Privacy Policy

We collect only the information you choose to provide to use our services.

• • Email address (for reports, requests, and account communication)
• • Card and usage information you input into the calculator
• • Statement text you choose to scan (see section 3 — read in your browser; a bank our rules can’t read yet goes to a document-reading service we use)

We are intentionally privacy-first. We do not collect or access:

Statement Scan is an optional feature, on every plan. Here is exactly what happens, step by step:

• • We read your statement in your browser, by rules. The PDF you select is read and parsed on your device. We never store the file.
• • No AI reads your statement. Since October 7, 2026 your browser reads the statement with fixed rules for the issuer’s layout. Except as described in the next point, the full statement text, and any description of your wallet, is never sent to our server or to any third party to be read. Only the items listed below are saved.
• • If we can’t read your bank yet, a service provider reads it. Who receives it: a document-reading service we use. What it receives: that one PDF, sent automatically when our rules can’t read it, without your file name. Why: only to read the statement’s transactions and send them back to us. How: by rules, not AI — before every send we check that the service’s AI reading is off, and we don’t send if it is on. How long: the service is set to delete the file after one day; it keeps a record of what it read. On our side we keep the same benefit facts as for any scan, and each credit it finds waits for your OK before it counts.
• • What we save when you scan, for the card the statement belongs to: a scan record (file name, a fingerprint of the file so a rescan is recognised, the statement period and counts), and what the statement says about that card’s benefits — credits that posted, the annual fee, the issuer's notices, fees and interest year to date, your points balance, and purchases only at merchants your credits cover. Every other purchase, your account number and the cardholder names on the statement are dropped on your device before anything is saved.
• • Your issuer’s benefit notices are also shared with our team — the issuer’s printed wording only, with no name, account or card number attached — so we can check the card’s page against the issuer.
• • What we save as credits used: each credit line the issuer printed that clearly matches one of your card’s benefits by name (date, the issuer’s description, amount), and your card’s annual fee and its date. These are saved as soon as you scan, with an Undo. A credit we can’t place on a benefit is saved only if you choose it.
• • How to delete it. On the card’s page, under Use Credits, “Delete statement data for this card” removes the statement data listed above. The scan record and the credits saved as used stay; deleting your account removes everything.
• • A scan record is kept even when a scan finds nothing new, so a rescan of the same statement is recognised and not counted twice.
• • If a credit’s amount differs from our catalog, that credit line (date, the issuer’s description, amount) is shown to our team so we can correct the catalog.
• • We do not store the file or the full statement text on your account.
• • Only what the statement proves is saved for you. A credit counts toward your verdict when the issuer printed it and it matches one benefit; anything else waits for you.

If you would rather no statement leave your device, skip Statement Scan for a bank we don’t read yet, and enter credits by hand. The rest of WorthTheFee works the same way.

Saved reports and calculations are stored securely so you can access them across devices. You’re in control — you can delete any report at any time.

We use essential cookies to keep you signed in and the site running. We also use analytics and advertising measurement to understand how people find and use the site.

• • Essential: session and authentication cookies (cannot be disabled)
• • Product analytics: page views and feature usage, tied to your account when signed in
• • Google Analytics and Google Ads conversion tracking: used to measure which ads bring people to the site. These set Google cookies.

What Google gets. The pages you visit, and three moments: that you signed up, that you saved a card, and which card you checked with its verdict. Never your card numbers, your statements, your email address or your account. We turn off Google’s ad personalization for this tag — it counts our ads; it does not target you.

To opt out, use Google’s Analytics opt-out and Google’s ad settings. Browser tracking protection and ad blockers also stop these tags.

We do not sell your data. We share only what a provider needs to do its job. These are the third parties that can process your data:

• • Lovable Cloud (Supabase) — hosting, database, and authentication. Processes your account, cards, and saved reports.
• • Lovable AI Gateway (routes to OpenAI) — no longer receives statement text: since October 7, 2026 statements are read on your device.
• • A document-reading service — receives a statement PDF only when our rules can’t read that bank yet, reads it by rules (not AI) to return its transactions, and is set to delete the file after one day. See section 3.
• • Stripe — payment processing for the Unlimited plan. Stripe handles your card details directly; we never see or store them.
• • Our email delivery provider — sends account, reminder, and report emails. Processes your email address and message content.
• • Google (Analytics and Ads) — measures which ads bring people to the site, as described in Cookies & Analytics.

We may also disclose information if required by law. If this list changes, we will update this page.

Data is encrypted in transit and at rest, and access is restricted by row-level authorization so one account cannot read another’s data. We never ask for or store bank credentials or full card numbers.

We do not retain uploaded statement files or the full extracted statement text. We keep scan metadata and the credit matches saved from it for as long as your account is active, and you can delete them at any time. Account data is kept only as long as needed to provide the service. When you delete your account from Settings, your account data is removed.

You can update your email preferences, unsubscribe from non-essential email, delete individual cards and reports, and delete your account from Settings. For any other privacy request, email privacy@worththefee.com and we’ll handle it.

WorthTheFee is not intended for children under 13, and we do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We'll post the updated version on this page and update the "Last updated" date.

Questions about this policy or your data? We're here to help.
Email us at legal@worththefee.com