Privacy Policy

1.Information We Collect

We collect the following categories of information:

• Account information. Your name, email address, and authentication data, managed through our identity provider (Clerk).
• Date of birth. Signup asks for your age in years for an 18-or-older check. From that age, we derive December 31 of the inferred birth year and store the derived date encrypted on a separate age-check record, not on your main account record, which holds only the date you were verified. This is not your exact birthday. If you are under 18, we record that the attempt happened without keeping your age or a derived date. The encrypted date stays as long as your account does and is deleted with it under the schedule in Section 8. Turning on Pikt Personal separately asks for your full date of birth — see Section 1d, which also covers what leaving the program deletes.
• Financial connectivity data. When you link a financial account, the bank connection provider you choose retrieves the data described in Section 2 below. We do not receive or store your bank login credentials; those are handled by that provider or your bank.
• Usage data. Simulations you run, offers you add, recommendations shown, and similar activity within the Service. This also covers how fast pages loaded for you, and which link brought you to us when you arrived through one of our own campaign links (Section 9).
• Merchant and location searches. The store words you type in Card Check and, if you choose to provide it, a ZIP code or location used to find nearby results. Section 5 names the search providers that may receive these details.
• Email engagement. Whether an email we sent you was delivered, delayed, bounced, suppressed, opened, or clicked. In product analytics, we keep the type of email and, for a click, which page on our own site it led to — never the address, subject line, or text of the email. Section 5 describes how this is measured and Section 8 how to limit the PostHog copy.
• Daily page counts. A handful of pages — our landing page, and the page your browser opens if you remove the Pikt Checkout extension — add one to a daily tally on our own servers so we can see how many people arrived or left. No cookie is read or set, no identifier is created, and nothing in that tally could be traced to you or joined to your account. Because there is no cookie and no identifier, these tallies are not covered by the cookie banner and run whichever choice you made.
• Card credits you track. When you mark that you used an issuer credit (for example an annual travel credit), we keep the credit name, the amount, the period, and any note or linked purchase you attach. We use this only to show your remaining credits and to help you use them before they reset.
• Billing data. Subscription status and customer identifiers. Card and payment details are collected and stored by Clerk and Stripe, not by Pikt.
• Support communications. If you start a chat in the app or email us, we keep your message, your name and email address, and our replies, so we can answer you and follow up. Support chat is handled by Crisp (Section 5).
• Technical data. Device and browser information, and log data used for security and reliability. Our hosts see an IP address to serve the page and to stop abuse. Product analytics does not store your IP address or a precise location (postal code, latitude, or longitude). This includes error reports when something breaks, which we use only to diagnose and fix faults.

1a.Pikt Checkout Browser Extension

The optional Pikt Checkout browser extension provides rewards-card assistance on checkout pages you are already visiting: it estimates which card is likely to earn the most, points at the card-number field so your browser’s own saved cards can fill it, may show related card-offer reminders, and may show a clearly labeled sponsored pick of a card you already have. It never issues a card, never processes or moves money, and never sits in the middle of a payment. This section describes exactly what the extension reads, what it sends, and what stays on your device.

Where the extension runs

Once you install it, a small piece of Pikt code loads on every ordinary https web page you open — not only shopping sites, and not plain http pages. There is no published list of which pages on the internet are checkout pages, so the only way for Pikt to show up at the right moment is to be present and check.

What that code does on each page is narrow. It looks at the page you are on and asks one question: does this look like a checkout — is there a card-number field, or does the web address plus a real “place order” button plus a payment form point at a payment step? On the overwhelming majority of pages the answer is no. When the answer is no:

• nothing is sent to Pikt, and nothing is stored — except an unexpected throw inside Pikt’s own packaged scripts, described below, and on a page that is not a checkout that report carries no hostname or address;
• no panel appears and you never see Pikt on the page — the one exception is the optional “did you use that card?” question, which can appear on the order page right after you place an order on the same store;
• one more exception, on web-search results pages only (Google, Bing, DuckDuckGo, Brave, Yahoo, Ecosia, Startpage, Kagi): the code reads the destination addresses of the result links, and may also read the search term and result titles on the page, then compares those locally against your own list of offers, which the extension fetches from your Pikt account without describing the page. Only when a store name or result link matches an offer you have does a strip appear naming that store, the offer, and the card. Your search term and result titles stay on your device and are never sent or stored, and the result links are never stored or sent. You can turn this off from the strip or from the popup’s Settings;
• the code keeps watching that one page for up to about three minutes, in case a payment step loads in later (many stores build checkout that way), and then stops watching. That watching happens entirely on your device.
• it runs only on the main page, never inside embedded frames such as ads, and only on pages you open yourself.

Pikt does not build a history of the sites you visit, and the list of pages you open is never sent to us. Only a page that passes the checkout question above leads to anything leaving your device — except the optional Swipe Correct answer described below, which you may send from the order page, and unexpected throws inside Pikt’s own packaged scripts — and what leaves is described next.

