Privacy Policy

This Privacy Policy describes how Brewapps LLC ("Creddy", "we", "us", or "our") collects, uses, and protects your personal information when you use the Creddy mobile application (the "App") and related services (collectively, the "Services").

Creddy is available on iOS, Android, and the web to help you track card benefits, statement credits, welcome bonuses, and reset windows. We designed Creddy with privacy as a foundation - we do not sell your data, we do not share it with advertisers, and we collect only what is needed to operate the App.

1. Who We Are

Brewapps LLC is the data controller for information collected through Creddy. We are a Delaware limited liability company. You can reach our privacy team at hello@thebrewapps.com.

2. Information We Collect

2.1 Account Information

When you create a Creddy account, we collect your email address and (optionally) your display name. Account creation is handled by Supabase Auth, our authentication provider. Passwords are hashed using industry-standard algorithms and never stored in plaintext.

2.2 Cards You Add

Creddy lets you add credit cards from our catalog to track their benefits. We store the card issuer and card name you select (e.g., "American Express Platinum", "Chase Sapphire Reserve") and the optional details you add to a card, such as a nickname, the last four digits, the date you opened it, and its credit limit. If you link the card account (section 2.4), the last digits and credit limit can come from that account. We do not store:

• Full card numbers, expiration dates, or CVV codes
• Bank login credentials
• Payment credentials
• Your billing address

2.3 Benefit Usage You Log

When you mark a benefit as used inside the App, we store the dollar amount, the date, and any optional note you add. This information is tied to your account so we can show your tracking history back to you and warn you before benefits expire.

2.4 Linked Financial Accounts

Where account linking is available, you can choose to connect a US credit-card account through Plaid. We receive the institution and account names, an account identifier and last digits, current or available balance and credit limit when provided, and transaction dates, merchant or description, amount, category, and status. We use this information to match posted statement credits to your card benefits. A statement credit that clearly names a card credit is counted as benefit usage automatically when it posts, and you can undo it. Less certain matches wait for you to confirm them. We do not receive or store your bank username or password.

Statement-credit descriptions, merchant names, amounts, and dates may be processed by TypeSafe to suggest which card credit they pay out. We send them without your name, email, or account identifiers.

To improve credit matching for everyone, we keep de-identified statement-credit records: the card product, the credit's wording with numbers removed, how it was matched, the month, and a rough amount range. They contain no name, email, account, or transaction details, and we keep them after you disconnect an account or delete your Creddy account.

While an account is linked, our team may review its statement-credit lines (the date, amount, description, and the card's last digits), without your name or email, to match credits correctly. These details are deleted when you disconnect the account.

We store the Plaid access token encrypted on our server while the account is linked. You can disconnect an account in Creddy, which revokes its Plaid connection and deletes its imported account and transaction data from our database. Benefit usage that was counted automatically or that you confirmed remains in your wallet history until you remove it or delete your Creddy account. Plaid's handling of data is described in the Plaid End User Privacy Policy.

2.5 Subscription State

If you buy a Creddy Pro plan or the Auto-tracking add-on, the purchase is handled by the channel you buy through: the Apple App Store, Google Play, or our web checkout, which RevenueCat Web Billing provides. RevenueCat, our subscription-management provider, tells us which product you bought, its status, and a transaction identifier from that channel. Payment details go to the channel, not to Creddy. We do not receive your full payment card number or your Apple or Google account details.

2.6 Push Notifications

When you enable push notifications, we collect an Apple Push Notification Service (APNs) device token. This token is used solely to deliver reminders about expiring benefits and welcome-bonus milestones. You can disable notifications at any time from your iOS Settings.

2.7 Product Analytics

On the website, we use Google Analytics 4, PostHog, and Amplitude only when you accept optional analytics. They help us understand traffic sources, page visits, app-store clicks, and subscription checkout outcomes using pseudonymous browser identifiers. We do not send names, email addresses, payment details, or card numbers in analytics events.

You can accept or reject analytics and change your choice using Cookie preferences in the website footer. Rejecting analytics does not affect sign-in, subscriptions, or other essential features. Withdrawing consent stops future analytics collection and removes analytics cookies and browser storage where supported; it does not delete information previously collected. We do not enable advertising personalization or session recordings on the website.

Essential storage supports your sign-in session and remembers your privacy choice. Analytics providers may process technical information such as browser details and network addresses when receiving requests. Google describes its processing in its Privacy Policy. Mobile-app analytics preferences are managed separately from this website choice.

2.8 Crash and Diagnostic Data

We may collect anonymized crash reports and performance metrics to diagnose bugs. This data is processed in aggregate and does not include personal identifiers.

3. How We Use Your Information

• To provide, operate, and improve the App
• To send you push notifications about benefits you might lose if you don't use them in time (only if you opt in)
• To process and manage your Creddy Pro subscription
• If you link a card account where available, to connect it through Plaid, count clear statement-credit matches, and suggest the rest for your review
• To respond to your support requests and communicate with you about your account
• To detect, prevent, and investigate fraud, abuse, or security incidents
• To comply with legal obligations

4. Third-Party Service Providers

We use a small number of trusted third-party service providers to operate Creddy. Each acts as a data processor under our instructions and is bound by data-processing terms.

