Cardinate, credit card tracker and debt payoff planner

Privacy Policy

Last updated: September 28, 2026

Who we are

Cardinate is operated by Nasr Almansoob ("we", "us"), acting as the data controller for personal data processed through the service. Contact: support@cardinate.app.

What we collect

When you sign up, we collect your email address and (optionally) a display name. When you link credit cards, we receive card balances, transactions, and credit-card metadata (APR, statement balance, minimum payment, due date) from Plaid on your behalf. Cardinate tracks credit cards only. Checking, savings and loan accounts at the same bank are not saved.

How we use it

We use this data exclusively to power features you see in-app: categorising transactions, building payoff plans, and showing balance trends. We do not sell your data, do not share it with advertisers, and do not use it to train AI models.

How you found Cardinate

If you arrive from another website, or through a link with tracking tags (for example from an ad, a post or a newsletter), your browser keeps where you came from for up to 30 days: the website's domain (not the full address), the tags on the link (source, medium, campaign and content), and the page you first landed on. This happens whether or not you accept analytics. We only receive it when you sign in.

It is saved with your account only if the account was created within the last day and the visit came before you signed up. We use it to measure which channels bring people to Cardinate. It is not shared with advertisers.

Third-party processors

  • Plaid Inc.: bank connectivity. Plaid's privacy notice: plaid.com/legal.
  • Supabase / AWS: encrypted Postgres storage and authentication.
  • Stripe, Inc.: payment processing for Pro subscriptions. Stripe receives your email address and card details and handles billing, invoicing and tax calculation. We never see or store your full card number. See Stripe's privacy notice.
  • Amplitude, Inc.: product analytics, and session replay on a 10% sample of sessions to help us find bugs. Replay is recorded with full masking: text and form inputs are obscured, so balances, card names and amounts are not captured. Analytics only run after you accept in the cookie banner. See Amplitude's privacy notice.
  • DataFast: visitor analytics and revenue attribution, for every visitor, including if you decline the cookie banner. It receives the address of each page you view, the site that linked you, any ad click IDs in the link, your browser language, time zone and screen size, and your IP address, and sets cookies to recognise your browser (see below). It loads only after any sign-in tokens have been cleared from the address, so it never receives them. When you subscribe, it is told your Stripe checkout session so it can link the payment to the visit that led to it. See DataFast's privacy policy.
  • Cloudflare, Inc.: content delivery and protection for cardinate.app. Cloudflare processes your IP address and request metadata. See Cloudflare's privacy policy.
  • logo.dev: bank and merchant logos. Your browser requests each logo directly, so logo.dev receives your IP address and the name of the institution or merchant being displayed. It does not receive balances, transaction amounts or account details. See logo.dev's privacy policy.
  • Professional advisers and authorities: legal/accounting advisers, or authorities where required by law.

Cookies, analytics and session recording

Cardinate uses cookies and local storage that are necessary for the product to work: keeping you signed in, and remembering your theme and display preferences. These are always on, because without them the app cannot function. If you save promos from the 0% APR tracker before you have an account, they are kept in your browser until you sign up, then added to your account as cards.

DataFast, our visitor analytics, runs for every visitor whether or not you accept, and sets its own cookies: a visitor ID, the date of your first visit and a count of your visits, each kept for a year, and a session ID kept for 30 minutes. We use it to count visits, see which sites and campaigns send people to Cardinate, and link subscriptions to the visit that led to them.

Where you came from is also kept in local storage whether or not you accept analytics. See How you found Cardinate.

Separately, we use product analytics (Amplitude) to understand which features get used and where people get stuck, including session replay on a 10% sample of sessions to help us reproduce bugs. These only start after you accept in the banner shown on your first visit. If you decline, Amplitude records nothing and no product analytics events are sent.

Session replay is recorded with full masking. Text and form inputs are obscured before anything leaves your browser, so balances, account names, transaction amounts and anything you type are not captured. We see the shape of the page and where you clicked, not your financial data.

Data access

To operate, support, secure, and improve Cardinate, authorized personnel and our infrastructure providers (such as Supabase, AWS, Plaid, and Stripe) may access your data when necessary, for example, to provide support, investigate a technical issue, or comply with a legal obligation. We never access your data in order to sell or share it, and we limit access to what's needed for these purposes.

Data retention

  • We keep your data for as long as your account exists.
  • When you delete your account, your data is removed from our live database immediately.
  • Encrypted backups held by our hosting provider age out on their own rolling schedule. Individual records cannot be erased from a backup.
  • Billing records and referral credits are kept in anonymized form, with no link back to you, for tax and accounting.

Your rights

You can export your data, disconnect any bank, or delete your account entirely at any time from Settings → Danger Zone. Deletion immediately revokes Plaid access and removes your data from our live database. Email support@cardinate.app for any other request under GDPR / CCPA (access, rectification, erasure, restriction, portability, objection, withdraw consent, or complain to your supervisory authority).

Security

All traffic is TLS 1.2+. Cardinate never receives your bank login. Plaid handles the sign-in and gives us a read-only token, so we can see your balances but never move your money. Your data is encrypted at rest, and row-level security ensures one user can never read another's data. We support optional two-factor authentication (TOTP). Turn it on at Settings → Security.

Contact

Questions? support@cardinate.app