Skip to content
Perkly

Privacy policy

Perkly has no accounts, no tracking and no ads. Here is exactly what happens to your data.

Effective date:

The short version

  • The cards you hold and your settings stay on your device, in your browser's storage and the extension's storage.
  • To work out a recommendation, Perkly sends your card list, the purchase amount and the store (or category) to the Perkly API. The API answers and keeps nothing.
  • The extension reads only the store's domain, the order total and its currency from a cart or checkout page.
  • There are no accounts, no tracking cookies, no analytics, no ads and no affiliate links.
  • We don't sell or share your data. Perkly is free.

What data is processed, and where

Perkly has three parts. Each handles a small amount of data.

  • The website (perkly-web-five.vercel.app) runs in your browser. It shows the card catalogue, the calculator and your wallet. Your wallet is the list of cards you hold, plus any bonus categories you picked, cards whose spending cap you've reached, your point-valuation choice and any custom point values.
  • The Perkly API (perkly-api.vercel.app) calculates which of your cards earns the most. It also serves the public card catalogue.
  • The Chrome extension runs in your browser. It works on the cart and checkout pages of the Canadian online stores it supports. On those pages, it reads the order total, its currency and the store's domain name (for example, www.loblaws.ca). It then shows a small badge with the best card from your wallet.

The extension does not read card numbers, payment fields, the items in your cart, your name, your address or anything else you type. To tell whether you're on a cart or checkout page, it checks the page address on your device. It sends only the domain name, never the path or query, and doesn't record which pages you visit.

The extension runs automatically only on the supported store sites listed in its manifest. On any other site, it runs only when you click Check this page in its popup. That gives it one-time access to the current tab through Chrome's activeTab permission, and it then looks for an order total in the same way.

What is stored, and where

Everything Perkly stores stays on your device:

  • Website: your wallet is saved in your browser's local storage for this site, under the key perkly:wallet. The site sets no cookies.
  • Extension: a copy of your wallet, with the time it was last changed and last synced, is saved in the extension's own storage (chrome.storage.local).
  • Dismissing the badge: when you close the badge on a store page, the extension saves a "dismissed" flag in that tab's session storage so that the badge stays closed. The browser deletes it when you close the tab.

Syncing: when you open the Perkly website with the extension installed, the extension compares its wallet with the one the website saved in your browser and keeps whichever you changed most recently, copying it to the other side. This happens inside your browser. Nothing is uploaded to do it.

To delete your data, remove the extension and clear this site's data in your browser settings. Do both: while the extension is installed, it copies its wallet back to the site the next time you visit. No other copy exists anywhere.

What is sent to the API, and why

To work out a recommendation, the website's calculator and the extension send a request to the Perkly API. A request contains:

  • the ids of the cards in your wallet, with your bonus-category picks and cap settings;
  • your point-valuation choice and any custom point values;
  • the purchase amount and its currency;
  • the store: the domain of the page you are on (from the extension), or the store or category you chose (from the calculator).

The API uses this only to calculate and return the ranking. It doesn't log these requests or save them to any database. It doesn't set cookies and doesn't try to link requests to each other or to a person.

To prevent abuse, the API limits how many requests each IP address can make per minute. It keeps a short counter for each IP address in the server's memory only. This counter is never written to disk. It is lost when the server instance shuts down or when newer addresses replace it. Our hosting provider, Vercel, also limits recommendation requests per IP address at its network edge. It uses your IP address only to count those requests, under Vercel's privacy policy.

The website and the extension also download the public card, store and category lists from the API. These requests send no personal data.

Hosting providers

  • Vercel hosts the website and the API. Like any web host, Vercel keeps standard request logs, such as your IP address, the page or endpoint requested, the time and your browser type. These logs are kept for a limited period under Vercel's privacy policy (opens in a new tab). If the API hits an unexpected error, a technical error report goes to the same logs.
  • Where requests are processed: the API runs on Vercel in the United States, in its Washington, D.C. region (iad1), so recommendation requests are processed there. Vercel serves the website's pages and the cached public card lists from its global network, usually from the location nearest you. The United States may have privacy laws that differ from Canada's.
  • Supabase holds a copy of the public card catalogue (cards, earn rates and stores). It holds no user data. The website, the API and the extension don't send it anything about you.

Retention

Perkly keeps no user data on any server. The only server-side records are the hosting provider's standard request logs described above. Data on your device stays until you clear it or remove the extension.

Selling, sharing and advertising

We don't sell, rent or share your data. We don't use it for advertising, profiling or creditworthiness. Perkly has no affiliate links and earns nothing when you pick a card. We collect only what the recommendation needs, in line with the principles of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Children

Perkly is a tool for adults who hold credit cards. It isn't aimed at children, and we don't knowingly collect information from anyone under 13.

Changes to this policy

If Perkly starts handling data differently, for example if it adds optional accounts, we'll update this page and the effective date before the change takes effect. If a change affects data you have already given, we'll ask for your consent first.

Contact

Questions about privacy? Email frickwu0316@gmail.com.