RightCard Privacy Policy

Effective date: October 8, 2026

RightCard helps you choose the best credit card for any purchase. It is built to be privacy-first: an account is optional, we collect no unnecessary personal information, we never connect to your bank, and there is no third-party tracking.

The short version

• An account is optional. You can use RightCard fully without signing in. If you choose to create an account — to back up your synced offers and use them on another device — we store only the identifier you sign in with: a Sign in with Apple identifier (which can be a private Hide My Email relay address), a Google account identifier and its email address, or an email address. We never ask for your name, phone number, or address.
• No bank login, ever. RightCard never connects to your bank or card through Plaid or any other aggregator, and never sees your account numbers, balances, or transactions.
• No third-party tracking or ads. RightCard contains no advertising, attribution, or third-party analytics SDKs. We keep only minimal first-party usage data (your app version and the date you last opened the app) to understand active usage — never sold or shared.
• Location is optional and stays on your device. By default we use only a fixed, country-level region hint — no location access. If you use Best card here, RightCard looks up the stores around you when you ask, and, once you have allowed location, when you open the app at a store so your best card is already on the Home screen. If you turn on the optional Offer alerts nearby feature, it uses your location in the background to alert you at a store where you have an offer, or where a different card than your usual one is better. Your location is used only on your device (and by Apple Maps to find nearby stores) and is never sent to our servers or logged. The one thing kept is a store you choose to Remember: its location stays on your phone so it can alert you there, until you forget it or delete the app.
• Notifications are local. Any reminders — an offer about to expire, your sweep streak, or a nearby offer — are scheduled on your device. We don't run a push server, and nothing about them leaves your phone.
• Your recommendations run on your device and work offline.

What we store, and where

On your device:

• The cards you select in “Manage Cards” and your reward-valuation preference.
• A cached copy of public card and merchant data for offline use.
• A secure, device-only session token (kept in the iOS Keychain; never synced to iCloud and excluded from backups).

On our backend (Supabase):

• An anonymous identity — a randomly generated ID and access token, created automatically with no sign-up and not linked to any personal information.
• If you create an account, the sign-in identifier you used: a Sign in with Apple user identifier (and the email Apple shares with us, which may be a private @privaterelay.appleid.com relay address), a Google account identifier and its email address, or the email address you registered. Creating an account does not change what app data we hold — it keeps the same identity, so your synced offers simply become recoverable and syncable across your devices.
• The card offers you choose to sync from your bank, stored only as { card, merchant, percentage/amount, expiration, source }, plus whether it works online or in store, whether the offer is activated on your card, and whether you've marked it used. These are private to your identity and isolated by row-level security so no other user can read them. We never store account numbers, balances, transactions, or any personal information.
• What you tell us about cards and stores. If you use “Request a card”, we store the card name you typed and your device's country. If you tap “Earned less here?” on a store's answer, we store the store's name, the category RightCard answered with, what your statement showed (the base rate or another category) and the card it recommended. No amounts, no dates, no statement text. Both are tied to your identity, so you can undo a store report. We only change a store's answer for everyone after at least three different people report the same thing.
• A minimal usage record — your app version and the date you last opened the app, tied to your identity — used only to measure active usage. No spend, no transactions, no personal profile.

All network traffic uses HTTPS.

Your account (optional)

RightCard works fully without an account. Creating one is entirely optional and exists for a single purpose: to back up the offers you've synced and make them available on your other devices (and to recover them if you reinstall the app).

• You can sign in with Sign in with Apple (including Hide My Email, so we only ever see a private relay address), with Google (we receive your Google account's email address — nothing else from your Google account), or with an email and password. That is the only information an account adds.
• An account is never a bank login. We never ask you to connect a card, link a bank, or share credentials.
• Your data stays isolated to you by row-level security — no other user can read it.
• You can sign out at any time, or permanently delete your account and its data from inside the app (see “Deleting your data”).

Location and notifications (optional)

Location. RightCard does not use your location by default; merchant search uses a fixed, country-level region hint. Best card here uses your location, with your “While Using” permission, to find the stores around you: when you open it, and when you open the app while standing at a store so the answer is waiting on the Home screen. If you enable Offer alerts nearby, RightCard uses background location (with your “Always” permission) to notice when you arrive at a store where you have an offer on one of your cards, or where a different card than your usual one is better, and to show you a reminder. Your location is used only on your device, to ask Apple Maps what stores are nearby and to match them against what's already on your phone. It is never sent to our servers and never logged. When you tap Remember on a store, RightCard keeps that store's location on your phone so it can alert you when you walk in; it never leaves the device, and it's removed when you tap Forget or delete the app. All of this is off by default, you can turn it off at any time, and the app works fully without it.

Notifications. RightCard's reminders — for offers about to expire, your weekly sweep streak, and nearby offer alerts — are local notifications scheduled on your device. We do not operate a push-notification server; no notification content or schedule is sent off your phone. Notifications are opt-in.

Browser extensions (optional)

RightCard has two optional extensions that read your bank's offers page for you: the Safari extension that ships inside the iPhone app, and a desktop extension for Chrome (Firefox to follow). Both work the same way: only on your bank's website, and only after you have signed in there yourself, they read the offer details shown on the page (merchant name, percentage or amount, expiration, and whether it works online or in store) so those offers appear in RightCard and, if you turn auto-add on, get added to your card for you.

• They run only on supported card-issuer domains: American Express, Chase, Citi, Bank of America, Wells Fargo and U.S. Bank. (The Safari extension is also permitted on Capital One, where it deliberately does nothing: Capital One's offers are shopping links, not card offers.) They do not run on any other website.
• They never read or transmit your username, password, account numbers, balances, or transaction history.
• A bank page never sees your RightCard session. On iPhone the extension hands offers to the app, which does the syncing. On desktop your sign-in lives in the extension's own background process, which web pages cannot read.
• The desktop extension requires a RightCard account, so your phone and your computer share one set of offers. You sign in with a six-digit code we email you. The extension keeps that session in the browser's extension storage on that computer; signing out ends it and clears the extension's local data. The extension talks only to our backend (Supabase) over HTTPS.
• "Check this site." When you click the desktop extension's icon while on a store's website, the browser tells the extension that one tab's address at that moment, and the extension answers whether you hold an offer for that store. The address is matched on your computer and is not stored or sent anywhere. At any other time the extension cannot see which sites you visit; it has no permission to.
• Offers synced from a browser carry a source label (for example "Chrome") so the app can say where a sync came from. That is the only thing recorded about your browser.

Sharing of data

We do not sell, rent, or share your data with third parties. We have no advertising or data-broker relationships.

Deleting your data

• Use Settings → Account → Delete account to permanently delete your account and the offers synced to it.
• Use Settings → Clear synced offers to remove the offers stored under your identity while keeping the app.
• Deleting the app removes your device-only session.
• In the desktop extension, Cards & offers → Account → Sign out on this computer clears everything the extension kept on that computer; Clear synced offers there removes the offers stored under your account, the same as in the app.
• Deleting your account also deletes your card requests and store reports.
• To request deletion of any remaining data, email us (below).

Children's privacy

RightCard is not intended for children under 13. We do not knowingly collect personal information from children.

Changes to this policy

If we change this policy, we will update the effective date and publish the updated version at this same URL.

Contact