Policy version 1.0

Who we are

RewardSherpa (rewardsherpa.com) is a free website that tells you which of your credit cards to use for each kind of purchase. It is run from the United States. In this policy, "we" means RewardSherpa.

Using the site without an account

You do not need an account. The cards you pick are kept in your own browser (its local storage), not on our server.

To show your table, your browser sends us the list of cards you picked. We work out the table and send it back. We do not store that list.

If you sign in later, the cards you picked in that browser are saved to your account.

If you ask for a sign-in code, we store your email address and the IP address of the request for up to 2 days, to stop abuse. The email is sent through Google Workspace.

If you try to sign in with a passkey, we keep the IP address of the request for a few minutes, to stop abuse.

Our web server keeps a standard request log (IP address, page, time and browser) for 14 days to run the site and stop abuse.

Our web firewall keeps a copy of requests it blocks as attacks for up to 35 days, to stop abuse.

What we collect when you have an account, and why

• Your email address. It is your account. We use it to sign you in and to email you about your account and about changes to this policy.
• How you sign in. If you use Google, we keep your Google account ID. If you use a passkey, we keep its public key and a label such as "iPhone". A public key cannot be used to sign in as you.
• Sessions. A record that keeps you signed in, until 30 days after your last visit, or until you sign out.
• Sign-in history. The time, the sign-in method, your IP address and your browser's description of itself (its user agent). This helps you and us spot a sign-in that was not you.
• Email sign-in codes. We store them only in scrambled (hashed) form, with the IP address that asked for them, so we can limit abuse. We delete them after 2 days.
• Your saved cards, by name only. Either a card from our list, or a name, reward rates and annual fee you type in. You can add a nickname and the last 4 digits of the card as a label. We never take a full card number.
• Sign-up bonus progress that you enter: the spending goal, the deadline, the bonus value and how much you have spent.
• The version of this policy you accepted when you signed up.

Cookies and tracking

We use cookies only for signing in and keeping you signed in.

There are no analytics, no ads, no trackers and no third-party scripts on this site.

What we never do

• We never sell your data.
• We never share your data for advertising.
• We never give or sell your data to data brokers.
• We never ask for a full card number, a card security code or a bank password.

Who handles your data for us

• Google Workspace (Gmail) sends our email, so it handles your email address and the messages we send you.
• If you choose to sign in with Google, Google confirms who you are. Its own privacy policy covers that.
• The site and its database run on a server that we operate in the United States.

No one else gets your data. We would share it only if the law requires it, such as a valid court order.

How long we keep it

• Your account data: until you delete your account.
• Email sign-in codes: 2 days.
• Sessions: until 30 days after your last visit, or until you sign out.
• Web server request logs: 14 days.
• Requests our web firewall blocks as attacks: up to 35 days.
• Backups: 30 days. After that they are gone for good.

Your choices

• See and change your saved cards at any time.
• Download a copy of your data from your account page.
• Delete your account from your account page. It happens right away: your cards, bonus progress, passkeys, sign-in history and sessions are removed, and you are signed out everywhere.
• Copies in our backups age out within 30 days.
• Anything else, email info@rewardsherpa.com.

Your privacy rights in US states

Some US states give residents rights over their personal data. We give the same rights to everyone, wherever you live:

• Access: see what we have and get a copy.
• Delete: remove your data.
• Correct: fix anything that is wrong.

There is nothing to opt out of: we do not sell your data, we do not share it for advertising, and we do not use it to profile you. We will never treat you differently for using these rights. Use your account page, or email info@rewardsherpa.com. If we turn down a request, reply to that email and ask us to reconsider.

Children

RewardSherpa is not for anyone under 18. If we learn that we hold data about someone under 18, we delete it.

Security

The site uses an encrypted connection (HTTPS) everywhere. There are no passwords to steal: you sign in with Google, a passkey or a code we email you. Sign-in codes are stored scrambled. The database is not reachable from the internet, and only RewardSherpa can get to it.

No system is perfectly safe. If something goes wrong that affects your data, we will email you.

Features we may add later

None of these are on the site today: reminders based on your location when you are at a store, a browser extension, connecting a bank account through Plaid, and importing your purchase history from a file (CSV).

If we add any of them, we will update this policy first, and each one will be off until you choose to turn it on.

Changes to this policy

Each version has a number and a date, shown at the top of this page. Before a change takes effect, we email you at least 30 days ahead. Every past version stays online at /privacy/history.

Contact

Questions or requests: info@rewardsherpa.com.

The short version

RewardSherpa is a free tool that gives you information. It is not financial advice. Check card details with the bank before you rely on them.

Agreeing to these terms

By using RewardSherpa you agree to these terms and to our privacy policy. If you do not agree, please do not use the site. You must be 18 or older to create an account.

Information, not advice

The site shows which of your cards is likely to earn the most for a kind of purchase, based on the rates we know about and the rates you enter. It does not know your full finances. It is not financial, tax or legal advice. You decide which card to use and which cards to apply for.

Card terms change

Banks change rewards, fees, bonus offers and categories, sometimes without notice. Our information may be out of date or wrong. The bank that issues a card decides who is approved and what you earn. Always check the current terms with the issuer.

Your account

Keep your email and your sign-in methods safe. You are responsible for what happens in your account. Do not enter full card numbers anywhere on the site.

We may suspend or close an account that abuses the site, for example by trying to break in, overload it, or use it to harm others. You can delete your account at any time.

No warranty

The site is provided as it is, free of charge. We do our best, but we do not promise it will always be available, accurate or free of errors.

Limits on our responsibility

As far as the law allows, we are not responsible for any loss that comes from using the site or relying on it. That includes missed rewards, fees, interest, a declined application or a lost bonus. If we are found responsible anyway, the most we owe you is $50.

Changes to these terms

Each version has a number and a date. We email you at least 30 days before a change takes effect. Past versions stay online at /privacy/history.

Governing law

These terms are governed by the laws of the State of Colorado, in the United States.

Contact

Questions: info@rewardsherpa.com.

Today

RewardSherpa earns nothing from any bank or card. There are no referral links, ads or paid placements on the site.

How we may earn money later

To keep the site free, we may one day add referral links. If you open a card through one, the bank may pay us a fee. It costs you nothing extra. If we add them, we will update this page first and mark each referral link clearly.

Our ranking rule

Rankings are based only on what benefits you: the rewards you would earn with the cards you have. A referral fee never changes the order. A referral link is only ever attached to a card that already ranked where it is on its own merits.

Contact

Questions: info@rewardsherpa.com.