Privacy Policy

Effective date: 10 September 2026 Last updated: 20 October 2026

This policy explains what Unspent collects, why, and what you can do about it. Unspent is operated by OptimAIze LLC, a Wyoming limited liability company ("we", "us").

The short version

Unspent works by knowing which card products you hold and when they renew. That is genuinely all it needs. So that is close to all we store.

We never ask for and never store:

• Card numbers — not the full number, not the last four digits
• Security codes, expiry dates, or PINs
• Bank or issuer logins, or any connection to your accounts
• Your transactions, balances, statements, or spending
• Your legal name, postal address, date of birth, or government identifiers

There is no field for any of it in the app, and no part of the product uses it. We do not sell or rent your information to anyone, ever. We do not use third-party advertising networks or advertising trackers. We do not carry card offers today; when we do, section 5a sets out exactly how they will work and what we will use to choose them, and it was written before the first one appears.

We use AI to build our benefit catalogue from public issuer pages — but never from your data. No AI provider is ever sent your email, your cards, or anything about your account. Section 5b explains this in full.

1. What we collect

Account

• Your email address, used to identify your account, to send your 6-digit sign-in code, and to send the occasional product email described in section 4 (which you can unsubscribe from at any time)
• If you choose Continue with Apple or Continue with Google, the email address that provider confirms for you. Apple may instead give us a private relay address that forwards to you, and may give your name the first time you sign in; Google may give your name. We keep the name only to address you, and never receive your Apple or Google password
• The date your account was created
• If you unsubscribe, your address is kept on a suppression list so that we do not email you again

What you put in the app

• Card nicknames you choose (these are free text — please do not put anything sensitive in them)
• Which catalogue card product each one corresponds to
• Renewal dates, and any annual fee you override
• Whether you have marked each benefit as used, not available on your account, or ignored, and any partial amount you record
• Any custom benefits and reminders you create
• Your notification preferences

Technical

• Basic device and app information (app version, platform, operating system version)
• A push notification token, if you enable notifications on mobile
• Error reports, if something crashes. These are scrubbed before they leave your device: URLs have their query strings stripped, and any field whose name suggests a token, key, password, email, phone number, or code is redacted.
• Aggregate usage counts, used to understand which features are used at all
• Product analytics, only if you turn it on. The mobile app has an analytics switch that is OFF by default. If you turn it on, the app records a small set of in-app product events — which screens you open and key actions like signing in, finishing onboarding, and adding a card — against a pseudonymous id, so we can see where people get stuck. It never includes your card numbers, your nicknames, any amounts, or your email. It is processed by PostHog (see §5), and you can turn it off again at any time in the app's settings; off means nothing is sent.
• Website visit counts on the public pages of unspent.cc, collected by Google Analytics (page URL, browser, and a cookie Google sets — see §5). Sign-in, the signed-in app, and admin are not sent to Google Analytics. Nothing about your cards or your email is sent.

What we do not do: we do not use advertising trackers or sell a profile of you. The public website uses Google Analytics to count visits (see §5); we do not send your email or anything about your cards to Google.

2. Why we collect it

Under GDPR, our legal bases are performance of a contract (running the account you asked for), legitimate interests (keeping the service working, secure, and accurate), and consent where required, such as for push notifications.

3. How your "not in my account" reports are used

When you tell us a benefit is not on your account, we record it. We aggregate these across everyone who holds that card and, if enough people report the same benefit, it goes into a review queue for a human to check against the issuer's published terms.

Your individual reports are never shown to other users, never published, and never attributed to you. Our own review tools show a percentage, not a list of people.

4. The email we send, and how to stop it

You can sign in with Apple, with Google, or with a 6-digit code we email you when you ask for one. The code is transactional and always sent when you ask for it; signing in with Apple or Google sends no email.