What the extension reads from the page

• On a page that passes the checkout check above, the extension reads page content to identify the merchant, the purchase category, and an approximate purchase amount, and to locate the payment form fields. Merchant identification may use a packaged store catalog, a cleaned checkout page title on a hosted payment page, or a short “Sold by” / store-name snippet on a marketplace listing. On a marketplace cart or checkout page, it may also read a short product or brand label on the page and compare it, on your device, to your own offer list — that label is never sent. For up to thirty minutes after you place an order on that store, it also reads the page title and headings of pages you land on next, for one question only: does this page look like an order confirmation? That is what decides when the Swipe Correct prompt below appears, so it is asked once, on your receipt, instead of on whatever page happened to load. Those headings are never stored and never sent. On every other page it reads nothing beyond what those checks need, keeps what it saw on your device, and sends nothing. It does not collect or transmit your browsing history.

What the extension sends to Pikt

• Recommendation request. To name your best card, the extension sends the merchant name or website domain, the approximate purchase amount, and whether the page looks like a subscription rather than a one-off purchase to Pikt’s servers (www.trypikt.com), authenticated with your signed-in Pikt session. The merchant name is a catalog label for known stores, a cleaned checkout page title on hosted payment pages, or — on a marketplace with no catalog name — a short “Sold by” label read from the page. We never receive the rest of the page, the other items in your cart, or any card number from this request.
• Card-offer alerts. On a detected checkout, the extension may ask Pikt whether a tracked or commonly available offer matches the merchant and a card in your wallet. Soft alerts remind you to confirm or turn on the offer in your issuer’s app; they never turn an offer on for you. You can also save an offer to your own tracked offers from the checkout banner; that sends the offer id and which of your cards it applies to. If you tap yes/no on “Did you have this offer?,” that verdict is sent to improve offer confidence for members.
• Sponsored recommendations. When an issuer pays to feature a card you already have for a matching category and that card ties your unpaid best earn for the purchase, the pick is labeled Sponsored in the UI and the unpaid best card stays available under Switch card. A clear unpaid winner is never replaced by a paid placement. The extension may send a placement attribution event to Pikt. Sponsors receive aggregate metrics only (for example impression counts); they do not receive your identity, browsing history, or card numbers. Pikt never injects affiliate links, promo codes, or cookies into the merchant checkout page.
• Usage events. When a recommendation is shown, accepted, switched, or declined, the extension records that event, associated with your Pikt account, to improve recommendation quality. These events contain no card number, CVV, or payment-card data.
• Optional feedback. If you use the thumbs up/down control, your rating and any optional comment are sent to Pikt (with merchant domain, recommended card name, approximate amount, and extension version) so we can improve the product. Feedback is never sold.
• Card pinning and category correction. From the same panel, you can pin one of your own cards to always be recommended at a specific merchant — that sends the merchant name and the id of the card you chose, never a card number — and undo the pin any time. You can also correct the category a store is filed under; unlike everything else in this section, that correction is written to a shared classification that also improves the category shown to other members at that same store, not just your own recommendations.
• Swipe Correct (optional). After you place an order, the extension may ask whether you paid with the card it named. If you answer — yes or no — that answer is sent to help verify recommendations against real purchases. Answering is entirely up to you: if you close the question or ignore it, nothing is sent, and the answer never includes a card number.
• Unexpected extension errors. If a packaged Pikt script throws, the extension may send a sanitized built-in error class (such as “Extension TypeError”), the packaged script’s file name, and allowed line and column coordinates. It does not send the exception’s message text, a page hostname or address, page text, or errors from the merchant’s own scripts.
• If you are not signed in, the extension falls back to a generic, on-device category estimate and makes no personalized request.

Checkout history (optional, separate consent)

Separately from everything above, you can choose to let Pikt keep a record of your own checkouts, so future recommendations are based on your own history instead of averages across all members. This is off by default. You are asked once, during onboarding or from Settings, and nothing is recorded until you turn it on.

• What’s saved. For each checkout while this is on, the extension may send the store name, the approximate amount, the date, a recommendation id when one was shown, and the purchase category when we can determine one. The extension never reads or transmits a card number, last four digits, expiry date, or CVV through this channel. The page address is checked only to confirm it isn’t a payment processor’s own domain; the address itself is not stored.
• Not proof of a completed purchase. A saved checkout reflects what the extension observed on the page, not confirmation that the order went through or which card you paid with. Internally it carries our lowest confidence grade and is never presented, to you or anyone else, as a verified transaction on its own.
• Stays in your account. These records are not shared, sold, or added to the aggregated, de-identified data set described in Pikt Insights (Section 1d) unless you have opted into that program.
• Turning it off. Turn this off any time from Settings. New checkouts stop being saved immediately. Turning it off does not, by itself, delete checkouts already saved — those are removed the same way as the rest of your history, described in Section 6, or on request.

