Privacy Policy

This page explains what MaxPoints.ai collects when you use the site, where it goes, and how long it is kept. It describes what the site’s code and settings actually do. There are no user accounts, and you can use every tool without giving us your name or email address.

The short version

• The calculator’s spending numbers are sent to our server to work out results. They aren’t saved, unless you click Share.
• Share saves your spending profile and result under a random link for 30 days.
• The site uses Google Analytics. Google signals is off, and Analytics isn’t linked to Google Ads.
• Two calculator settings are kept in your browser’s local storage. MaxPoints itself sets no cookies for visitors; Google Analytics does.
• If you sign up for transfer bonus alerts, we store your email address. Every alert has an unsubscribe link.

The calculator

When you enter spending amounts, the cards you already hold or want to exclude, or other options, your browser sends them to our server. The server calculates the best cards and sends the result back. It doesn’t write these inputs to the database or to a log, and nothing links them to you.

Some pages put your numbers in the page address (the part after “?”), so a link can reproduce the result. These include the quick calculator on the home page, the fee audit, the award sweet spot finder, and calculator links with amounts filled in. The calculator also adds your credit and card-swap choices to the address. These addresses can end up in your browser history. Before a page address is passed to Google Analytics, the site removes everything after “?” except campaign tags (such as utm_source) and list filters, so your amounts, choices and email link tokens aren’t sent to Google Analytics (see below).

Shared result links (/r/…)

When you click Share (or copy the link, or share to X or Reddit), we save a snapshot so the link keeps working. The snapshot holds:

• your monthly spending amounts by category;
• any cards you marked as already held or excluded, and your Chase 5/24 answer if you gave one;
• your credit and card-swap choices; and
• the result: the recommended cards and the dollar figures.

It’s stored under a random 22-character link with the time it was created. We don’t store your name, email address or IP address with it. Anyone who has the link can open it. Result pages tell search engines not to index them, and they aren’t listed in our sitemap. Sharing to X or Reddit opens their site with the link and a short text; what happens there is covered by their own policies.

Shared results are deleted automatically 30 days after they’re created. The cleanup runs when new links are created, at most every 6 hours, so a link can outlast the 30 days by a little. There’s currently no way to delete a link yourself before then.

Stored in your browser

The calculator keeps two items in your browser’s local storage, so your choices survive a reload:

• maxpoints:credit-choices:v1: statement credits you turned on or off; and
• maxpoints:swap-choices:v1: cards you swapped in the results.

These stay in your browser. They reach our server only as part of a calculator request or a shared link. You can remove them by clearing this site’s data in your browser. MaxPoints itself doesn’t set cookies for visitors; the only cookies on the site are Google Analytics’ (below).

Google Analytics

We use Google Analytics 4 (measurement ID G-BF527GQH4N) to see which pages and tools people use. It loads after you first scroll, tap or type, or a moment after the page finishes loading. It isn’t loaded on the embeddable widget at /embed. Google Analytics collects:

• the pages you view and the page that sent you here, with everything after “?” removed except campaign tags and list filters;
• device, browser and screen information, and an approximate location that Google derives from your IP address;
• Google’s automatic “enhanced measurement” events: scrolling, clicks on links to other sites, file downloads, site searches, embedded video plays, form interactions and in-page address changes; and
• a few events we send ourselves: calculation_run (the name of the top recommended card and how many cards were recommended), card_clicked (the card name and the text and address of the link you clicked), result_shared (how you shared: copy link, X, Reddit or your device’s share sheet), and the alert sign-up steps (transfer_bonus_signup_click, transfer_bonus_signup_submitted, transfer_bonus_signup_confirmed, transfer_bonus_signup_unsubscribed, sign_up with method “email”). These events don’t include your spending amounts or your email address.

Our settings: Google signals is turned off, the property isn’t linked to Google Ads, and Google’s email redaction is turned on, so email addresses in page addresses are removed before they’re stored. Google keeps event-level data for 2 months and user-level data for 14 months. Google says that Google Analytics 4 doesn’t log or store IP addresses; see Google’s explanation.

Google Analytics sets two first-party cookies, _ga and _ga_BF527GQH4N. They hold random identifiers that let Analytics count returning visitors. Google requests a two-year lifetime; Chrome caps it at about 13 months.

To opt out, install Google’s Analytics opt-out browser add-on, or block www.googletagmanager.com and www.google-analytics.com with a content blocker. The site works the same without Analytics. Google’s use of the data is covered by Google’s privacy policy.

Transfer bonus email alerts

If you sign up on the transfer bonuses page, we store:

• your email address;
• the programs you chose, if you picked any;
• a random token used in the confirmation and unsubscribe links; and
• when you signed up, confirmed and unsubscribed, and when we last emailed you.

We use the address only to send the confirmation email and the alert emails. Emails are sent through Oracle Cloud Infrastructure’s Email Delivery service. Unconfirmed sign-ups older than 7 days are deleted the next time anyone signs up. Every alert includes an unsubscribe link, and unsubscribing takes effect immediately. After you unsubscribe, we keep your address marked as unsubscribed so it gets no more emails.

Cloudflare, hosting and logs

All traffic to maxpoints.ai passes through Cloudflare, which provides caching and security. Cloudflare handles your IP address and request details to do this. Cloudflare also adds its Web Analytics script (from static.cloudflareinsights.com), which reports page views and page-load performance to Cloudflare; Cloudflare describes it as not using cookies. See Cloudflare’s privacy policy.

The site runs on Oracle Cloud Infrastructure. Our application doesn’t keep an access log of the pages you request. To rate-limit heavy tools, the server keeps your IP address in memory and forgets it after about 10 minutes of inactivity. Error logs can include an email address when an alert email fails to send. The database, which holds shared results and alert sign-ups, is continuously backed up to Oracle Cloud object storage. Something deleted from the database can stay in those backups for a while until they roll over.

Embedded widget

Other sites can embed our calculator from /embed. The widget handles your numbers the same way as the calculator above and doesn’t load Google Analytics, but Cloudflare still handles the request. The site that embeds it has its own privacy policy.

Other third parties

Fonts, card images and scripts are served from maxpoints.ai. Apart from Google Analytics and Cloudflare, the site loads nothing from other companies. There are no ads, social media widgets or chat tools.

Changes

When this policy changes, we update the date at the top of this page.

Contact Us

If you have any questions about this privacy policy, please contact us.