We may also send occasional product email — that Unspent has opened, a meaningful new feature, an important service notice — to your account email address, and to the email of anyone who joined the waitlist. This is low-volume and not a daily or weekly drip. Every one of these emails carries a one-click unsubscribe link in its footer; unsubscribing is honoured immediately and permanently, and a suppressed address is skipped on every future send. Your 6-digit sign-in code is transactional and still reaches you after you unsubscribe, because it is how you get into your own account.

We do not use third-party advertising email, and we do not sell or rent your address to anyone.

Benefit reminders are delivered as push notifications, and only if you turn them on. You can turn them off at any time in your device settings or in the app.

We may also show promotions for our own products inside the app. These are labelled, dismissible, and involve no third party receiving your information.

5. Who else touches your data

We use a small number of service providers to run Unspent. They process data on our instructions and are not permitted to use it for their own purposes.

Sentry receives a report when the app crashes or hits an error. We turn off its personal-data collection, keep only an opaque account id so repeated reports can be grouped, and strip anything that looks like a token, an email address or a phone number before the report is sent.

Cloudflare Turnstile runs on the sign-in screen. It is invisible: you are not asked to click anything or identify pictures. It looks at how your browser or device behaves in order to tell a person from an automated script, and it does not receive your email address or anything about your cards. Cloudflare processes this under the Turnstile Privacy Addendum.

This list is what is actually in the path today. We will update this list whenever it changes. We do not sell or share your personal information for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA.

We may disclose information if legally required to, and we will tell you unless we are legally prohibited from doing so.

5a. Advertising and card offers

Advertising is switched OFF today, and this section changed before it can be switched on. There are two kinds and each has its own switch: our own products, and paid card offers. Both are off unless we turn them on, and the app treats a switch it cannot read as off.

This section changed first. Unspent is free to use for up to two cards, and a paid plan (currently $2.49/month, first month free, billed through the app store) unlocks more than two cards and household sharing. The other way a tool like this pays for itself is a commission when someone applies for a card through it, and we are going to start carrying those. We are telling you here before the first one appears, which is the standard section 5 holds us to for sub-processors.

These are the rules we bind ourselves to:

• It is marked at the link, not disclosed in a footer or a settings page you would have to go looking for.
• What we are paid never decides what you are shown first. Cards are ranked by our own arithmetic — the annual fee against the value of the benefits we have verified — and that ranking does not know what any offer pays. What we are paid is recorded for reconciliation and is not an input to ordering.
• When offers are shown, we use your account to decide which ones. This is the part that changed. Which cards you hold, and which credits you actually claim, decide which card offers are worth showing you — the point is to stop showing you a card you already have, or one whose benefits you would never use. Previously this section said we would not do this. We will, once offers are switched on, and would rather say so plainly now than leave the old sentence standing.
• That matching happens on our servers and stays there. The network that pays the commission is told a click happened and a random reference. It is not told who you are, which cards you hold, or what you have claimed.
• Offers appear in their own marked section, never inside the list of benefits you are tracking and never counted in any figure about your money. A paid link is never presented as a benefit.
• A click is still not tied to you. We log that a link was followed, with a random reference so a commission can be reconciled. There is no account id and no session attached to it, so it cannot be assembled into a record of what you were shopping for. offer_clicks has no column for you to go in.
• You can turn the matching off. One switch, beside the offers themselves, stops your account being used to choose offers. You will still see offers; they will just be the unmatched ones everybody else sees. Switching it off is not a punishment: it removes the matching, not the product.
• We still do not sell or share your personal information for cross-context behavioural advertising, as defined under the CCPA/CPRA. Nothing about you leaves us, and nothing follows you to another site.

Card offers and affiliate links are intended exclusively for residents of the United States. If you reside outside the United States, these offers are not intended for you and will not be displayed.

