splurn · Version 2026-10-09 · Effective October 9, 2026 · Also at splurn-api.fly.dev/privacy
splurn tells you which of your credit cards to use and tracks the perks on them. This page says what we collect, why, how long we keep it, and how to delete it. splurn is run by Wonchan Kim ("we"). Questions: support@splurn.com.
Card numbers, security codes, bank usernames or passwords, and account or routing numbers. When you connect a bank, you sign in on Plaid's screen; splurn never sees those credentials.
| Data | Why | Where it lives |
|---|---|---|
| Which card products you hold, perk usage, preferences, saved stores | To rank your cards and track credits | On your phone. On our server only if you save your wallet. |
| Email address or Apple ID identifier | To sign you in and sync your wallet | Our server |
| Card transactions from Plaid (date, merchant, amount, category) | To mark credits as used and count bonus caps. Only if you connect an account. | Our server and your phone |
| Your location, while the app is open | To find the store you are in | Used on your phone only. Never sent to or stored by us. |
| Your consent to connect accounts, with the date and policy version | To show you agreed, and to let you withdraw | Our server |
| Premium subscription status | To unlock Premium | Apple handles payment; we see only whether you subscribe |
We use Plaid to connect your card accounts with read-only access to transactions. By connecting, you also agree to Plaid's End User Privacy Policy. We cannot move money. The key Plaid gives us for your connection is encrypted on our server and never stored on your phone.
We do not sell your data, share it with advertisers, or use it to track you across other apps or websites. We do not use it to decide credit. If splurn shows a card you could apply for, the order is never changed by any fee we may earn.
| Data | Kept for |
|---|---|
| Card transactions | 180 days, then deleted automatically |
| Sign-in sessions | 90 days, then you sign in again |
| Email sign-in codes | Deleted within a day |
| Your saved wallet and account | Until you delete your account |
Data travels over HTTPS only. Plaid connection keys are encrypted with AES-256-GCM, and our database sits on an encrypted volume. On your phone, transactions are stored in a file that iOS keeps encrypted while the phone is locked, and your sign-in token is in the Keychain. Connecting a bank needs Face ID or your passcode and a recent sign-in.
splurn.com is a static site. It sets no cookies, runs no analytics or advertising scripts, and keeps no record of your visit beyond the standard access logs of the host that serves it. Fonts are loaded from Google Fonts, which receives your IP address to serve the font files.
You can see, correct, export, or delete your data at any time. California residents have these rights under the CCPA, and we honor them for everyone. We do not knowingly serve anyone under 13.
When this policy changes we update the version and date above. If the change affects connected accounts, the app asks for your consent again before syncing.