The Short Version
- No accounts. You never give us your name or email to use the site.
- No advertising trackers, no cross-site tracking, and our code sets no cookies.
- We never sell or rent data about you — we barely hold any.
- Your calculator inputs are used to compute your ranking, not to profile you.
What We Collect
Aggregate analytics. We use Cloudflare Web Analytics, a cookieless measurement tool, to see page-level traffic: which pages are visited, roughly where from (country), and on what kind of browser. It does not use cookies, does not fingerprint you, and does not follow you to other sites.
Error reports. If the site breaks in your browser, it sends us a technical report: the error type and message, the page path, and your browser's user-agent string. Your IP address is used momentarily to rate-limit this endpoint and is not stored with the report.
Calculator inputs. The spending amounts you enter (groceries, travel, and so on) are sent to our ranking engine to compute NAV for your profile. They are processed per-request, are not linked to any identity, and are not stored in our database.
Server logs. Like effectively every site, our hosting infrastructure (Vercel, Cloudflare, Google Cloud) generates short-lived operational logs of requests — used for security and debugging, then rotated out.
During the Beta
While CardSpec is in private beta, access is gated by a login screen operated by Cloudflare Access. It processes the email address you sign in with to send a one-time code and confirm access. We don't use that email for anything else. When the site opens publicly, the login (and this processing) goes away.
What We Never Collect
We have no accounts, so we never hold your name, email (outside the beta login above), phone number, address, Social Security number, income, or credit information. Card applications happen entirely on the issuer's site — nothing you type into an application ever touches CardSpec.
Third Parties
The services that run CardSpec — Vercel (hosting), Cloudflare (DNS, analytics, beta login), Supabase (database), and Google Cloud (computation) — each process traffic as part of serving the site, under their own privacy terms. When you click through to a card issuer (including through an affiliate link, disclosed in our terms), you are on their site and their privacy policy applies. Affiliate partners may know the click came from CardSpec. They do not receive anything about you from us — we have nothing to send.
Retention
Error reports are kept while they're useful for fixing bugs. Aggregate analytics live in Cloudflare's dashboard per their retention. Operational logs rotate on their platforms' standard short schedules. None of it constitutes a profile of you.
Your Rights
Depending on where you live (GDPR, CCPA, and similar), you may have rights to access, correct, or delete personal data a service holds about you. Because we don't hold identified personal data, there is usually nothing to produce — but if you believe we hold something about you, contact us and we'll investigate and respond.
Children
CardSpec is about credit cards, which require you to be at least 18. The site is not directed at children, and we do not knowingly collect information from anyone under 18.
Changes
If what we collect ever changes, this page changes first, with a new effective date. We won't quietly broaden collection — the whole premise of this site is showing our work.
Contact
CardSpec is in beta. A contact address for privacy questions will be published as we exit beta. In the meantime, you can use the “Send feedback” link in the site footer.