Privacy Policy

1. Who we are

TapWizz LLC (“TapWizz,” “we,” “us”), a Washington limited liability company, is based in King County, Washington, USA. This policy covers tapwizz.com and the TapWizz iPhone app. Questions? Email contact@tapwizz.com.

2. What we collect

When you visit tapwizz.com

• Which pages you view, the site or search that sent you here, your browser and device type, and an approximate location (country or city) based on your IP address. We use this to understand how people find TapWizz.
• We don’t use cookies or similar storage for this, we don’t record your screen, and we don’t link visits to your email. If your browser sends Do Not Track or Global Privacy Control, we don’t collect it at all.

When you join the waitlist

• Your email address, the phone you use, how many credit cards you use, and your answer to our short question.
• Your light or dark theme choice, and a one-way hashed version of your IP address that we use only to prevent spam and abuse.
• If you check your status, a one-time code we email you. We store it only in hashed form, and it expires after 10 minutes.

When you use the app

• Account details: your email address and name, if you provide it. You sign in with an email link or Google, handled by our authentication provider.
• Your wallet: the cards you add (for example, “Amex Gold”), points or rewards balances, card perks, loyalty programs, your goals, and the monthly spending estimates you give us by category.
• Ask Wizz: your questions, the answers, and the notes Ask Wizz keeps to remember your preferences, so you can see past conversations. See “Ask Wizz and AI” below.
• Notifications: a push notification token, if you allow notifications.
• Usage and device information: which features you use, app version, device model, operating system, and crash and performance data.
• Feedback and bug reports: what you write, and any screenshots you attach. We store these so we can fix the problem.
• Purchases: if you subscribe to TapWizz Plus, your subscription status. Apple handles payment; we never see your payment card.

Bank connections (optional)

You can link a credit card account through Plaid so TapWizz can check your purchases against the best card and track the points you earned. When you link:

• You sign in with your bank inside Plaid’s screen. We never see or store your bank username or password.
• Access is read-only. TapWizz cannot move money or make payments.
• For each transaction on the linked cards we store the amount, merchant name, date, category, and whether it’s still pending. We also store the account name and its last four digits so you can match it to a card in your wallet.
• For each linked card we may also store its current balance and credit limit, and from its latest statement: the statement balance and date, the payment due date, the minimum payment, your last payment, the APR and any interest charged. We use these to show your card health, your statement and payment reminders. Only you can see them, even in a family group.
• Plaid gives us an access token for your bank link. We encrypt it before storing it.
• You can disconnect at any time in the app. We then tell Plaid to remove the link and delete the accounts and transactions we got from it.

Plaid’s own handling of your data is covered by Plaid’s End User Privacy Policy.

Apple Card (optional)

If you allow it, TapWizz reads Apple Card transactions on your iPhone through Apple’s FinanceKit and stores the same transaction details listed above (amount, merchant, date, category). You can turn this off at any time.

Loyalty balances (optional)

If you connect AwardWallet, we receive your loyalty program balances from AwardWallet and store them in your wallet. We store the AwardWallet connection reference in encrypted form, and you can disconnect at any time.

Location (optional)

• Here (while using the app): we use your location when the app is open to find the store you’re at.
• Background store alerts (“Always” permission, turned on in Settings): your iPhone watches small areas around nearby stores (geofences). This happens on your device; your position is not sent to us when you arrive at a store. The app then shows an alert with the best card. We keep a record of alerts we’ve sent (the store and the time) so we don’t repeat them.
• Finding the store you’re at: when you open Here or a store alert checks where you are, the app sends your current position to our server to look up the nearest store. We use it for that lookup only and don’t store it.
• Loading nearby stores: to fill in the stores around you, the app sends an area rounded to about 1 km. We look up stores in that area from OpenStreetMap.
• If you report a missing store, we store the name, category and location you submit.

