Privacy at PointUp

Your account and sign-in

Clerk provides PointUp authentication and account management. PointUp associates your portfolio with your Clerk account identifier. Clerk handles your sign-in credentials, account profile, connected identity and sessions. An enabled notification can use your account email address to deliver a message.

Clerk provides sign-in, and you may use Sign in with Apple, Google or email. Which options appear depends on how PointUp is configured. Sign-in uses the identity, email address and basic profile (your name and profile picture) that the method you choose provides. These are used to authenticate you and display your account.

If you use Sign in with Apple, Apple may provide a private relay email address instead of your real one. Notifications sent to that address are forwarded by Apple. If you use Google, the connection does not request access to Gmail messages, Google Drive files or Google Calendar events, and the PointUp application does not retrieve Google access or refresh tokens for those services.

You can manage your connected sign-in methods in the PointUp account portal. You can also revoke access in your Apple Account or your Google Account connections. Revoking a connection does not erase portfolio information already stored in PointUp.

Your loyalty portfolio

PointUp stores information you enter or authorize it to record. This can include loyalty-program membership numbers, balances and balance history, expiry details, notes and tags, trip goals, preferences, watches and activity records. PointUp uses this information to organize your portfolio, calculate estimates and show progress toward your goals.

A program appearing in the catalog does not mean PointUp can sign in to that provider or automatically synchronize it. Capture and sync availability depend on the program and the integrations you choose to use. Do not put a loyalty-provider password into account notes or assistant messages.

Browser capture and local storage

When you use the PointUp extension on a supported provider page, it reads visible page text locally to identify a balance. Its capture flow sends a structured observation, including the provider, balance and source-page origin and path. It removes URL queries and fragments and does not send the full page text. The retained path may still contain identifying information.

Capture is subject to your token permissions and provider consent. Some authorized observations can be accepted directly; others need review. Revoking consent prevents future ingestion under that grant but does not erase previously recorded observations.

The extension keeps its PointUp API address and capture state in persistent browser local storage. Its bearer token is kept in extension session storage, bound to the saved PointUp API address, and must be entered again after a browser restart. When loading settings saved by an earlier version, the extension moves a legacy token into session storage when needed and removes the persistent token copy.

Assistant conversation and pending-request state use browser session storage. Clearing an extension conversation removes that local conversation state; it does not remove server records or revoke the token. Revoke the token in PointUp and remove the extension's local data when retiring a browser profile.

Assistant requests

PointUp processes your question and supplied conversation history with relevant information from your authorized portfolio. The initial AWS launch uses the application's rule-based assistant; remote model processing is not enabled in this release configuration. If a remote model service is introduced, PointUp will identify the service and explain the information sent to it before introducing that use.

The assistant can propose supported changes for your review. Proposed actions and their review status can be stored separately from a conversation. You approve a proposed change before it is applied. This assistant flow does not book travel or transfer points at a loyalty provider.

Connecting PointUp to ChatGPT

When the PointUp plugin is available and you connect it in ChatGPT, Clerk handles authorization. ChatGPT sends an access token with tool requests to PointUp. PointUp verifies that token with Clerk and checks the permissions you allowed in Connections. PointUp stores your connection status and allowed permissions, associated with your account.

Information returned by an authorized tool is shared with ChatGPT to answer your request. Depending on the tool and permissions, this can include portfolio accounts, membership details, balances, expiry dates, goals, activity and captured readings. Requested changes are saved to your PointUp account. Your use of ChatGPT is also subject to OpenAI's policies and your ChatGPT settings.

Captured-reading records can retain the connection identifier, authorization version and token identifier used for the request. These identifiers record which authorization was used; they are not the access token itself. Enabling the plugin does not grant provider capture consent or approve readings held for review.

You can disable ChatGPT access in Connections. Disabling blocks subsequent requests but does not undo completed changes or delete stored portfolio and observation history. Disconnecting does not remove information already returned to ChatGPT; manage that information through ChatGPT's own controls.