What Pikt never sees

• Pikt does not store, receive, or transmit your card number (PAN), expiry date, or CVV — on your device or on our servers — in any form, ever. There is no “save a card” step and nothing to back up.
• Chrome fills it, not Pikt. The extension names your best card and points at the card-number field, inside your own click, so Chrome’s own saved-card autofill (the cards you’ve saved at chrome://settings/payments) can offer to fill it. Pikt never types, reads, or transmits the number.

Browser permissions we use

• Access to web pages. Chrome will tell you the extension can “read and change your data on all websites.” That is the page access described under “Where the extension runs” above: the code is present on every https page so it can spot a checkout, and does nothing on the rest except the unexpected packaged-script throw described above.
• activeTab. So the toolbar popup, when you click it, can see which site the tab you are looking at is on.
• storage. To keep a small amount of on-device state — your login session, a per-site dismissal counter, a cached year-to-date badge total, a cached copy of your own offer list for the search-results strip (refreshed about every six hours, cleared on disconnect), whether you turned that strip off, a few first-run setup flags, and one-shot flags that let the popup show a single dismissible prompt right after a confirmed win, inviting you to rate the extension or invite a friend. Each flag clears the first time you open the popup, whether or not you act on it. Separately, on the merchant’s own page, the extension notes in that page’s temporary session storage whether you already dismissed the Swipe Correct prompt for that one recommendation, so it does not ask twice; that note disappears when you close the tab. One exception: when you dismiss Pikt on the same store three times, we send that store’s address and the date the quiet period ends to your Pikt account, so the same store shows as muted in your web settings and un-muting it there clears it here too. Nothing else here is sent to Pikt, and none of it is ever card data.
• Host access to www.trypikt.com. So the extension can fetch your personalized recommendation, offer alerts, and related events from your own Pikt account, and so a crash in Pikt’s own packaged scripts can be reported. This is the only address the extension sends anything to; no other server, ours or anyone else’s, is contacted.

Your control

Uninstalling the extension permanently deletes the on-device-only state above. Pikt does not hold a copy of that local state. The separate merchant-mute record described above is already part of your Pikt account and remains until you delete the account or request its removal. Pikt never held a copy of any card number.

When you remove the extension, Chrome opens one page on our site telling you it is gone and how to add it back. Opening that page adds one to a daily tally of removals (Section 1) — no cookie, no identifier, nothing that says who removed it. If you accepted analytics, it also records that the page was viewed, the same as any other page on our site. The page asks you nothing and we do not email you about it.

1d.Pikt Personal (Optional)

Pikt Personal is one optional program — the only one. You turn it on or you don’t. It is separate from linking your bank account and separate from accepting our Terms of Service, and nobody is enrolled automatically. You can join or leave at any time from Settings → Privacy & data.

What you get out of it. Pikt learns which cards actually earn the most for wallets like yours, so the card it names for you gets more accurate over time instead of leaning on averages across all members. Community benchmarks come with it, and a one-time free month of Pro when you join and connect a bank.

• What we use. Which offers and purchases worked: the merchant category and name (never the full transaction description), the amount as a range rather than an exact figure, the month rather than the exact date, and which card was used. Grouped with other members for anything we publish, and filed under the coded ID described in Section 4 rather than under your name. We do not use your name, email, or card numbers as part of this set.
• What it’s used for. First, to sharpen the recommendations you personally get. Then, in grouped form, to power Community benchmarks and to train the models behind Pikt’s recommendation technology, which we may license to partners. A partner receives card recommendations, never your data. Nothing here is ever published as a report about you individually.
• We do not sell your data. Pikt does not sell reports built from your data, or your data itself, to advertisers, data brokers, researchers, or any other third party. Licensing recommendation technology to a partner is not a sale of your personal information. A partner receives card recommendations produced by that technology. A partner never receives your data, a feed of member data, or anything that identifies you. Grouped, in-app figures (like Community benchmarks) still clear two floors before they are ever shown to anyone: a group is only included if at least 25 different members are in it, and we will not compute one at all on fewer than 50 purchases.
• Date of birth and age range. We ask for your full date of birth so the 18-or-older check is exact. It is stored encrypted on this program’s consent record, and never on your main account record. This is separate from the derived date stored at signup, described in Section 1. From the full date you supply to this program we derive an age range such as 25–34 (and a generation label such as Millennial) and use the range, never the exact date, to improve which card Pikt suggests to you and to members at a similar life stage. Leaving the program deletes this copy, and so does a Global Privacy Control signal.
• What you get. A one-time free month of Pikt Pro when you join and connect a bank (30 days, shown in Settings before you join; not a recurring payment). Joining without a bank link does not bank the month. Plus:
  • Community benchmarks — grouped stats showing how your wallet’s earnings compare to other enrolled members. Hidden behind “not enough members yet” until at least 3 members have contributed.
  • Sharper, more personalized picks — your history helps Pikt recommend better for you specifically, not just the average member.
  • Early access to new Pikt features as we ship them.
• Your control. Leave from Settings. Leaving stops future collection immediately. You keep any free Pro month already banked. “Do Not Sell or Share My Personal Information” in Settings turns off Pikt Insights.
• Age check (Pikt Personal). You must be 18 or older, and joining stores your date of birth encrypted on the consent record, as described above. Leaving the program deletes that copy. If we cannot confirm you are 18 or older, you cannot join.
• If this program changes. When we expand what the program does, we do not apply the change to people who already joined. We show you what changed and ask again, and nothing new happens with your data unless you say yes. Saying no leaves everything exactly as it is and takes nothing away.
• Global Privacy Control. If your browser sends a Global Privacy Control (GPC) opt-out signal, we honor it automatically: Pikt Insights is turned off for you and cannot be joined from that browser while the signal is active.
• If you say no. Declining is always respected. If you decline, we wait at least 12 months before presenting the offer again — for everyone, not only where a law requires it.