5b. How we use AI, and what it never sees

We use automated systems, including AI language models, to help build and maintain our benefit catalogue: reading publicly available issuer pages, extracting what a card's benefits are, and cross-checking figures before they go live. This is how we keep a large catalogue current — and, as the Terms explain, it is one reason the catalogue can be wrong, so you should always confirm a benefit with your issuer.

These systems only ever process public issuer materials. We do not send your personal information to any AI provider — not your email, not the cards you hold, not your nicknames, not your benefit history, not anything about your account. The AI builds the catalogue everyone sees; it never touches your data.

The AI systems we use for this receive only public web content. We do not use AI to make automated decisions about you, and no AI provider is given, or can infer, who you are.

6. How long we keep it

We keep your data while your account exists. If you delete your account, we delete it — see below.

Aggregated, anonymised statistics that can no longer be linked to you (such as "17% of holders of this card report this credit is missing") may be retained, because there is nothing left in them that identifies anyone.

Backups are taken on a rolling basis by our database provider (Supabase) and overwritten as newer ones replace them, so a residual copy of deleted data may remain in a backup for a short period after it is gone from the live database — until that backup is overwritten in the normal rolling cycle, after which it is gone everywhere. We do not restore deleted accounts from backup, and we keep no other copy of your data after deletion.

7. Deleting your account

You can delete your account at any time from the profile screen, on the web or in the mobile app. You do not need to email anyone or ask permission.

Deletion is immediate and permanent. It removes your account, your cards, your benefit history, your custom reminders, your notification preferences, your push tokens, and your email address. It is not a soft delete or a deactivation — the rows are removed.

Aggregated statistics that no longer identify you, and records we are legally required to keep, are the only exceptions.

8. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct it if it is wrong
• Delete it — you can do this yourself, instantly, from the app
• Export it in a portable format
• Object to or restrict certain processing
• Withdraw consent at any time, for anything based on consent
• Not be discriminated against for exercising any of these rights

Most of this you can do yourself inside the app. For anything else — including if you can no longer sign in — use our contact form. We respond within 30 days.

Benefit reminders are push notifications rather than email, and any product email we send is occasional and carries a one-click unsubscribe (section 4). The contact form is monitored so that you always have a way to reach us that does not depend on having access to your account.

If you are in the EEA or UK, you also have the right to complain to your local data protection authority.

California residents: we do not sell your personal information and have not in the preceding 12 months. We do not knowingly collect the personal information of anyone under 16.

9. Where your data is held

Our infrastructure is in the United States. If you use Unspent from outside the US, your data is transferred to and processed there. Where required, we rely on Standard Contractual Clauses or an equivalent transfer mechanism with our providers.

10. Security

Access to your data is enforced at the database level by row-level security, so a fault in our application code cannot expose one person's data to another. We do not hold payment credentials, so there is nothing in Unspent that could be used to charge you.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as required by law.

11. Children

Unspent is not intended for children under 13, or under 16 in the EEA and UK. We do not knowingly collect their data. If you believe a child has given us personal data, use our contact form and we will delete it.

12. Cookies and local storage

The web app uses local storage and a session cookie to keep you signed in and to remember interface preferences. Those are strictly necessary for the app to function. The mobile app stores your choices on the device too, including whether you have turned product analytics on (see §1); that choice stays on your device.

The public website also loads Google Analytics on unspent.cc (not on sign-in, the signed-in app, or admin), which sets its own cookie so Google can count repeat visits. We turn off Google's advertising signals and we do not use it to sell your information. We show a consent banner on the public site and load Google Analytics — and set its cookie — only if you accept; declining is remembered and Analytics never loads. You can also block it with a browser tracker-blocker or Google's opt-out.

13. Changes to this policy

We may update this policy. If a change materially affects how we handle your data, we will notify you in the app or by email before it takes effect, and update the date at the top.

14. Contact

Reach us through our contact form.

OptimAIze LLC, 30 N Gould St # 58812, Sheridan, WY 82801, USA

We have not appointed a data protection officer; the contact form reaches the person responsible.