Privacy Policy

Plume Points reads your credit-card statements once, keeps only the derived facts it needs to advise you, and discards the rest. We never see or ask for your banking credentials, we never store your transactions or merchant history, and we don’t run ads, analytics trackers, or sell data — there’s nothing here to sell.

When you upload a statement PDF, we extract its text, strip personally identifying details (names, addresses, account numbers) on our servers, and send only the redacted text to our AI provider to read the statement’s structure. The PDF and its transaction detail are discarded when the audit completes — they are processed transiently and never written to storage.

For visitors, nothing persists beyond your session: refreshing the page ends the audit.

For members, we store your account email, your subscription state, and the derived facts that power your dashboard: which cards you hold (including their card-ending digits, where the statement shows them), statement-period fingerprints (billing dates and counts, used to avoid double-counting), category-level spending totals, points balances, benefit-credit usage, and the details you tell us directly (card opened dates, household players, preferences). Transactions and merchant names are not among these — they are discarded on read.

When you upload a card we don’t yet model, we also keep the card-level facts the statement itself prints — the card’s name, its rewards-category labels as printed, and its annual-fee line — so we can add that card to the catalog for everyone — a person reviews it first; nothing is added automatically. These are terms of the card product, not your activity: no transactions, no merchant names, and none of your earned amounts ride along.

We never ask for and cannot receive your bank or card login credentials. Card numbers are redacted before any processing, except the card-ending digits printed on your statement (usually the last four; American Express prints five), which we keep to tell same-product cards apart. You’ll see them in your wallet as ····1234. Payments are handled entirely by Stripe — your payment card details never touch our servers.

We rely on a small set of processors to run the service:

• Cloudflare — hosting, storage, and delivery.
• Anthropic — AI statement reading. Receives redacted statement text only, after PII is stripped on our servers.
• Stripe — subscription billing and payment processing.
• Resend — delivers your sign-in codes by email.
• MailerLite — holds the issuer waitlist if you ask us to notify you about coverage.

You may request deletion of your data at any time by emailing hello@plumepoints.com. We will delete your derived profile data from our active systems within 30 days of a verified request. Note that removing a card or canceling your subscription does not by itself erase your stored derived facts — use the deletion request for full removal. We may retain limited billing records where required to comply with tax or accounting law.

The product contains no advertising and no ad-tech or cross-site analytics — our host, Cloudflare, collects basic performance telemetry. We do not sell or share personal information for advertising purposes.

We may earn referral compensation when you apply for certain cards through our links. Most cards we cover have no such link, and a referral relationship never influences our scoring or which card we recommend — our rankings are generated independently and we aim to surface the strongest offer available to you.

We do not sell or share your personal or financial data, and we never will. Our recommendations are independent, and referral relationships never influence what we recommend. This no-sale commitment is core to how Plume Points works.

Plume Points is operated by Rhodesters LLC, a Texas limited liability company. Questions about this policy: hello@plumepoints.com.