CC Optimized

Last updated 16 August 2026

Privacy Policy

CC Optimized is a credit card optimizer that never touches your credit cards. This page says exactly what we store, why, who can see it, and how to get rid of it.

The short version

  • We store your email, an optional display name, the list of cards you tell us you own, and which benefits you've ticked off. That is the whole list.
  • We do not collect card numbers, security codes, expiry dates, the last four digits, balances, statements, transactions, credit scores, or bank login details. There is no field in the product for any of them and no connection to any bank.
  • We do not sell your data. We do not share it with advertisers or data brokers.
  • You can export everything or delete your account instantly from Settings.

What we collect

Account information

Your email address and password, handled by our authentication provider. Passwords are salted and hashed by that provider using an industry-standard algorithm; they are never stored in plain text and are never visible to us. An optional display name, if you give one.

Your wallet

The identity of each card you add — a reference to an entry in our public card catalog, plus an optional nickname you write yourself. This says "this person owns a Chase Sapphire Preferred". It does not, and cannot, identify a specific account at Chase.

Your benefit history

When you mark a perk as used, we record which benefit, which period, and the time you ticked it. This is what makes the tracker work across months.

Technical logs

Our hosting and database providers keep standard operational logs — IP address, user agent, timestamps, error traces — for security and debugging. These are retained on their schedules and are not used to build a profile of you.

What we deliberately do not collect

This is the design decision the rest of the product is built around. Because the app works entirely from a catalog you select from, there is no reason for us to hold anything sensitive, so we don't:

  • No card numbers, CVVs, expiry dates, or last-four digits.
  • No bank or issuer credentials, and no aggregator connection (no Plaid or similar).
  • No balances, statements, transactions, or spending data.
  • No credit reports, credit scores, or Social Security numbers.
  • No location tracking and no third-party advertising or analytics trackers.

If a future version of CC Optimized ever needs any of this, we will ask you first, explain exactly why, and make it optional.

How your data is protected

  • Encrypted in transit. Everything travels over HTTPS/TLS.
  • Encrypted at rest. The database and its backups are encrypted on disk by our infrastructure provider using AES-256.
  • Isolated per user. Every table holding user data has row-level security policies in the database itself. A query can only ever return rows belonging to the authenticated user, and that rule is enforced by Postgres rather than by application code — so an application bug alone cannot expose one user's data to another.
  • Standard authentication. Session tokens and password hashing are handled by our auth provider. We did not write our own.

Who we share it with

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We rely on a small number of processors to run the service:

  • Supabase — database, authentication, and transactional auth emails.
  • Vercel — application hosting.

Each processes data only to provide the service to us. We will also disclose information if legally compelled, and will tell you unless we are prohibited from doing so.

Your rights

We give every user the same rights regardless of where they live, rather than gating them by jurisdiction:

  • Access and portability. Download everything we hold about you as a JSON file, immediately, from Settings.
  • Correction. Edit your name, cards, and benefit history in the app at any time.
  • Deletion. Delete your account from Settings. Your account and all associated rows are removed from the live database immediately. Encrypted backups roll off on our provider's retention schedule, typically within 30 days.
  • Objection and complaint. If you are in the EU, UK, or California, you may also have the right to object to processing or to lodge a complaint with your supervisory authority.

If you are in the EU or UK, our lawful basis for processing is performance of a contract (running the account you asked for) and legitimate interest (keeping the service secure).

Cookies

We set one category of cookie: the session cookie that keeps you signed in. It is strictly necessary for the app to function and is not used for tracking or advertising. There are no third-party analytics or advertising cookies, which is also why you aren't reading this through a consent banner.

Children

CC Optimized is not directed at anyone under 18 and we do not knowingly collect information from children. If you believe a child has created an account, contact us and we will delete it.

Changes and contact

If we make a material change to this policy we will notify signed-in users by email before it takes effect. Questions, requests, or concerns: privacy@example.com.

Replace the contact address and the processor list above with your real details before launch.