1e.Pikt Copilot (Ask About Your Cards)

Pikt Copilot lets you ask questions in plain English about the cards you have added — which one to use for a purchase, why Pikt chose a card, how a welcome bonus is coming along, or whether a spending cap is close to running out. This section explains what happens to what you type.

Most questions never reach an AI model

Common questions are answered directly by Pikt’s own calculation engine using a fixed set of written responses. No third party is involved and nothing leaves our systems. Only questions our engine cannot match are even candidates for an AI model.

The AI model is opt-in, and off by default

Even for a question our engine cannot match, nothing is sent to Anthropic unless you have turned on “Share data with Pikt’s AI assistant” in Settings → Privacy. Until you turn it on, those questions get a direct answer that stays inside Pikt — no external model, and nothing described below leaves our systems. You can turn this off again at any time, and turning the universal “Do Not Sell” toggle on turns this off too.

What is sent to the AI model, and what is not

When a question does go to an AI model, we send our third-party AI provider (Anthropic, which operates Claude) only:

• the question you typed;
• the display names, issuers, reward types, and everyday earn rates of the cards in your wallet;
• the results of the specific lookups needed to answer you — for example a reward rate, a dollar amount earned on the purchase you asked about, or how much is left on a welcome bonus.

We do not send your name, email address, account identifiers, card numbers or masked card numbers, balances, credit limits, credit utilization, or any individual transaction or transaction history. The AI model never receives your linked-bank data and never sees anything that identifies you. It also performs no calculations: every figure in an answer is produced by Pikt’s own engine and is only phrased by the model.

We send this information to Anthropic for the sole purpose of generating your answer, and we do not permit it to be used for any other purpose, including model training. Anthropic is a service provider under Section 5. Pikt Copilot data is never sold, never shared for advertising, and never included in Pikt Personal (Section 1d).

Whether your conversations are stored

Where conversation logging is enabled, we retain the questions you ask and the answers you receive for up to 30 days, to diagnose incorrect answers and improve accuracy. Before a question is stored, we automatically remove long sequences of digits (such as card, account, or routing numbers) and email addresses. Stored conversations are included in your data export, are deleted when you delete your account, and are permanently deleted at the end of the retention period.

What Pikt Copilot cannot do

Pikt Copilot is informational only. It cannot move money, make a payment, change your settings, open or close a card, or access anything beyond the card information described above. It is not financial, tax, or investment advice, and it does not provide credit scores, credit reports, or approval odds.

2.Financial Data We Access Through Bank Connections

Optional bank connections use Quiltt or Plaid, as named before you connect. Existing Stripe Financial Connections accounts may also be managed in Pikt. These providers receive the information you authorize under their own privacy notices: Quiltt Privacy Policy (opens in a new tab), Plaid End User Privacy Policy (opens in a new tab), and Stripe Privacy Policy (opens in a new tab). The data Pikt receives depends on your institution and permissions. The categories, purposes, and retention periods are listed below.

All financial data is processed server-side. No bank-provider access token, account number, or routing number is ever transmitted to your browser or mobile device. We do not request write access to any financial account. We request only the balance and transaction-history products needed to create the link. We do not request account and routing numbers or an identity-verification product on the card-link path, and we do not store account numbers or routing numbers. If we later offer a regulated card and need identity verification, that flow will be described here before it launches.

3.How We Use Information

• to recommend the best card for each purchase — the one that earns the highest reward for that store and spending category. Pikt only recommends; you always choose which card to pay with;
• to maintain and update per-card reward rate catalogs based on your transaction history;
• to display wallet health metrics, utilization scores, and savings history in your dashboard;
• to keep the Service running and improve it;
• to process subscriptions and billing;
• to send account emails like receipts and security notices, and, where you allow it, product news;
• to secure the Service, detect fraud, and maintain audit records of sensitive actions;
• to comply with applicable legal and financial regulations.

We do not use your financial data for advertising, cross-selling unaffiliated products, data brokerage, or credit scoring unrelated to our Service. And when we measure how the Service is doing overall, we use grouped, aggregated reporting: internal dashboards show a group only when it is large enough that no single member stands out, and our analytics tools never receive your individual purchases (Section 5).

