Privacy Policy

CardSignals is run by Hassan Khokhar, a sole proprietor in Ontario, Canada. It includes the iPhone, iPad and Android app, the Chrome extension and cardsignals.ca. Hassan Khokhar is our Privacy Officer and is responsible for the personal information described here. Contact: support@cardsignals.ca.

• We store the cards you add and the dates and amounts you enter, so we can show the best card to use and remind you about fees, credits and bonuses.
• We never ask for full card numbers, security codes, bank logins, balances or transactions, and we never connect to your bank.
• Your account data is stored in Canada. Some service providers, listed below, process limited data outside Canada.
• We don't sell your personal information and we don't show ads.
• You can export or delete your data in the app at any time.

Your account: your email address and password. Supabase handles sign-in; our own code never stores your password.

Your cards: which cards you hold or held, open and close dates, product switches, annual fee dates, welcome bonus terms and progress, and category picks. Only if you enter them: a nickname, the last 4 digits and notes.

Credits and bonus spending: how much of each statement credit you've used, merchants you picked, and any purchases you log toward a bonus.

Eligibility details: past application dates and bonuses you tell us about, used to estimate which cards you can get.

Optional profile: your province, rough monthly spending by category (in CAD, and in USD if you hold US cards), and rent details if you use the rent optimizer.

Other things you send us: card requests, notification settings, your waitlist or newsletter signup (email and optional first name), and support emails.

Created as you use it: the reminders we schedule and whether they were delivered; your push token and device model (not the name you gave your device); your Pro plan status, renewal date and the customer IDs our payment providers assign; and standard request logs (such as IP address, device type and time) kept by Supabase and Vercel for security and troubleshooting.

We don't collect: full card numbers, security codes or expiry dates; bank logins, balances, statements or transactions; your precise location; or your contacts, photos or files.

• Show which of your cards earns the most for a purchase or on a website.
• Track bonuses, credits and annual fees, and send the reminders you turn on.
• Estimate which new cards you can get and show offers that fit.
• Model rent payment options in the rent optimizer.
• Run your account: sign-in, password resets and your Pro status.
• Add cards people ask for, answer support emails and fix bugs.

We don't sell or rent your information, use it for advertising, use it for credit decisions, or share it with card issuers.

Your account and everything you enter in the app is stored in our Supabase database in Canada. Each signed-in user can only read and change their own data. Some requests (adding a card, deleting your account, the extension's Pro check) go through server functions that run in the nearest region, in Canada or the US. They pass data through and don't keep a copy.

The app and extension also keep your sign-in and a copy of your cards on your device so they work offline.

Each provider gets only what it needs.

Some buttons open a partner or card issuer page, directly or through a cardsignals.ca/go link (for example Chexy in the rent optimizer). These links can carry our referral code and which part of CardSignals you came from, never your name, email or account ID. We may earn a referral fee. Once you're on their site, their privacy policy applies.

We may disclose information if required by law, or to protect the rights and safety of our users or others.

Providers outside Canada process the limited data listed above. Data processed in another country is subject to that country's laws, and its courts and authorities may be able to access it. Our providers are bound by data processing agreements to protect the data they handle for us.

The extension shows which of your cards earns the most on the site you're on, and can add American Express offers to your card when you ask it to.

• It checks the address of your current tab against our list of about 225 shopping, travel and streaming sites, on your computer. The address is never sent to us or logged. It doesn't run on other sites.
• The on-page panel only shows an answer. It doesn't read the page's text, forms, prices or cookies.
• On the Amex Canada offers page, and only when you click "Add all offers", it clicks "Add to Card" for you. It reads the offer list and card names there, keeps them on your computer, and sends nothing from that page to us except anonymous counts (added, skipped, failed). It never reads your Amex login, balances or transactions.
• It stores your sign-in, a copy of your cards, sites where you hid the panel, and a random install ID on your computer. While adding Amex offers it also keeps the last digits of each card it processed, until you close the browser.

We use these to see which features are used and to fix bugs. We never link usage analytics to your account and never use it for advertising.

• App (PostHog): screens you open, app install and open events, and a few named events (card added, onboarding finished and similar), with basic device details such as model, OS version and language. Taps are not recorded, your location is not estimated, and screen recording is off.
• Extension (PostHog): four events (popup opened, answer shown, panel shown, Amex run finished) with a random ID. No website addresses, card details, email or account ID. PostHog may estimate your country from your IP address; it doesn't store the IP.
• Website (PostHog and Vercel): page views and clicks, with an anonymous ID in a cookie and local storage. PostHog may estimate your country, region and city from your IP address; it doesn't store the IP. Screen recording is off.
• Errors (Sentry): crash reports from the app, website and servers. Before sending, we remove emails, sign-in tokens, anything shaped like a card number, and fields such as notes, nicknames, last 4 digits, rent, addresses and IP addresses. Reports from our servers can include your account ID so we can fix a problem with your account.

• Account emails (confirm your email, reset your password) when you sign up or ask for them.
• Reminders about annual fees and expiring credits, by push or email, as you set them in the app.
• An offers digest, only if you turn it on (weekly, every 2 weeks or monthly). It goes by push. We only email it if you also turn on "Offer digest by email" in Settings.
• Every reminder email has an unsubscribe link, and you can turn email or push off in the app at any time.

You can buy CardSignals Pro in the app through the App Store or Google Play, or on our website through Stripe. We never see your payment card details. Stripe gets your email and account ID to link the purchase to your account, and your billing address to charge the right sales tax. RevenueCat tracks whether your subscription is active so the app and extension can unlock Pro. We store your plan, status, renewal date and the customer IDs these services assign.

• Your account data: until you delete your account.
• When you delete your account, we delete it right away from our database: your account, cards, credits, bonus log, eligibility details, profile, reminders, notification settings, push tokens, card requests, subscription record, and any waitlist or newsletter signup under your email. Database backups roll over within 7 days, and we never restore deleted accounts from them.
• An internal credit-tracking log can still hold your former account ID, which no longer points to any account or email.
• Data held by our service providers (analytics, error reports, email logs, request logs, payment records) is kept under each provider's own settings.
• Payment and tax records are kept for 6 years, as Canadian tax law requires.
• Deleting your account doesn't cancel a paid subscription. Cancel it first in the App Store, Google Play or with us.

Under Canadian privacy law (PIPEDA) you can:

• See your data: in the app, Settings, then Data & privacy, then Export my data. For data held by our providers, email us.
• Correct it: edit any card, date, amount or setting in the app, or email us.
• Delete it: in the app, open Settings, scroll to the bottom and tap Delete account under Danger zone, or see our account deletion page.
• Withdraw consent: turn off email or push in the app, unsubscribe from any email, or sign out of or remove the extension. Some features may stop working.
• Complain: email support@cardsignals.ca. If you're not satisfied, contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).

We answer requests within 30 days.

Data travels over encrypted connections. The database only lets each signed-in user reach their own data, and server functions check who is calling before they act. No system is perfectly secure. If a breach creates a real risk of significant harm, we will tell you and the Privacy Commissioner as the law requires.

CardSignals is for adults. You must be 18, or the age of majority where you live if that is higher. We don't knowingly collect information from anyone younger. If you think a minor has given us information, email us and we will delete it.

If we change how we handle your information, we'll update this page and the date at the top. For significant changes, we'll also tell you in the app or by email before they take effect.

Questions about your privacy: support@cardsignals.ca. We're based in Ontario, Canada.