Camera, photos and microphone (optional)

• Photos in Ask Wizz: if you attach a photo (for example, a receipt or a store sign), it is sent to our AI provider to answer your question. We don’t store or log the photo.
• Bug report screenshots: stored with your report, and deleted when you delete your account.
• Voice input: speech is turned into text on your iPhone where your device supports it; otherwise Apple’s speech service may process it. Only the resulting text is used as your question.

TapWizz browser extension (Chrome, and Safari on iPhone)

The extension shows which of your own cards earns the most on the store you’re on, and card credits you can use there. It is optional and only works after you sign in to TapWizz in it.

• What it sends us: the domain of the store you’re on (for example, uber.com), and, if you’re in a family or business group and pick who is using the computer, which group member you picked. Nothing else about the page.
• What it never reads: page content, your cart, prices, form fields, what you type, or your browsing history. It decides whether you’re at a checkout from the web address only.
• Where it runs: when you click its icon, on the site you’re on. The automatic card at checkout and the credit badge run only on the stores you allow in the extension (Chrome asks you first), and you can turn them off for a site or for all sites.
• Sign-in: the extension gets its own read-only TapWizz sign-in token. It can read your wallet (cards, earn rates, credits) to pick a card, but it cannot change anything in your account. In Chrome the token is kept in the extension’s storage on your computer; on iPhone it is kept in your iPhone’s keychain, shared only with the TapWizz app. Signing out in the extension, or removing it, deletes the token from your device.
• Family and business groups: the extension can show cards that other group members share with you, under the same rules as the app (see section 4). Each such view is logged.
• Limited use: we use what the extension sends only to show you the best card and credits. We don’t sell it, transfer it, use it for advertising, or use it for credit decisions, and the extension’s use of this data follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

What we don’t collect

We do not collect full credit or debit card numbers, security codes, expiration dates, PINs, or your bank or card usernames and passwords.

3. Ask Wizz and AI

• Ask Wizz answers most questions on your iPhone, using built-in rules and Apple’s on-device model where available. These questions are not sent to an AI provider.
• Some questions need a bigger model. The first time, we ask your permission. If you allow cloud answers, we send your question (and any photo you attach) through our servers to Anthropic’s Claude, together with a summary of your wallet: card names, earn rates, balances, goals and spending totals. Never card numbers or bank logins.
• You can turn cloud answers off at any time in Settings → What AI knows.
• We keep your Ask Wizz conversations in your account so you can see them. They are deleted when you delete your account.

4. Family and Business spaces (coming soon)

We are building optional shared spaces. They are not available yet. This section describes how they will work if you choose to join one.

Family spaces

• Each member chooses what to share with the family: cards and points, purchases, bank connection status, and goals. Nothing is shared unless you choose it.
• You can change what you share or leave the space at any time.
• Family admins can only view what you share. They can’t change your cards or accounts.
• Sharing cards and points shares your card names, balances and points, card earn rates, perks and which credits you used, welcome-bonus progress and card value.
• If you share your cards, other members who also share their cards can see yours, and you can see theirs. Members aged 13 to 17 and business employees don’t see other members’ cards, even when they share.
• Every time someone views your shared data, it is logged, and you can see that log.
• Members aged 13 to 17 can join with view-only access. Children under 13 can’t join.

Business spaces

• Company cards connected by a business are visible to that business’s admins, approvers and auditors, including transactions, points and fees.
• Employees can see the points on their own company cards.
• Personal cards stay private. A personal purchase is shared with the business only if you mark it as a work purchase.
• Receipts are kept as long as the business needs them for its records, up to 7 years.
• For company card data, your employer decides how it is used (it is the “controller”), and we handle it on the employer’s behalf. Questions about that data should go to your employer first.

5. How we use your information

• To recommend which of your cards earns the most for a purchase, check past purchases, and send the alerts you turn on.
• To answer your Ask Wizz questions.
• To run the waitlist and the service: sign-in links, invites, reminders, status codes and service emails.
• To keep the service secure, prevent spam and abuse, and fix bugs.
• To understand how TapWizz is used, so we can improve it.
• To comply with the law and enforce our Terms.

