 most recent purchases (merchant, amount and category), the names and terms of your cards, the categories you spend in (names only, no amounts) with which of your cards earns the most in each, and your recommended cards with what each is best for and the estimated gain. If you haven't connected a bank, or it has no purchases yet, those categories come from the spending estimates you enter. We don't send your name or email address, but some purchase descriptions can include names.
6. Location and Camera
On the Scan map, your location is used to centre the map, and Google's map, which may receive your location, shows the area around you. When you tap a store, we send Google that store, not your location. Poiiints doesn't save your location. On the website, store search sends what you type and the map area you're viewing to Google; your location isn't used. Google's map also collects diagnostic and usage data under Google's own privacy policy. If you correct a place's category, we save that correction to your account until you change it or delete your account. To have it removed sooner, email eann@getpoiiints.com. The camera reads a price on your phone to fill in an amount. Nothing from the camera is saved or sent.
7. User Rights
You can delete your account and data at any time in Settings. You can withdraw chat's permission to use an AI provider, or delete your chat history, at any time in Settings → Chat. To request a copy of your data or a correction, email eann@getpoiiints.com.
8. Contact
For privacy inquiries, contact: eann@getpoiiints.com
9. Poiiints in ChatGPT and Claude
You can use Poiiints inside ChatGPT or Claude without a Poiiints account; this section covers that use. ChatGPT and Claude each reach Poiiints at their own address, which tells us only which assistant sent the request, not who you are. Poiiints receives only what the assistant sends for your question: monthly spending totals by category (for example groceries or dining, in whole dollars) and, where you give them, your rent, your time zone, the cards you hold or want compared, your answers about those cards, and for a single purchase its category, amount and the merchant's name. We don't receive your name, email address, account numbers or individual transactions. If you ask the assistant to use your connected accounts (for example ChatGPT's Finances), the assistant works out the monthly totals on its side and sends Poiiints only those totals. Nothing is stored: the service that answers ChatGPT and Claude has no database, keeps no copy of your request or of the result, and isn't connected to the Poiiints app or to any account. For each request it logs one line (which assistant and tool, whether it succeeded, how many spending categories, cards and answers it had, and how long it took), never an amount, a category name, a card, an answer, your time zone, the request or the result; Railway, which hosts the service, keeps these lines, with its own record of each request, for a limited time set by its plan (7 days on its Hobby plan, 30 on Pro, up to 90 on Enterprise). ChatGPT sends an anonymous identifier with each request, which we use only to limit how many requests come in a row, after a one-way hash with a secret that changes whenever the service restarts; it is never stored or logged. What you type into ChatGPT or Claude, and what they keep, is governed by OpenAI's and Anthropic's own policies.