3a.Recommendation Technology We Build and License

Pikt’s recommendation engine is our product. If you have set your data dial to “Improve Pikt” or turned on Pikt Personal, the recommendation outcomes you generate help train the models behind it — and we may license that technology to partners so their products can offer card recommendations powered by Pikt. Age-range features train only on Pikt Personal grants recorded under the July 2026 or later program terms described in Section 1d. Here is exactly what that does and does not mean:

• What trains the models. Purchase context (store category and amount range), the characteristics of the cards involved (reward rates, annual fee, network — the card product, not your account), whether the recommendation was followed, and — only for Insights members who agreed to the July 2026 or later program terms — an age range such as 25–34. Only members who opted in are included. Members at “Just serve me” are never included.
• What never goes in. Your name, email, account identifiers, card numbers, and exact date of birth are never part of the training data’s features. The models learn patterns like “a 4x dining card beats a 2% flat card at restaurants” — they do not and cannot store a profile of you.
• What a partner receives. Card recommendations — nothing else. No partner ever receives your data, a feed of member data, or anything that could identify you or reconstruct your activity. Licensing the technology is not selling your data, and we do not sell your data.
• If you joined before this section existed. We will show you this description and ask again before your data helps train licensed technology. Saying no changes nothing else about your account.

4.How We Protect Financial Data

We treat financial data as sensitive and apply the following controls:

• Encryption at rest. Stored Plaid access tokens are encrypted with AES-256-GCM before they are written to the database, using keys held in our hosting provider’s encrypted secret store and never committed to code. Disk-level encryption alone is not relied upon.
• Encryption in transit. Pikt uses HTTPS to protect data sent between your browser and our service.
• Secure storage. Plaid access tokens are encrypted before database storage. Server code uses these tokens to retrieve authorized data; the tokens are not sent to your browser or mobile app.
• Server-side only. Our servers retrieve linked-bank data. The connection screen uses a temporary session or link token in your browser. Long-term Plaid access tokens stay on our servers.
• Least-privilege access. Decrypted financial credentials are read by the automated card-recommendation service. Access to production secrets and to the production database is limited to two people at Pikt, protected by multi-factor authentication on our hosting accounts. Keeping that list to two is deliberate — it is the shortest list that still lets us run and support the Service — and neither of them looks at an individual member’s spending except where the law requires it.
• Whose spending is whose. Your purchases are not filed under your name or your account number. Each one is filed under a coded ID, and the key that connects that code to you lives in our application, never in the database. The practical effect is a simple one: a copy of the database, on its own, does not say whose spending is whose.

  This is not anonymization.

  One honest note on wording, because it does real work in a privacy policy. We would rather not call the coded IDs something they are not. The code can be matched back to you — that is exactly what lets you open your own activity history and download a copy of your own data — so your spending is still your personal information, and we handle it as such. What the coding gives you is that the match can only be made inside Pikt, with a key that never sits next to the data.

  Day to day, nobody at Pikt is reading any of it. The matching happens automatically, inside the app, so that your own history is there when you open it. The only time a person at Pikt would look at an individual member’s spending is where the law requires it, which Section 5 describes.

• Audit logging. All bank-provider token exchanges are logged with a timestamp, pseudonymized user ID, action type, and success/failure status. Token values are never logged. Logs are retained for five years per CFPB Section 1033 open-banking recordkeeping requirements.

5.How We Share Information

We do not sell your personal information. We share information only with service providers that help us operate the Service, under contractual confidentiality and security obligations, including:

