Privacy Policy

This policy describes how Worth My Fee ("we," "us") collects, uses, stores, and deletes your information when you use our website and application (the "Service"). The short version: we collect the minimum needed to audit your card benefits, we never see or store your bank credentials, we don't sell your data, and you can delete everything at any time.

1. Information we collect

• Account information. When you sign in with Google or with an email link, we receive your email address and a unique account identifier. We use this to create and secure your account.
• Financial account data via Plaid. When you choose to connect a credit card, we use Plaid Inc. ("Plaid") to retrieve read-only data about that account: account name and type, and transaction history (dates, amounts, merchant names, and categories). We use this solely to analyze which card benefits your spending can reach. We never receive, see, or store your banking username or password — you authenticate directly with your bank through Plaid, typically via your bank's own sign-in page.
• Information you provide. Which card an unrecognized account is (when your bank reports a program name instead of a card name), and loyalty-program details you choose to share (for example, hotel or airline status levels, stays or flights per year, and a status you are requalifying for). This information powers the benefit and conflict analysis you ask us to perform.
• Payment information. If you buy an audit year, Stripe processes the payment. Card numbers are entered on Stripe's pages and never reach our systems; we store the fact and date of the purchase, Stripe's identifiers for your customer record, checkout session and subscription, the subscription's status, and whether it was refunded or canceled. Stripe keeps its own payment records after you delete your account, under Stripe's privacy policy.
• December 31 reminder (no account needed). If you ask on our December 31 page to be emailed on December 1, we store your email address and the cards you picked. We send a confirmation link first and nothing else until you click it. After the reminder goes out we delete both, unless you also ticked occasional product news, in which case we keep only your address and that choice until you remove it. An unconfirmed sign-up is deleted after seven days, and every email carries a one-click remove link that deletes your address immediately.
• Technical information. Standard server logs (IP address, browser type, timestamps) used for security and reliability, and error reports sent to Sentry that contain technical diagnostics and your account identifier — never your transactions, email, or name. We do not use advertising trackers.

2. How we use your information

• To operate the Service: matching your transactions against card benefits, scoring reachability, detecting conflicts with your loyalty programs, and generating your audit results.
• To secure the Service: authentication, fraud prevention, and abuse detection.
• To communicate with you about your account or the Service.
• To send the December 31 reminder you asked for, and product news only if you ticked that box.

We do not sell or rent your personal information. We do not share your data with advertisers. We do not use your financial data for marketing.

We keep a small set of product events in our own server logs for 30 days: which screen a visit reached, whether a sign-in or bank connection succeeded or failed and the error code, whether an audit rendered and how many cards it covered, whether checkout started, and, when the link you followed was one of ours that says so, which ad or post brought you here (one name from a fixed list, such as google_ads or reddit). They are tied to a random identifier that exists only for that page load. An event record holds no account identifier, email, IP address, merchant, or amount, and the list of what it can hold is fixed in our code. This system is first-party only — no third-party analytics and no session recording — and browsers that send Do Not Track or Global Privacy Control are not sent even these events. Our public marketing pages at worthmyfee.com, before you sign in, separately use PostHog, a third-party analytics tool, to see which pages and links visitors reach. It is not present anywhere in the signed-in application at app.worthmyfee.com, so it never sees your account, a bank connection, or your financial data. It records page views and clicks only, never keystrokes or page content, respects Do Not Track and Global Privacy Control, and we keep its session recording turned off. These marketing pages are served from Google Cloud, whose standard request logs (IP address, user agent, page requested and time) are kept for 30 days and used only to see which search engines and AI crawlers read the site; the crawler records we send to PostHog contain no IP address.

3. Plaid

We use Plaid to connect to your financial institutions. By using the Service and connecting an account, you grant Worth My Fee and Plaid the right to access and transmit your financial account data as described in this policy and in Plaid's own policy. Plaid's collection and use of your information is governed by the Plaid End User Privacy Policy. You can manage or revoke Plaid connections at any time from the Service's settings, or through the Plaid Portal.

4. How we store and protect your data

• Your data is stored with Google Cloud (Firebase Authentication and Cloud Firestore) in the United States.
• Plaid access tokens — the credentials that allow us to retrieve your transaction data — are encrypted with AES-256-GCM before being stored, and are only ever decrypted server-side. They are never sent to your browser or to any third party other than Plaid.
• To avoid re-downloading your history from Plaid on every audit, we keep a server-side cache of your transactions (dates, amounts, merchant names, and categories — never card numbers) for each connected bank. It holds up to 24 months of history, the most Plaid provides, and is deleted when you disconnect that bank or delete your account.
• Access to your data is restricted by per-user security rules: your data is readable only by your authenticated account and by our servers.
• All data is transmitted over TLS (HTTPS).

5. Data retention and deletion

• We retain your data for as long as your account is active.
• Disconnecting a card revokes our access at Plaid and deletes the stored connection token.
• Disconnecting a bank also deletes its cached transactions.
• Deleting your account removes your account record, card selections, loyalty details, cached transactions, and all Plaid connections (we revoke each one at Plaid first). It also cancels any active subscription. This is available in the Service's settings and takes effect immediately. One server-only record survives: that your account identifier, and a one-way keyed hash of your sign-in email, once held a founding-cohort slot (no transactions), so a deleted account cannot claim a second free window.
• If your audit year ends and you do not renew, we disconnect your banks at Plaid and delete their cached transactions 30 days later; the app shows the date for those 30 days. Free-tier connections (no audit year) are removed 30 days after linking, because Plaid bills us monthly for every connected bank. Your account and settings remain until you delete them, and you can re-link at any time.
• December 31 reminder sign-ups are deleted once the reminder is sent (or kept as address-only if you chose product news), seven days after sign-up if never confirmed, or immediately through the remove link in any of these emails.
• Residual copies in encrypted backups are purged on the backup provider's standard cycle.

6. Sharing

We share data only with the service providers required to operate the Service — Plaid (bank connectivity), Google Cloud (authentication, database, and hosting), Stripe (payments), Resend (the few emails we send: your address, a card name and the audit's advice for it, or the December 31 reminder you asked for), and Sentry (error monitoring) — each acting under their own security and privacy obligations. We publish anonymized, aggregated statistics (for example, the share of advertised credits the median cardholder reaches); these never identify a person or an account. We also keep two cross-user tallies that improve matching: merchant strings our catalog could not recognize, and the link between a merchant identifier and a benefit's merchant string. They hold counts only — no account, person or pseudonym — skip medical, government, non-profit, personal-care, legal, income, loan and rent categories entirely, and a string is used only once at least two people's histories contain it. We may disclose information if required by law, or to protect the rights, safety, or property of Worth My Fee or others. If Worth My Fee is involved in a merger or acquisition, your data may transfer with the business; this policy would continue to apply until amended with notice to you.

7. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information. You can delete everything directly in the Service (Settings → Delete account); for access, correction, or export requests, email us. We respond to all requests within 30 days.

8. Children

The Service is not directed to individuals under 18, and we do not knowingly collect information from them.

9. Changes to this policy

If we make material changes, we will notify you by email or an in-app notice before the changes take effect, and update the effective date above.

10. Contact

Questions or requests: privacy@worthmyfee.com.