BygPoints ("we," "us," "our") is operated as a sole proprietorship based in Ontario, Canada. This policy explains what we collect, why, who processes it, and the choices and rights you have. Questions or requests: [email protected].
us-east-1) — processed outside Canada. You can export or delete your data anytime.Two products operated by the same person: BygPoints (credit-card rewards planning) and BygTab (a companion household expense & tax tracker). Where a section applies to only one, we say so.
| Data | Where | Notes |
|---|---|---|
| Account email + password | Both | Password is stored only as a secure hash by our auth provider — we never see it. |
| Cards you add (product, issuer, dates, bonus progress, notes) | BygPoints | Card metadata only — never the card number, CVV, or expiry. |
| Points balances, region, planned applications | BygPoints | |
| Household + member display names, invite codes | Both | Display names are whatever you type — need not be legal names. |
| Expenses, receipts, statements you log/upload | BygTab | Stored privately, scoped to your household. |
| Income & tax entries | BygTab | For your own bookkeeping. |
| Email, optional first name, which playbook(s) you asked for, and whether you joined the newsletter (with the time and wording of that choice) | Website (/playbooks) | Needed to give you the free Points Playbooks; no account required. A salted one-way hash of your IP is kept only to stop automated sign-ups — the IP itself is not stored. |
Automatically: authentication/session data; web-push details only if you enable reminders; standard server/CDN logs (IP, timestamps) kept by our providers for security. We use no third-party ad or analytics trackers and do not sell your data.
Location: BygPoints' optional "best card near me" uses your location only when you tap it, sends approximate coordinates to Apple Maps to name the place (to OpenStreetMap instead if Apple can't answer, or where Apple Maps isn't available), and doesn't store it. On iPhone the Apple Maps search is made by iOS itself.
To provide and sync the service; calculate bonuses, deadlines and recommendations; send reminders you opt into; run AI features you choose to use; give you the free Points Playbooks and, only if you tick the separate newsletter box, send the Miles & Nights newsletter (every issue has an unsubscribe link); and keep the service secure. Our lawful bases (PIPEDA) are your consent and the necessity of providing a service you requested. You can withdraw consent by deleting the data or your account.
Optional features send data to Google's Gemini API: in BygPoints, the AI Lookup recommender, statement import, and the bonus-offer checker; in BygTab, receipt scanning, statement import, and the spending assistant/recap. We send the relevant content — e.g. the statement or receipt you upload, or a summary of your spending. For statement and receipt import we send the file itself (the PDF or image) to Gemini, because the model reads it directly; we do not extract the text on your device first. We do not keep the file — only the list of transactions the model returns is stored, and you can delete that in-app.
Honesty note These features currently run on Google's free Gemini API tier. Under Google's terms for that tier, Google may use submitted content to improve its products, and human reviewers may see some content. Please don't upload documents or type notes containing information you wouldn't want processed by Google (full account numbers or government IDs aren't needed by any feature). We're evaluating a paid tier / Google Cloud Vertex AI, whose terms don't permit that reuse, and will update this section and notify users if we switch.
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, auth, file storage, sync | United States (us-east-1) |
| Google (Gemini API) | AI features (Section 5) | May be outside Canada, incl. US |
| Cloudflare | Hosting & CDN | Global edge |
| Stripe | Payments for BygPoints+ — card details go straight to Stripe and never reach us | United States / global |
| Apple Maps (MapKit on iPhone, MapKit JS on the web) | Finds the shop nearest your approximate location (BygPoints, on tap only). Receives coordinates, never your identity or account. | Apple, United States / global |
| OpenStreetMap (Overpass API) | The backup for the same lookup when Apple Maps can't answer. Receives coordinates, never your identity. | Community-run, mainly EU |
| Web Push (Apple/Google/Mozilla) | Delivers reminders you opt into in the web app | Global |
| MailerLite | Sends the Miles & Nights newsletter, only to people who ticked the newsletter box on /playbooks. Receives your email and first name. | EU / United States |
| Expo push service | Relays reminders you opt into in the iOS/Android app. Sees your device's push token and the notification text (e.g. a card name and a due date). | United States |
Your data is stored and processed outside Canada (Supabase in the US; Google and Cloudflare globally). We share only what a feature needs, never for sale or advertising.
Encrypted in transit (HTTPS) and at rest; Row-Level Security so each account reads only its own data and household data stays within the household; receipts in a private bucket behind short-lived signed links; no bank credentials, card numbers, or credit data collected — BygPoints+ payments are handled entirely by Stripe, whose hosted checkout receives your card details directly, so they never pass through or rest on our systems. No system is perfectly secure — today's main limits are single-factor sign-in (use a strong, unique password) and that whoever controls your email can reset the account.
We keep your data until you remove it or close your account. You can export (BygPoints: More → Export data as JSON; BygTab: Setup → Export as CSV), delete individual items in-app, or delete your whole account yourself in-app at any time (BygPoints: More → Delete account). That removes your cards, settings, reminders, promo-code grants and household membership — your BygTab household, books and receipts too if you are its last member — and then the sign-in itself. It is immediate and cannot be undone. If you would rather we do it, email [email protected] from your account email and we will complete it within 30 days.
Playbook and newsletter sign-ups are kept until you unsubscribe or ask us to delete them ([email protected], within 30 days). They aren't linked to an app account, so deleting your account doesn't remove them — just ask.
Everyone: access, correct, or delete your information, and ask how we use it — [email protected], 30-day response.
Canada (PIPEDA): access, challenge accuracy, and withdraw consent; unresolved concerns can go to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
United States (incl. California/CPRA): we do not sell or "share" personal information for cross-context advertising; you may request to know, delete, or correct, and we won't discriminate for it.
Europe/UK (if applicable): bases are consent and performance of a requested service; rights of access, rectification, erasure, restriction, portability, and objection.
Neither product is directed to children. Don't create an account if you're under the age of majority in your province/state (or under 13 in any case). We don't knowingly collect children's data.
We'll update the date above and, for material changes (like the AI-tier change in Section 5), notify you in-app or by email.