• Quiltt. Optional financial account connectivity when you choose to link a bank. Account and transaction data described in Section 2 flow only after you opt in; Plaid or Stripe Financial Connections may also be used where configured. Linking is not required for Card Check or Pikt Checkout.
• Stripe. Subscription billing and payment processing, and financial account connectivity where we use Stripe Financial Connections as the bank connection providers above. See Stripe’s Privacy Policy (opens in a new tab).
• Clerk. Authentication, account management, and subscription billing.
• Resend. Transactional and notification email delivery. To deliver a message, Resend processes the recipient address, sender, subject, message contents, headers, and delivery records. It tells us whether an email was delivered, delayed, bounced, or suppressed. When engagement measurement is enabled for our sending domain, Resend can also tell us whether an email was opened or clicked. An open can be measured by a small invisible image in the email. A click can be measured by routing the link through Resend before it reaches the page. In PostHog, we keep the type of email, its campaign, a one-way message key, and the delivery or engagement result. For a click, we also keep which page on our own site the link went to. PostHog never gets the email address, subject, message contents, full destination address, IP address, or mail-app details from this process. A link outside our site is recorded only as external. When the address matches an account, the product-analytics event is recorded against that account. This happens in email, not in your browser, so the cookie banner does not control it. Your data-collection choice controls whether Pikt copies account-linked email events into PostHog, but Resend can still process them as our email provider.
• Crisp. In-app support chat. When you are signed in, we pass Crisp your name and email address so we know who we are talking to, along with whatever you write in the chat. We also pass your plan, whether Pikt Checkout is connected, and the number of cards in your wallet so support can understand your setup. Crisp does not receive card names or numbers, spending, balances, or linked-bank data.
• PostHog. Product analytics — which features get used, and where people get stuck. Browser page views, page-speed measurements, and interaction events run only after you accept analytics storage in our cookie banner. A Global Privacy Control signal is treated as declined, even if you previously tapped Accept all. Signed-in account and product milestones, such as signup, subscription changes, completed setup, and a card pick being shown, are recorded by our servers without using an analytics cookie; the cookie choice does not control those service records. PostHog never receives your spending: events carry no merchant names, no purchase or savings amounts, and no balances — we strip those fields before any event is sent. Button clicks and form submissions carry the page, the basic control type, and, when available, a short label written by us. They never carry the words on the screen or anything entered in a form, and we do not use click heatmaps. URL query strings are stripped before they leave the browser, with one exception: the campaign labels Pikt itself puts on its own links (see Section 9). Private record ids, invite tokens, share tokens, and referral codes in page addresses are replaced with route labels. PostHog builds no profile of visitors who aren’t signed in. If you sign in after accepting analytics storage, the browser’s random analytics id is linked to your Pikt account id. PostHog does not keep your IP address, postal code, or coordinates. It may keep a country and region so we can see where the product is used, not where you live. We do not record screens or sessions. Session replay (a recording of what you click, type, or see on the page) is turned off, both in our PostHog configuration and in our PostHog project settings. See Section 9.
• Sentry. Error monitoring. When something in the app or in a packaged Pikt Checkout script fails, Sentry receives the technical details of the fault so we can fix it. Extension reports are the sanitized message, script file name, and hostname described in Section 1a — not the page address, page text, or the merchant’s own errors.
• Google. Site analytics (GA4), only after you accept analytics storage in our cookie banner. See Section 9.
• Apple Push Notification service. Delivers native iOS notifications. Apple receives the iOS device token, notification title and body, and any deep-link or other data needed to open the correct Pikt screen.
• Expo. Delivers cross-platform notifications. Expo receives the device token, notification title and body, and any deep-link or other notification data.
• Firebase Cloud Messaging. Delivers native Android notifications. Firebase receives the Android registration token, notification title and body, and any deep-link or other data needed to open the correct Pikt screen.
• Google Wallet. Creates and updates the wallet pass only when you ask Pikt to save it. Google receives a member-scoped pass ID, card names, category labels, reward-rate and wallet-position text, and a link to Pikt Settings. The pass contains recommendations, not card numbers or transaction history.
• NerdWallet. A configured destination for some card-application links. If you follow one, your browser sends ordinary request information to NerdWallet.
• CardRatings. A configured destination for some card-application links. If you follow one, your browser sends ordinary request information to CardRatings.
• Google Places and Maps. Store suggestions and address matching. Google may receive the store words you type and device coordinates when you allow browser location, or ZIP-derived coordinates when you use ZIP-based search.
• Foursquare Places. A second source for store suggestions and categories. Foursquare may receive the store words you type and device coordinates when you allow browser location, or ZIP-derived coordinates when you use ZIP-based search.
• Zippopotam.us. Turns a five-digit ZIP code you enter for store search into an approximate city location.
• Logo.dev. Supplies card and merchant logo images. A logo request includes the issuer or merchant website domain and ordinary connection information, such as an IP address and browser headers.
• Anthropic. AI model used to phrase Pikt Copilot answers, limited to the fields described in Section 1e. Anthropic receives no linked-bank data, no account identifiers, and nothing that identifies you.
• Hosting & infrastructure providers. Vercel hosts the Service. Railway hosts the database where your account records are stored. A cache and job-queue provider handles rate limiting and background job delivery. Cloudflare provides DNS and, through Turnstile, checks public forms for bots. These receive technical data such as IP address, and — in the case of our database host — the account data described in Section 1, as needed to operate the Service.
• Technology licensing partners. Partners who license Pikt’s recommendation technology receive card recommendations produced by that technology — never member data, never a data feed, and nothing that identifies you. See Section 3a.

We may also disclose information to regulators or law enforcement where required by applicable law, without prior notice to you where such notice is prohibited by law. That is also the only circumstance in which anyone at Pikt would look at an individual member’s spending, or connect a coded spending record back to the member it belongs to. Otherwise your spending stays under the coded ID described in Section 4, matched to you automatically and only to show you your own history.

5a.Business Transfers

If Pikt is involved in a merger, acquisition, financing, or sale of some or all of its assets, your information may be transferred as part of that transaction. We will provide notice — through the Service or by email — before your information is transferred and becomes subject to a different privacy policy, and the protections in this policy continue to apply until that happens.