We do not use your information to make credit decisions, we do not sell or rent it, and we do not share it for cross-context behavioral (targeted) advertising.

6. Who we share it with

We share information only with service providers that help us run TapWizz. They may use it only to provide their service to us:

• Supabase: database, file storage and account sign-in.
• Plaid: bank connections you choose to make.
• AwardWallet: loyalty balance sync, if you connect it.
• Anthropic: cloud answers in Ask Wizz, only if you allow them.
• PostHog: product analytics for the app and visitor analytics for tapwizz.com. We don’t send it merchant names, amounts, account numbers or your email.
• Sentry: crash and error reports. We strip emails, tokens, card-like numbers, bank ids and amounts before a report is sent.
• RevenueCat and Apple: TapWizz Plus subscriptions.
• Resend: email delivery.
• Expo: building and updating the app, and delivering push notifications.
• Vercel: hosting for tapwizz.com.
• Apple: the App Store, TestFlight, push notifications, FinanceKit and on-device services. Apple’s use of data is covered by Apple’s privacy policy.

We may also share information if the law requires it, to protect the rights and safety of our users or others, as part of a merger, acquisition or sale of assets (you’ll be notified), or with your consent.

7. Card offers and commissions

TapWizz may show offers for cards you don’t have yet. If you apply through one of these links, we may earn a commission from the issuer. Commissions never change which card in your wallet we recommend for a purchase.

8. How long we keep it

• Account, wallet and Ask Wizz data: for as long as your account is open.
• Bank and Apple Card transactions: until you disconnect that account or delete your TapWizz account.
• When you delete your account in the app, we remove your bank links at Plaid and delete your data, including bug report screenshots and waitlist entries, except where the law requires us to keep something. We keep only an anonymized record that an account was deleted. Backups are overwritten within 30 days.
• Waitlist data: until 12 months after TapWizz’s public launch, or sooner if you ask us to delete it.
• Status codes and anti-spam records: a short time only. Codes expire after 10 minutes.
• Business space receipts (coming soon): as long as the business needs them, up to 7 years.

9. How we protect it

Data is encrypted in transit (HTTPS/TLS) and at rest by our providers. We also encrypt bank access tokens ourselves before storing them. Our database uses row-level security, so each app user can access only their own records. No system is perfectly secure, but we work to protect your information and will notify you if a breach affects you, as the law requires.

10. Your choices and rights

• Download your data: in the app, Settings → Download my data. For anything not included there, such as bank transactions, email contact@tapwizz.com.
• Delete your account: in the app, Settings → Delete account, or email contact@tapwizz.com from the address on your account.
• Correct your data: edit it in the app, or email us.
• Bank links, Apple Card, AwardWallet and cloud answers: turn them off or disconnect at any time in the app.
• Location, camera, photos, microphone and notifications: turn them off at any time in iOS Settings → TapWizz.
• Emails: service emails come with your account. To stop waitlist reminders, reply to any of them or email us.

California and other US state residents: depending on where you live, you may have the right to know what personal information we collect and how we use it, and to access, correct, delete or get a copy of it. You may also have the right to opt out of its sale or sharing for targeted advertising (we do neither) and to limit our use of sensitive information such as precise location and financial account data (we use it only to provide the features you turn on). We won’t treat you differently for using these rights. To make a request, email contact@tapwizz.com. We’ll verify your identity and reply within 45 days. You can also use an authorized agent.

11. Children

A TapWizz account is for adults 18 and over. When Family spaces launch, teens aged 13 to 17 will be able to join a family space with view-only access. TapWizz is not for children under 13, and we don’t knowingly collect information from them. If you believe a child has given us information, contact us and we’ll delete it.

12. Where we operate

TapWizz is offered only in the United States and supports US-issued cards. Your information is stored and processed in the United States.

13. Changes to this policy

We’ll update the date at the top when this policy changes. If a change is significant, we’ll let you know by email or in the app before it takes effect.

14. Contact

TapWizz LLC · King County, Washington, USA · Email contact@tapwizz.com