Privacy Policy

This policy describes how Worth My Fee ("we," "us") collects, uses, stores, and deletes your information when you use our website and application (the "Service"). The short version: we collect the minimum needed to audit your card benefits, we never see or store your bank credentials, we don't sell your data, and you can delete everything at any time.

1. Information we collect

• Account information. When you sign in with Google, we receive your email address and a unique account identifier. We use this to create and secure your account.
• Financial account data via Plaid. When you choose to connect a credit card, we use Plaid Inc. ("Plaid") to retrieve read-only data about that account: account name and type, and transaction history (dates, amounts, merchant names, and categories). We use this solely to analyze which card benefits your spending can reach. We never receive, see, or store your banking username or password — you authenticate directly with your bank through Plaid, typically via your bank's own sign-in page.
• Information you provide. Cards you add, annual fees and renewal dates, benefits you track, redemptions you log, and loyalty-program details you choose to share (for example, hotel or airline status levels). This information powers the benefit and conflict analysis you ask us to perform.
• Technical information. Standard server logs (IP address, browser type, timestamps) used for security and reliability. We do not use advertising trackers.

2. How we use your information

• To operate the Service: matching your transactions against card benefits, scoring reachability, detecting conflicts with your loyalty programs, and generating your audit results.
• To secure the Service: authentication, fraud prevention, and abuse detection.
• To communicate with you about your account or the Service.

We do not sell or rent your personal information. We do not share your data with advertisers. We do not use your financial data for marketing.

3. Plaid

We use Plaid to connect to your financial institutions. By using the Service and connecting an account, you grant Worth My Fee and Plaid the right to access and transmit your financial account data as described in this policy and in Plaid's own policy. Plaid's collection and use of your information is governed by the Plaid End User Privacy Policy. You can manage or revoke Plaid connections at any time from the Service's settings, or through the Plaid Portal.

4. How we store and protect your data

• Your data is stored with Google Cloud (Firebase Authentication and Cloud Firestore) in the United States.
• Plaid access tokens — the credentials that allow us to retrieve your transaction data — are encrypted with AES-256-GCM before being stored, and are only ever decrypted server-side. They are never sent to your browser or to any third party other than Plaid.
• Access to your data is restricted by per-user security rules: your data is readable only by your authenticated account and by our servers.
• All data is transmitted over TLS (HTTPS).

5. Data retention and deletion

• We retain your data for as long as your account is active.
• Disconnecting a card revokes our access at Plaid and deletes the stored connection token.
• Deleting your account removes your account record, connected cards, benefits, redemptions, loyalty details, and all Plaid connections. This is available in the Service's settings and takes effect immediately.
• Residual copies in encrypted backups are purged on the backup provider's standard cycle.

6. Sharing

We share data only with the service providers required to operate the Service — Plaid (bank connectivity) and Google Cloud (authentication, database, and hosting) — each acting under their own security and privacy obligations. We may disclose information if required by law, or to protect the rights, safety, or property of Worth My Fee or others. If Worth My Fee is involved in a merger or acquisition, your data may transfer with the business; this policy would continue to apply until amended with notice to you.

7. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information. You can exercise all of these directly in the Service (settings → export / delete), or by emailing us. We respond to all requests within 30 days.

8. Children

The Service is not directed to individuals under 18, and we do not knowingly collect information from them.

9. Changes to this policy

If we make material changes, we will notify you by email or an in-app notice before the changes take effect, and update the effective date above.

10. Contact

Questions or requests: privacy@worthmyfee.com.