Legal

Privacy Policy

Last updated October 6, 2026

PerkFolio tracks the statement credits and perks on the credit cards you carry. To do that it holds your account details, the cards you add and, if you link a bank, your credit-card transactions. This page says exactly what we hold, why, who else can see it, how long it stays, and how to delete it.

PerkFolio is run by Vlad Lovin, an individual operating a personal project (“we”, “us”). It is offered to people in the United States.

What we collect

What you give us

Account details: your email address, a display name if you set one, and your password, stored only as a one-way hash we cannot reverse.
Your wallet: the cards you add, nicknames you give them, credits you mark as used, store reward certificates and 0% financing plans you enter.
Birth month, if you choose to give it, to show birthday perks. Month only: never a day or year, so no date of birth is stored.
Feedback you send us, with the page you sent it from and your browser type, so we can reproduce what you saw.

From your bank, only if you link one

Through Plaid (see below) we receive, for the accounts you choose to share:

Account names, types and the last four digits of each account number (never the full number).
Transactions: the merchant, amount, date, whether it is pending, the description as the bank wrote it, Plaid's category for it, and the merchant's name, logo and website where Plaid identifies them.
When we start offering features that use them, your credit cards' statement and payment details (statement date, payment due date, minimum payment and interest rates). You are asked to allow this when you link a bank. We do not request it from Plaid until a feature needs it.

We never receive your bank username or password. You enter those on Plaid's or your bank's own screen.

Automatically

A sign-in cookie that keeps you logged in, a cookie with your time zone so dates show correctly, and, if you tick “remember this device”, a cookie that skips the emailed sign-in code on that browser. We do not use advertising or analytics cookies, and the site loads no third-party trackers.
Notification addresses: if you turn on notifications, the address your browser or iPhone gives us for sending them.
Browser extension: if you install it, the extension tells us which supported store's page you are on (about 60 stores where your cards carry credits) so it can suggest a card. On a checkout page we save that suggestion so we can tell you which card the purchase landed on. It runs on no other sites.
Failed sign-in attempts: the email address typed and your IP address, kept for one day to stop people guessing passwords.
Server logs kept by our host, which include IP addresses, as with any website.

How we use it

To show each card's credits and how much of each you have used or have left.
To match your transactions to the credits they used, so usage records itself.
To send the emails and notifications you can switch on or off: a credit posted, a credit about to expire, a purchase landed on a card, a new card at a linked bank, a bank connection needing attention.
To sign you in and keep your account secure, including two-factor codes.
To answer feedback and fix problems.

What we never do

We do not sell your data, and we do not share it for advertising.
We do not move money. Our access to your bank is read-only.
We do not make credit decisions about you or report anything to credit bureaus.
We do not send marketing email.

Bank connections and Plaid

We use Plaid Inc. (“Plaid”) to connect to your bank. When you link a bank, you sign in through Plaid, and Plaid passes us the data described above for the accounts you choose. By linking a bank you agree that Plaid may collect, use and share your information under the Plaid End User Privacy Policy.

You can stop sharing at any time: disconnect the bank in PerkFolio's Settings, or revoke PerkFolio's access from your bank's website or Plaid's my.plaid.com. Either way, we stop receiving data from that bank.

Only the companies that run PerkFolio for us, and only for that purpose. Each is bound by its own terms to protect the data.

Company	What for	What it sees
Plaid Inc.	Bank connections	Only if you choose to link a bank. Plaid authenticates you with your bank and returns transaction data. Your bank credentials are entered on Plaid's or your bank's screen and are never seen by PerkFolio.
Vercel Inc.	Hosting	Serves the site. Processes server logs, which include IP addresses, as any web host does.
Supabase, Inc.	Database	Stores your account, the cards you add, and any bank data you have linked.
Resend	Transactional email	Your email address, to send sign-in codes, password resets, address verification and the alerts you leave switched on. Not used for marketing.
Apple, Google and Mozilla push services	Notifications	Only if you turn notifications on. Each notification's text passes through the push service your phone or browser uses, to reach your device.

We may also disclose information if the law requires it, for example in response to a valid court order, and we would tell you first unless the law forbids it.

How it's protected

Everything travels over encrypted connections (HTTPS).
The keys Plaid gives us to read your bank are encrypted in our database (AES-256), with the encryption key kept separately, so a copy of the database alone cannot be used to read anyone's bank.
Passwords are stored only as one-way hashes.
Two-factor sign-in with emailed codes is available to every account. Anyone with administrative access must use it.
Changing or resetting your password signs out your other sessions and forgets your remembered devices.

No system is perfectly secure. If a breach ever affects your information, we will tell you without unreasonable delay.

How long we keep it, and deleting it

While your account is open, we keep your account, wallet and linked bank data so the tracking keeps working.
Disconnecting a bank ends the connection at Plaid and deletes every transaction we received from it. Your cards stay in your wallet with the credits already counted, since you still hold those cards.
Unsharing a single card at your bank deletes that card's transactions in the same way.
Deleting your account (Settings → Delete account) first disconnects every bank at Plaid, then permanently deletes your account, wallet, transactions, notification settings and sign-in sessions in one step. Feedback you sent is kept without your email address attached, because it describes the product, not you.
Sign-in sessions expire after 30 days. Password-reset links and sign-in codes expire within minutes to hours.
Deleted data can survive for a limited time in our database provider's backups and our host's logs, which roll over on their own schedules. It is not restored from them.

Your choices

See and correct your details in Settings, or ask us for a copy of what we hold.
Delete your account yourself at any time, or ask us to.
Turn off credit emails and expiry reminders in Settings, and notifications per device.
Stop bank access as described under Bank connections.

Depending on your state, you may have further rights over your personal information. Email us and we will honor them. We will not treat you differently for using them.

Children

PerkFolio is for adults who hold credit cards and is not directed to children. We do not knowingly collect information from anyone under 13; if you believe a child has given us information, tell us and we will delete it.

Changes

If this policy changes, we will update the date at the top. If a change affects how we use data you have already given us, we will tell you by email before it takes effect.

Contact

Questions, requests or concerns: VladLovin@getperkfolio.com.