Privacy policy

Who we are

RewardSherpa (rewardsherpa.com) is a free website that tells you which of your credit cards to use for each kind of purchase. It is run from the United States. In this policy, "we" means RewardSherpa.

Using the site without an account

You do not need an account. The cards you pick are kept in your own browser (its local storage), not on our server.

To show your table, your browser sends us the list of cards you picked. We work out the table and send it back. We do not store that list.

If you sign in later, the cards you picked in that browser are saved to your account.

If you ask for a sign-in code, we store your email address and the IP address of the request for up to 2 days, to stop abuse. The email is sent through Google Workspace.

If you try to sign in with a passkey, we keep the IP address of the request for a few minutes, to stop abuse.

Our web server keeps a standard request log (IP address, page, time and browser) for 14 days to run the site and stop abuse.

Our web firewall keeps a copy of requests it blocks as attacks for up to 35 days, to stop abuse.

What we collect when you have an account, and why

• Your email address. It is your account. We use it to sign you in and to email you about your account and about changes to this policy.
• How you sign in. If you use Google, we keep your Google account ID. If you use a passkey, we keep its public key and a label such as "iPhone". A public key cannot be used to sign in as you.
• Sessions. A record that keeps you signed in, until 30 days after your last visit, or until you sign out.
• Sign-in history. The time, the sign-in method, your IP address and your browser's description of itself (its user agent). This helps you and us spot a sign-in that was not you.
• Email sign-in codes. We store them only in scrambled (hashed) form, with the IP address that asked for them, so we can limit abuse. We delete them after 2 days.
• Your saved cards, by name only. Either a card from our list, or a name, reward rates and annual fee you type in. You can add a nickname and the last 4 digits of the card as a label. We never take a full card number.
• Sign-up bonus progress that you enter: the spending goal, the deadline, the bonus value and how much you have spent.
• The version of this policy you accepted when you signed up.

Cookies and tracking

We use cookies only for signing in and keeping you signed in.

There are no analytics, no ads, no trackers and no third-party scripts on this site.

What we never do

• We never sell your data.
• We never share your data for advertising.
• We never give or sell your data to data brokers.
• We never ask for a full card number, a card security code or a bank password.

Who handles your data for us

• Google Workspace (Gmail) sends our email, so it handles your email address and the messages we send you.
• If you choose to sign in with Google, Google confirms who you are. Its own privacy policy covers that.
• The site and its database run on a server that we operate in the United States.

No one else gets your data. We would share it only if the law requires it, such as a valid court order.

How long we keep it

• Your account data: until you delete your account.
• Email sign-in codes: 2 days.
• Sessions: until 30 days after your last visit, or until you sign out.
• Web server request logs: 14 days.
• Requests our web firewall blocks as attacks: up to 35 days.
• Backups: 30 days. After that they are gone for good.

Your choices

• See and change your saved cards at any time.
• Download a copy of your data from your account page.
• Delete your account from your account page. It happens right away: your cards, bonus progress, passkeys, sign-in history and sessions are removed, and you are signed out everywhere.
• Copies in our backups age out within 30 days.
• Anything else, email info@rewardsherpa.com.

Your privacy rights in US states

Some US states give residents rights over their personal data. We give the same rights to everyone, wherever you live:

• Access: see what we have and get a copy.
• Delete: remove your data.
• Correct: fix anything that is wrong.

There is nothing to opt out of: we do not sell your data, we do not share it for advertising, and we do not use it to profile you. We will never treat you differently for using these rights. Use your account page, or email info@rewardsherpa.com. If we turn down a request, reply to that email and ask us to reconsider.

Children

RewardSherpa is not for anyone under 18. If we learn that we hold data about someone under 18, we delete it.

Security

The site uses an encrypted connection (HTTPS) everywhere. There are no passwords to steal: you sign in with Google, a passkey or a code we email you. Sign-in codes are stored scrambled. The database is not reachable from the internet, and only RewardSherpa can get to it.

No system is perfectly safe. If something goes wrong that affects your data, we will email you.

Features we may add later

None of these are on the site today: reminders based on your location when you are at a store, a browser extension, connecting a bank account through Plaid, and importing your purchase history from a file (CSV).

If we add any of them, we will update this policy first, and each one will be off until you choose to turn it on.

Changes to this policy

Each version has a number and a date, shown at the top of this page. Before a change takes effect, we email you at least 30 days ahead. Every past version stays online at /privacy/history.

Contact

Questions or requests: info@rewardsherpa.com.