The Short Version
The whole policy comes down to four things, and the rest of the page is just the detail behind them.
- No accounts. You never give us your name or email to use the site.
- No advertising trackers, no cross-site tracking, and our code sets no cookies.
- We never sell or rent data about you, and we barely hold any.
- Your calculator inputs are used to compute your ranking, not to profile you.
What We Collect
There are four things, and none of them identify you. Here is each one and exactly what it holds.
For aggregate analytics we use Cloudflare Web Analytics, a cookieless measurement tool, to see page-level traffic: which pages are visited, roughly where from (country), and on what kind of browser. It does not use cookies, does not fingerprint you, and does not follow you to other sites.
If the site breaks in your browser, it sends us an error report: the error type and message, the page path, and your browser's user-agent string. Your IP address is used momentarily to rate-limit this endpoint and is not stored with the report.
The calculator inputs you enter (groceries, travel, and so on) are sent to our ranking engine to compute NAV for your profile. They are processed per-request, are not linked to any identity, and are not stored in our database.
Like effectively every site, our hosting infrastructure generates short-lived server logs of requests, used for security and debugging, then rotated out.
During the Beta
CardSpec is in open beta: anyone with the link can use it, with no login, no account, and no email required to browse. We don't gate access, so there is no sign-in step that would collect anything from you. If you choose to send feedback through the link in the footer, we only receive what you type there.
What We Never Collect
We have no accounts, so we never hold your name, email, phone number, address, Social Security number, income, or credit information. Card applications happen entirely on the issuer's site, so nothing you type into an application ever touches CardSpec.
Third Parties
The infrastructure providers that host and serve CardSpec each process traffic as part of serving the site, under their own privacy terms. When you click through to a card issuer, you are on their site and their privacy policy applies. If we ever add affiliate links (we have none today, see our terms), a partner may know the click came from CardSpec, but they still receive nothing about you from us, because we have nothing to send.
Retention
Error reports are kept while they're useful for fixing bugs. Aggregate analytics live in Cloudflare's dashboard per their retention. Operational logs rotate on their platforms' standard short schedules. None of it constitutes a profile of you.
Your Rights
Depending on where you live (GDPR, CCPA, and similar), you may have rights to access, correct, or delete personal data a service holds about you. Because we don't hold identified personal data, there is usually nothing to produce. But if you believe we hold something about you, contact us and we'll investigate and respond.
Children
CardSpec is about credit cards, which require you to be at least 18. The site is not directed at children, and we do not knowingly collect information from anyone under 18.
Changes
If what we collect ever changes, this page changes first, with a new effective date. We won't quietly broaden collection. The whole premise of this site is showing our work.
Contact
CardSpec is in beta. A contact address for privacy questions will be published as we exit beta. In the meantime, you can use the “Send feedback” link in the site footer.