Privacy
What we collect
Nothing that identifies you, unless you sign in. Signed out, nothing you enter is sent to us, apart from the anonymous card count you can choose to join after a Gmail scan, and there are no advertising trackers. If you sign in, we keep what is listed under "If you sign in", and nothing else.
Analytics
We count visits with Google Analytics. It loads when you open a page and sets first-party cookies (named _ga) and records the pages you read, the tools you use (such as finding a card, checking a card or following an Apply link), how you arrived, your rough location, device and browser. It never records what you spend or which cards you add to My cards. We use it to see which pages are useful and what is broken. Ad features are switched off and we sell nothing. Google keeps this data under its own policy: policies.google.com/privacy. To turn it off, use "Analytics choice" at the foot of any page and choose No; it stops loading from the next page. To remove cookies already set, clear this site's data in your browser.
Finding your cards in Gmail
My cards can find your cards from bank emails, if you ask it to and give Google your permission. Your browser searches for credit card emails from banks and reads only their sender, subject and preview line, not the full message or attachments. It works out the card names on your device. Those details, and your Gmail access, are never sent to us or stored. The access ends when the scan does. Only the cards you confirm are kept, in your browser with your other My cards entries. If you are signed in, they are also copied to your account, like the rest of My cards. Until you confirm, the page draws plain card faces and asks this site for nothing about the cards it found. Once a card is on My cards, the page loads its picture from this site, as it does for any card you add.
One thing is optional. After the scan you can tick a box to add your confirmed cards to our anonymous count. The box starts unticked. If you tick it, your browser adds 1 to a running total for each of those catalogue cards, kept in Google Firestore. No name, email address, last four digits, email content or ID goes with it, and we do not store your IP address with the total. A note in your browser stops the same card being counted twice. We use the totals only to improve this site, such as which cards to keep most up to date, and we look at them only as totals. We do not sell or share them, use them for advertising, or use them to judge credit. A total cannot be traced back to you, so it cannot be removed later. Our use of data from Google follows the Google API Services User Data Policy, including its Limited Use rules.
What stays in your browser
The main page keeps what you set up in My cards and in "Will I get it?" in your browser's local storage, so it is there next time: the cards you hold, the date each card's yearly fee is charged, your monthly spend, the rent, insurance, wallet loads and school fees you say go on a card, what you spend abroad and the lounge visits you would use, the months you save to your log, and what you give in "Will I get it?": your age, work, where you work, take-home pay, credit score band, the banks you have an account with, how long you have had a card or loan, how many you applied for in six months, how much of your card limits you use, whether you missed a payment in the last year, your fixed deposit answer and whether you live outside India. Each of these is optional. It also remembers the sort order you picked and your analytics choice. While you are signed out, none of it leaves your device. Clear your site data to remove it.
The search box reads your words in your browser. What you type is not sent to us.
The My cards page at /my-cards/ keeps the cards, spends and credit limits you enter in your browser's local storage, so they are there next time. They are not sent to us, and its share link carries them after the # in the same way. The card finder at /find/ works the same way. Its share link holds the boxes you filled in (age, income, score, spend and choices, never the words you typed) after the # in the address. Browsers do not send that part to us, to Firebase, to banks or to Google Analytics. Anyone you give the link to can read those details.
If you sign in
Signing in is your choice. Everything on the site works without it except "Will I get it?", which keeps your details in your account. You sign in with Google or with a link we email you; there are no passwords. We use what you save only to show you your dashboard on every device you sign in on and to send the emails you turn on. We do not sell it, use it for ads or send it to banks, and Google Analytics never receives it.
When you sign in, what your browser keeps for My cards and "Will I get it?" (listed above) is copied into your account, joined with anything already there, and kept the same on each device you sign in on. The account also holds the email address you signed in with, the email choices you turn on, which bank cuts you have already seen, and how much of your month goes on each card, which the fee emails use. Your sign-in is handled by Firebase Authentication and your record is kept in Cloud Firestore in Mumbai (asia-south1), so it stays in India; both are run by Google for us. The site's rules let only you, signed in, read or change your record; our daily email job reads it to send the emails you turn on.
Emails
Emails are off until you tick them in My cards: one when a bank cuts a card you hold, and one a month before a yearly fee whose date you have set. Untick them there to stop. They go out through an email delivery service, which receives your address and the text of the email to deliver it.
Deleting your account
Open your dashboard (top right of any page, or under Menu on a phone), go to Settings and choose "Delete my account and data". That deletes your record at once, for every device, and then your sign-in. If you can no longer sign in, write to hello@c4e.in from the address you used and we will delete it and tell you when it is done. Signing out only clears this device; your account keeps your record until you delete it.
Who else sees a request
Pages are served by Firebase Hosting, run by Google, which receives the standard details of each request (IP address, browser, page asked for) to deliver the page. Fonts load from Google Fonts, which receives the same details. When you open sign-in, or while you are signed in, the page also loads Firebase's code from www.gstatic.com, also run by Google. Google's privacy policy covers both: policies.google.com/privacy.
Links to banks and partners
Apply buttons and source links take you to the bank's own site, or to a partner network that passes you on to the bank. Those sites may set their own cookies, for example to record that you came from here. Their privacy policies apply once you leave. A partner link is labelled as one under the button.
Your rights, changes and contact
Under the Digital Personal Data Protection Act, 2023 you can ask what we hold about you, have it corrected or deleted, withdraw your consent at any time (deleting your account does that), and raise a complaint with us. Write to hello@c4e.in. If this policy changes, this page changes first, with a new date.