6.Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. Specific retention periods for financial data are set out in Section 2 above. Website deletion requests have a 14-day recovery period after email confirmation. Permanent deletion follows within 90 days unless a legal hold applies. Deleting from the iOS or Android app instead starts permanent deletion immediately, with no recovery period, as described in Section 8. Deletion removes personal data and associated records (linked cards, simulations, offers, and history), with the following retention exceptions:

• Audit trail logs. Retained for 5 years per CFPB Section 1033 open-banking data requirements.
• Account-deletion proof. After we permanently delete your account, we keep a one-way hash of your email address so we can show that the deletion happened. A hash is not encryption and can be matched to a known email address. A separate deletion audit entry can retain your email, IP address, and browser information for the audit retention period.
• Analytics events. Product-analytics events — the ones described in Sections 5 and 9, which never carry your spending — are held for 12 months and then deleted automatically. The email delivery, open, and click events we copy into PostHog age out on the same schedule. Resend also keeps the provider records needed to send, troubleshoot, and suppress email under its own retention controls.
• Daily page counts. The daily tallies in Section 1 are a number per day with nothing attached. There is nothing in them to delete on request, and we keep them indefinitely.

Deleting your account does not delete analytics events already recorded. Once you are signed in, those events are labelled with your account identifier, so we want to be straight about this rather than imply they vanish: they stay until they age out on the 12-month schedule above. They carry no spending, no merchant, and no amount. If you want them removed sooner, ask us and we will do it — Settings → Privacy & data → Make a privacy request, or email support.

Pikt Copilot conversations. Where conversation logging is enabled, questions and answers are retained for a maximum of 30 days and then permanently deleted, as described in Section 1e. They are deleted immediately if you delete your account.

7.Security

Pikt uses HTTPS to protect data sent between your browser and our service. Stored Plaid access tokens and dates of birth use AES-256-GCM encryption. These controls do not mean that Pikt has completed a security certification. Our providers also process data under their own privacy notices. No method of transmission or storage is completely secure.

8.Your Rights & Choices

• Access & update. View and edit your profile from Settings.
• Delete. On the website, request deletion from Settings → Account → Delete account. We email a confirmation link. After you confirm, your account enters a 14-day recoverable grace period. Sign back in during those 14 days to cancel the deletion. After the grace period the account is no longer restorable. We permanently delete your personal data and Quiltt-derived records within 90 days of the confirmed deletion (except the audit-log and deletion-proof records in Section 6). Accounts under legal hold are held until that hold is released. In the iOS and Android apps, the in-app confirmation starts permanent deletion immediately. It has no email confirmation or 14-day recovery period. The retention exceptions in Section 6 still apply.
• Disconnect financial accounts. Unlink accounts at any time. Disconnect in Settings → Cards & bank to stop new imports. Pikt revokes Plaid access and removes its Quiltt connection. Removing a Quiltt connection does not revoke access at the provider; contact support for help with that step. Previously imported history stays until deleted or its retention period ends. Transaction rows remain subject to the 13-month window in Section 2. You can request deletion of imported history.
• Email preferences. Opt out of marketing emails from Settings → Notifications or via the unsubscribe link. Account, security, and billing notices may still be sent. An email you never receive is never measured, so turning an email off also ends measurement for messages that are never sent. Most mail apps let you block remote images, which can stop an open from registering. Turning off data collection in Settings → Privacy & data stops Pikt from copying future account-linked email events into PostHog. Resend can still process delivery events and, when enabled, engagement events needed to operate email, including suppression records after a hard bounce or spam complaint.

To exercise any of the rights below, file a request from Settings → Privacy & data → Make a privacy request. That records it against your account so the response clock is tracked. If you’d rather write to us, or you no longer have access to your account, email [email protected]. Either way we will respond within 45 days. We will not discriminate against you for exercising your privacy rights.

8a.California Residents: CCPA / CPRA Rights

If you are a California resident, the California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”) gives you the following additional rights:

• Know. Request disclosure of the categories and specific pieces of personal information we have collected, the sources, the business purpose, and the categories of third parties with whom we share it.
• Delete. Request deletion of personal information, subject to the audit-log retention exception described in Section 6.
• Correct. Request correction of inaccurate personal information.
• Opt out of sale or sharing. We do not sell your personal information or share it for cross-context behavioral advertising. The only sharing you can create yourself is the optional Pikt Personal program (Section 1d), which uses de-identified, grouped data. You can turn it off at any time via “Do Not Sell or Share My Personal Information” in Settings. We also honor Global Privacy Control signals automatically.
• Financial incentive notice. Pikt Personal is a voluntary financial-incentive program. When you join and connect a bank, you receive one free month of Pikt Pro, as shown at the point of opt-in. Connecting a bank is a separate choice from joining. The value of that incentive is reasonably related to the value of the de-identified, grouped data described in Section 1d. You can join only by affirmative opt-in and can withdraw at any time from Settings, effective immediately. You keep the free Pro month already banked.
• Limit use of sensitive personal information. We do not use sensitive personal information beyond what is necessary to provide the Service or satisfy our legal obligations.

How to submit a CCPA request. Email [email protected] with subject line CCPA Privacy Request. Include your name, email address, and the specific right you wish to exercise. If you have a Pikt account, filing from Settings → Privacy & data is faster — it is already tied to your identity. We will verify your identity before processing and respond within 45 days.