Sharing and notifications

If you create a portfolio share link, anyone with that link can view its summary without signing in. The summary includes program names, balances, estimated values, totals, account count and the share label. It excludes membership numbers and account identifiers from the public response. A link may have no expiry. You can revoke it, but revocation cannot remove copies someone already made.

When a notification channel is enabled and you choose to use it, PointUp processes the destination and message content needed for delivery. Your notification settings control supported delivery preferences. Optional email and chat delivery services are not configured for the initial launch.

Services, cookies and operational records

PointUp uses Clerk for authentication, Supabase PostgreSQL for application records, and AWS for application hosting and Secrets Manager. The selected AWS application and Supabase database region is Northern Virginia, United States. Authentication and other service-provider processing may take place in other locations under their service arrangements.

Authentication uses cookies and session information. PointUp also uses the browser storage described above and records operational logs, metrics and error information to run the service, investigate failures and protect accounts. Authentication and hosting services may process connection information, such as device details and network addresses. Application redaction controls reduce sensitive information in logs; they do not remove every personal identifier from all service records.

With your permission, PointUp uses Google Analytics to measure page visits with cookies. It stays off until you choose Allow analytics. We report route templates instead of account IDs or share tokens, omit search text and URL fragments, and do not send portfolio balances, membership numbers or account identifiers. Advertising features are disabled. Google still receives connection information needed to process requests. Use Cookie settings on any page to reject or withdraw analytics; withdrawal stops future collection and removes PointUp analytics cookies, but does not erase events already received by Google. Your choice and analytics cookies expire after 180 days.

Information needed to deliver a service is processed by that service provider. Providers also have their own records and contractual retention arrangements. More information is available from Clerk, Supabase, AWS and Google. For requests about information handled for your PointUp account, contact PointUp.

Your controls and privacy requests

You can update supported portfolio information, manage provider consent, revoke PointUp access tokens, revoke share links and export the supported portfolio data. The portfolio export includes active accounts and a bounded balance history; it is not an export of every personal record. Unlinking a loyalty account archives it through soft deletion and retains its history.

For a broader access, correction, export or deletion request, email jordan@quarg.io. Requests are handled manually. Please identify your PointUp account and the request without sending passwords, API tokens or full loyalty credentials. We may ask for additional verification before releasing or changing account information.

To delete your whole account, use the deletion control described below. A request may also involve authentication records, operational logs or retained copies, so the response to an emailed request will explain its scope and any information that remains.

Deleting your account

You can delete your account at any time. In the iOS app, open Account and choose Delete account. On the web, open Account in the dashboard and choose Delete account. You can also email jordan@quarg.io from the address on your account.

Deletion is permanent. PointUp erases your linked programs and membership numbers, balance history, goals, valuations, watches, share links, access tokens, agent consents, capture and agent observations, assistant proposals, registered devices, notification settings and activity records, including the audit records tied to your account. Your Clerk sign-in profile is then deleted. If you signed in with Apple, PointUp also asks Apple to revoke the token issued for PointUp, which removes PointUp from the apps using your Apple Account.

Transfer-bonus listings you reported stay available to everyone without your name attached. Backups and operational logs expire on their own schedules and are not restored into the service. If your sign-in profile cannot be deleted immediately, your PointUp data is still erased and we complete the sign-in removal manually.

Retention and changes

Portfolio and observation history can remain after unlinking a membership or revoking consent. Cleanup controls for selected events, activity and expired tokens are separate from portfolio deletion. There is no single retention period covering every record. Backups, security and operational records, and authentication-provider records have separate lifecycles; a deletion request does not promise immediate removal from every retained copy.

This notice covers the renovated application. Retained information from the earlier PointUp site and its recovery snapshot has not been imported into the new portfolio database. A request concerning that earlier site should identify it so it can be reviewed separately.

PointUp will update this notice when its information practices change. The date above identifies the current version. Questions about this notice or a proposed new use can be sent to jordan@quarg.io.