• Supabase (database + authentication) - stores your account, cards, and benefit-usage data. Operated in the United States and European Union.
• RevenueCat (subscription management and web checkout) - handles the state of your Creddy Pro plan and Auto-tracking add-on. Operated in the United States.
• Apple Push Notification Service - delivers notifications to your device. Operated by Apple Inc.
• PostHog (product analytics) - collects anonymized usage events. Operated in the United States.
• Amplitude (product analytics) - collects pseudonymous website usage events. Operated in the United States.
• Vercel (web hosting) - hosts the Creddy marketing website and CMS infrastructure.
• Plaid (optional financial-account connectivity) - processes linked-account information only if you choose to connect an account.
• TypeSafe (AI matching) - may process statement-credit descriptions from linked accounts, without your name or account identifiers, to suggest benefit matches.

5. What We Do Not Collect or Share

We want to be specific about what we do not do with your data:

• We do not sell your data to third parties.
• We do not share your data with advertising networks or data brokers.
• We do not use your data for targeted advertising.
• We do not share your data with credit card issuers or financial institutions.
• We do not collect full card numbers, CVVs, or any actual payment-instrument data.

Google Analytics 4 provides optional website traffic and interaction measurement after your consent.

6. Creddy in ChatGPT

The Creddy plugin for ChatGPT answers card questions from our public card catalog. It does not need a Creddy account and never asks for card numbers, account numbers, or passwords.

• What we receive: only what ChatGPT sends to answer your request, such as card names, a spend category, a points program, or an annual fee limit. We do not receive your ChatGPT conversation.
• How we use it: to look up and return card information. We do not store these requests in a user profile, link them to a Creddy account, or use them for advertising.
• Who processes it: Vercel hosts the plugin endpoint and Supabase serves the catalog data. Vercel keeps standard request logs (including IP address and time of the request) for a short period for security and reliability.
• Links: some answers link to a card issuer's application page. Creddy may earn a commission if you apply. What you share with an issuer is governed by that issuer's privacy policy.

7. No Affiliation with Card Issuers

Creddy is an independent application and is not affiliated with, endorsed by, or sponsored by American Express, Chase, Citi, Capital One, Bank of America, Discover, Wells Fargo, Barclays, Bilt, U.S. Bank, or any other credit card issuer. The benefit data shown in the App is collected from publicly available sources and is for informational purposes only. Always verify benefit terms with your card issuer before relying on them.

8. Data Retention

We retain your account data while your account is active. When you delete your account, we purge your personal information within 30 days, except where retention is required by law (for example, financial records required for tax compliance). Anonymized analytics data may be retained for up to 12 months for product-improvement purposes.

Some deleted information may remain temporarily in restricted backups until the provider's normal rotation completes. We do not use those copies except for recovery, and valid deletion requests are reapplied after a restoration. Imported Plaid transactions are deleted 13 months after their transaction date. Account details and the encrypted access token remain while the account is linked and are deleted when you disconnect it, when your Pro plan ends, or when you delete your Creddy account. De-identified statement-credit records (section 2.4) are kept to improve credit matching.

9. Your Privacy Rights

You have the following rights regarding your personal information:

• Access - request a copy of the personal data we hold about you
• Correction - request that we update inaccurate or incomplete data
• Deletion - delete your account and all associated data yourself at getcreddy.com/delete-account, or in the app under Settings → Delete account. You do not need the app installed to use the web page.
• Portability - request an export of your data in a machine-readable format
• Objection - object to certain types of processing

To exercise any of these rights, contact us at hello@thebrewapps.com. We will respond within 30 days.

8.1 California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act: the right to know what categories of personal information we collect, the right to delete, the right to correct inaccurate information, the right to limit the use of sensitive personal information, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as defined by California law.

8.2 European Union / United Kingdom Residents (GDPR / UK GDPR)

If you are located in the European Union or United Kingdom, our lawful basis for processing your data is (a) the performance of our contract with you (operating the App), (b) your consent (where you opt in to notifications or analytics), and (c) our legitimate interests in operating and improving the Services. You have all rights granted by the GDPR / UK GDPR, including the right to lodge a complaint with your supervisory authority.

10. Children's Privacy

Creddy is not intended for users under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us at hello@thebrewapps.com and we will promptly delete it.

11. International Data Transfers

Your data may be transferred to, and processed in, countries other than your country of residence, including the United States and the European Union. Where transfers occur from the EU/UK to the US, we rely on the European Commission's Standard Contractual Clauses or equivalent safeguards.

12. Security

We protect your data using industry-standard safeguards:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest in our database
• Row-Level Security policies in Supabase that isolate every user's data from every other user's data
• Apple-managed APNs for push notification delivery
• Periodic security reviews and dependency audits

No system is perfectly secure. If we discover a breach affecting your data, we will notify you in accordance with applicable law.

13. YouTube API Services

Brewapps LLC publishes its own explainer videos on its own YouTube channel using YouTube API Services. Only our team uses this, signed in as the owner of that channel. The Creddy app and website do not use YouTube API Services, and Creddy does not access, collect, or store any Creddy user's or other person's YouTube or Google account data through them.

Videos on our site may be played through YouTube. Your use of YouTube is subject to the YouTube Terms of Service and the Google Privacy Policy. Because we hold no YouTube user data, there is nothing for you to delete with us. To remove your own data from Google, see the Google Privacy Policy.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates the most recent revision. Your continued use of the Services after a material change constitutes acceptance of the revised Policy.

Optional account linking applies only after you choose to connect an account. We explain the information used for this feature before you connect it, and you can keep using Creddy without linking an account.

15. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact:

Brewapps LLC
Privacy Team
Email: hello@thebrewapps.com