8b.United States Only

Pikt is built for U.S. credit cards and U.S. residents, and the Service is not offered outside the supported U.S. region. We use the network country reported for a request to block requests that appear to come from elsewhere. This check does not prove where a person lives, and it does not decide which privacy laws or rights apply.

9.Cookies

We use cookies and similar storage (including localStorage) for the purposes below. A banner asks you to choose on your first visit. Essential cookies always run. Analytics cookies wait until you tap Accept all. First-party functional cookies (referral and support chat) are set only when those features are used, and are not advertising cookies. You can change the analytics choice at any time from Cookie preferences in the site footer.

Two things we do are deliberately outside this banner, because neither uses a cookie or an identifier in your browser: the daily page counts described in Section 1, and the open-and-click measurement on emails we send you, which happens in your mail app rather than on our site. Both are covered at the end of this section.

Essential (always on)

• Authentication and security. Clerk session cookies keep you signed in, plus related security tokens. Blocking these may prevent sign-in.
• Your cookie choice. Stored in this browser so we remember whether you chose Accept all or Essential only.

Functional

• Referral. If you arrive through a member’s invite link, a first-party cookie remembers the code for 30 days so we can credit them after you sign up. It is not used for advertising.
• Support chat. When you are signed in, when you open the chat yourself, or once you tap Accept all on the public site, Crisp may set a session cookie so the chat widget can continue a conversation. On the public site the widget does not load before one of those happens. What Crisp receives is described in Section 5.

Browser analytics (off until you accept)

These run only after you tap Accept all on the cookie banner or in Cookie preferences. They never run before that. Essential only (or dismissing the banner) keeps them off and deletes any analytics cookies or storage that were set while consent was granted:

• PostHog. Product analytics — which features get used, and where people get stuck. Once you accept, it stores a random id in this browser so visits stitch into sessions; choosing Essential only deletes it. Events never include your spending, and no profile is built for visitors who aren’t signed in. Button clicks and form submissions are counted with the page, the basic control type, and a short developer-written label when one is available, never with visible words or form contents, and never as heatmaps. Query strings are stripped from URLs, except for the campaign labels described below. Private record ids, invite tokens, share tokens, and referral codes in page addresses are grouped under route labels. It also measures how quickly pages loaded and became usable for you. If you later sign in, PostHog links the random browser id to your Pikt account id. We do not record your screen or session — session replay is turned off (Section 5). PostHog does not keep your IP address or a precise location.
• Google Analytics (GA4). Site-usage cookies, only when a measurement ID is configured.

Server-side product milestones

Some signed-in service events are recorded by our servers instead of your browser. These include account creation, subscription changes, completed setup, a card being added, and a card pick being shown or confirmed. They do not use an analytics cookie, so the cookie banner does not control them. They use your Pikt account id, never include spending or form contents, and follow the analytics retention and deletion choices in Sections 6 and 8.

Campaign labels on our own links

When we post a link to Pikt — in a newsletter, in an email we send you, in a community post — we add a short label to the end of the web address saying which campaign it came from (for example utm_campaign=discord-beta). If you accepted analytics, that label is kept on the page view so we can see which channels bring people to Pikt and roughly how long after arriving someone signs up (we look back up to 90 days). These are the only query parameters that survive the strip above, they are checked against a fixed list of our own campaign names, and they say nothing about you — only where the link was posted. Links you follow to other people’s sites are not labelled by us and are not measured.

Email opens and clicks

When engagement measurement is enabled for our sending domain, emails can contain a small invisible image and their links can pass through our email provider before reaching the page. That is how we can learn whether a message was opened or a link was clicked. This is not a cookie on our website and the banner does not control it. What Pikt copies into PostHog and how to stop that copy are in Sections 5 and 8. Resend can still keep its provider-side delivery and suppression records.

Cookieless hosting metrics and counts

Our host (Vercel) collects anonymous traffic and performance metrics that do not use cookies. Cloudflare Turnstile, used to stop bots on public forms, also does not set advertising or analytics cookies. Our own daily tallies (Section 1) work the same way: a number per day on our servers, no cookie, no identifier, nothing that could point back to you.

Your control

Use Cookie preferences in the footer, or your browser settings. A Global Privacy Control signal is treated as Essential only for analytics, even if you previously tapped Accept all. The same signal turns Pikt Personal off, as described in Section 1d.

10.Children’s Privacy

The Service is not for people under 18. If someone tells us they are under 18, we refuse product access and do not keep the age or a derived birth date. The account identity and a limited security record of the rejected attempt may remain under Section 6 until the account is deleted. If you believe a child created an account, contact us so we can review and delete the account through that process.

11.Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the Service or by email at least 30 days before changes take effect. The “Last updated” date above reflects the most recent revision.

12.Contact

Questions about your privacy, or a request this page didn’t cover? Email us at [email protected]. Use the contact form if you prefer not to email. Pikt Rewards LLC, 126 Melrose Street, 3L, Brooklyn, NY 11206, United States · 401 702 7458.