Privacy policy

Effective [EFFECTIVE DATE]. Operated by [OPERATOR LEGAL NAME]. Contact: [CONTACT EMAIL].

bestcashback.fyi tells you which credit cards are worth carrying given what you spend. To do that it needs some information from you. This page lists exactly what, why, who else handles it, and how to get rid of it. It is written to be read.

What we collect

Data	When	Why
Your sheet: spending amounts by category, the cards you say you hold, cards you exclude, how you say you use points, the dollar value you put on card perks, and your answers to follow-up questions (for example whether you book travel through a card's portal).	When you fill in the worksheet.	It is the input to the optimizer. Saved to your account only if you sign in; otherwise it stays in your browser (see below).
Account, Google sign-in: the name, email address, profile image URL and account identifier Google provides.	When you sign in with Google.	To recognise you and keep your sheets.
Account, username sign-in: your username and a one-way hash of your password. We never store the password itself. An email address only if you add one.	When you create a username account.	To recognise you. Without an email we cannot reset your password or send alerts, and the sign-up form says so.
Purchases: your Lemon Squeezy customer id, order or subscription id, plan, status and paid-through date.	When you buy Pro or Premium.	To know what you are entitled to. We never see your card number.
Preferences: whether you have paused alert emails.	When you change it.	To respect it.
Technical: your IP address and browser identifier, in server logs and in a short-lived in-memory counter.	Every request.	To run the service, and to limit how often one address can call the optimizer or try a password.

We do not collect account numbers, statements, transactions or credit reports, and we never connect to your bank or card issuer. We do not use analytics or advertising trackers.

Cookies and storage on your device

One cookie, set when you sign in: better-auth.session_token (prefixed __Secure- on the live site). It keeps you signed in. No advertising or analytics cookies.
One browser storage entry when you use the site without signing in: bestcashback.sheet.v1 in localStorage, holding the sheet you are editing so it survives a reload. It never leaves your browser unless you sign in, at which point it becomes your first saved sheet.

Who else handles your data

Only the services needed to run the site, each for one job:

Google — sign-in, if you choose it.
Lemon Squeezy — payments, as the merchant of record. Your card details go to them, not us. Their policy governs that data.
Neon — hosts the database that stores accounts and sheets.
Render — hosts the application and keeps its server logs.
Resend — delivers the only emails we send: a password reset you asked for, and Premium alerts you paid for.
Have I Been Pwned — when you set a password we send the first five characters of a one-way hash of it to check whether it appears in known breaches. Neither your password nor your identity leaves our server.

We do not sell data, share it for advertising, or build profiles.

How long we keep it

Account data, sheets, purchase records and preferences: until you delete your account. Deleting it from the account menu removes all of them at once. Lemon Squeezy keeps its own records of payments as the law requires of it.
Server logs: kept by our host for a limited period [RENDER LOG RETENTION — verify], then gone.
Anonymous optimizer requests: not stored. The rate-limit counter forgets an address within a minute.

Your choices and rights

Use the site without an account; nothing is saved beyond your own browser.
Delete your account yourself, at any time, from the account menu.
Pause alert emails from the account menu; cancelling Premium also stops them.
Ask us for a copy of your data, a correction, or deletion by writing to [CONTACT EMAIL]. If you are in the EU/EEA, UK, or California, the rights those laws give you apply and this is how to exercise them.

Age

The site is about credit cards and is for people 18 and over.

Changes

When this page changes, the effective date above changes with it. Material changes to how we handle account data will also be announced on the site.