Last updated: August 14, 2026
Points & Prompts ("we," "us") helps you get more value from the credit-card points and miles you already earn. This policy explains what we collect, how we use it, how we protect it, and how you can delete it. It covers the web application at pointsandprompts.com. Bank connections through Plaid are not offered on the public product today; the Plaid section below describes the data path when that feature ships with beta.
The short version. You can use Points & Prompts by typing in your cards and balances — no bank connection required, and none is available today. Manual entry is the complete path. When bank connect ships, we will receive read-only, category-level spending data through Plaid. We keep only monthly spending totals by category; we never receive or store your bank login, and we never store your individual transactions.
Bank connection is not currently offered. When it ships with beta, if you connect a bank, you authorize the connection inside Plaid's secure window. Your bank credentials go directly to Plaid and are never seen by or shared with us. Through Plaid's Transactions product (read-only), we receive recent transactions, which we immediately aggregate in memory into monthly totals per spending category (for example, dining, groceries, travel). We store only:
We do not store your individual transactions, merchant names, account numbers, or bank login credentials.
When you choose statement parsing, your browser redacts account and card numbers except the last four digits, routing numbers, addresses, phone numbers, email addresses, barcodes and QR codes, and SSN or TIN patterns before any network transfer. You review the redacted image and choose whether to send it. Points & Prompts sends only that version to OpenAI, our AI processor. Points & Prompts does not save the original or redacted image; after processing, we keep only extracted balances, monthly category totals, and card names. OpenAI does not use API inputs to train its models by default. Under its standard API controls, OpenAI may retain the redacted image for up to 30 days for abuse monitoring and may keep flagged content longer for safety or legal reasons. Manual entry remains available.
We do not sell your personal information, and we do not use it for advertising.
We share data only with the service providers that run the product, and only as needed to operate it:
| Provider | Purpose |
|---|---|
| Plaid | The planned optional bank connection and read-only transaction data, when that path ships with beta. Not offered on the public product today. |
| Supabase | Database, authentication, and secure server functions. |
| Cloudflare | Static web hosting and content delivery. |
| Stripe | Payment processing for Pro subscriptions, when paid plans launch. Charging is not live today. Your card details go directly to Stripe and are never seen by or stored with us. |
| OpenAI | Processes Ask P&P questions and relevant stored values when you use Ask while signed in. Signed-out visitors receive Instant Read (computed from the dataset), not a model answer. |
| Resend | Sends account and service emails (sign-in, receipts, required notices). |
| Notion | Internal operations records, including the text of feedback you submit. |
Each provider receives only the data its purpose requires.
We may disclose information if required by law. We do not otherwise sell, rent, or trade your data.
Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Access to systems that hold your data is restricted by row-level security and least-privilege controls, and administrative access requires multi-factor authentication. See our Security practices for detail.
You can delete your account at any time from within the app. When bank connect ships, you will also be able to disconnect a bank from within the app.
Bank connection is not currently offered. When it ships with beta, connecting a bank will be optional and will require your explicit consent through Plaid Link. You can decline it entirely and use the app by hand — and that is the only spending path today. You may access, correct, or delete your data at any time in the app, or by contacting us. Plaid's own handling of the data it collects is described in the Plaid End User Privacy Policy.
Points & Prompts is not directed to children under 13, and we do not knowingly collect data from them.
We will update this page and revise the date above when this policy changes.
Questions or requests: privacy@pointsandprompts.com · pointsandprompts.com