m.Mostly Points

Scope and contact

This policy covers Mostly Points at mostlypoints.com, the account tracker at account.mostlypoints.com, the Mostly Points iPhone app, and Mostly Weekly. Mostly Points is operated by Jacob Wilhite. For privacy questions or requests, email info@mostlypoints.com or use our contact page.

Accounts and information you add

When you create or use an account, we process your name, email address, account identifier, authentication information, and profile preferences. We save the information you choose to enter in the tracker, including household names and membership, cards and cardholders, opening and annual-fee dates, rewards programs and balances, valuations, credit usage, custom entries, renewal decisions, and notification preferences. Account data is stored on our service so it can sync between the website and app. The tracker also uses browser or app storage to keep your session and working account data.

Households and separate logins

If you accept a household invitation, your login becomes associated with that household. Its owner and other authorized members can access the shared wallet and tracker information and make changes permitted by the service. Household access records identify the member and login; your password is not shared with other members. Review the household you are joining before accepting an invitation. Removing a login’s access does not by itself erase entries already saved in the shared household. Contact us if you need help separating or deleting household information.

Connected financial accounts and Plaid

Connecting a bank is optional. We use Plaid Inc. to establish the connection you authorize. Mostly Points receives and stores connected-account identifiers, institution and account information, balances where available, and transactions used to match supported statement credits and annual fees. Transaction records can include amounts, dates, merchants, descriptions, categories, and merchant-location information supplied with a transaction. A linked account may continue to sync until disconnected.

Bank authorization currently opens in Safari from the iPhone app. Your bank or Plaid handles bank sign-in and any verification steps. Mostly Points does not receive or store your bank-login password; it stores connection credentials used to retrieve authorized data. Plaid processes connection, device, and usage information under its End User Privacy Policy. Review the disclosures presented during bank connection. Connected financial data is used to operate the tracker and is not sold or used by Mostly Points to make lending decisions.

Subscriptions and payments

Apple processes purchases made through the iPhone app. We receive subscription and transaction information, including product and transaction identifiers, purchase and expiration dates, renewal or cancellation status, and verification results. We associate these records with your Mostly Points account to provide Premium, restore purchases, and maintain billing and referral records. We do not receive your Apple Account password or full payment-card number from Apple.

Website subscriptions are processed through Stripe. We store customer and subscription identifiers, plan, payment status, and related billing or referral records. Stripe handles the payment information you enter in its checkout. Apple and Stripe process payment information under their own privacy policies. Deleting your Mostly Points account does not automatically cancel a subscription: manage Apple subscriptions through Apple and website subscriptions through the website billing controls or contact us for help.

iPhone notifications and device security

If you enable iPhone push notifications, we collect an Apple push token and a related device-registration identifier, associate them with your account, and save notification preferences and delivery records. We use these to send account activity alerts, such as matched credits and annual-fee reminders, when available. You can turn delivery off in App settings or iPhone Settings. Notification content may appear on your lock screen according to your iPhone settings.

Optional Face ID, Touch ID, and passcode checks use Apple’s device authentication. Mostly Points receives a success or failure result and does not receive your facial image, fingerprint, or device passcode. If you choose to save your login on the iPhone, the app stores it in the device Keychain. You can remove that saved login through App settings.

Support, activity records, and service analytics

When you send feedback or request help, we store your message, request type, account identifier, email address, and relevant timestamps so we can respond. Please avoid including bank passwords or full payment-card numbers in support messages.

We keep account creation and save timestamps, setup completion, referral activity, subscription status, and related service records. The owner’s reports use account identifiers, names, email addresses, card counts, plan and payment records, and activity timestamps to understand setup completion, active accounts, and subscription or referral performance. These reports help operate and improve Mostly Points.

Hosting, authentication, financial-connection, and email providers may process IP addresses, browser and device information, request timestamps, errors, and security or diagnostic logs to operate, secure, and troubleshoot their services. The iPhone app’s saved device registration supports notifications; it is not an advertising identifier.

Public website analytics and external links

The public website uses Google Analytics to measure visits, approximate location, pages and interactions, and content or referral-link performance. Its tags use cookies and similar browser identifiers. The account tracker does not currently embed the public website’s Google Analytics tag. Learn how Google uses information from sites that use its services, or see the Google Analytics opt-out browser add-on.

When you open issuer, travel, affiliate, or referral links, those services may use their own cookies or identifiers for attribution. Their privacy policies apply to their services. Mostly Points does not send your saved wallet, bank transactions, or push token to advertising networks to target ads.

Mostly Weekly and referrals

If you subscribe to Mostly Weekly, Beehiiv processes your email address and newsletter subscription information to deliver the newsletter. You can unsubscribe through a link in each newsletter. Creating a tracker account is separate from choosing to receive the newsletter.

If you use the app’s referral program, we save referral codes, attribution, signup and qualifying payment status, and reward records. Referrers see progress and counts through the program; their dashboard does not provide referred users’ names or email addresses. Authorized service administration may access those records to operate the program and address fraud or disputes.

Why we use and share information

Providers include managed application hosting and Cloudflare infrastructure, Supabase for authentication and connected-account storage, Plaid for financial connections, Apple for in-app purchases and push delivery, Stripe for website payments, Resend for service email, Beehiiv for newsletters, and Google Analytics for public-website analytics. They receive information necessary for the services they provide and may have independent obligations described in their policies. We may also disclose information when legally required, to protect the service and its users, or in connection with a business transfer.

Mostly Points does not sell personal information for money. We do not combine app account data with unrelated third-party data for targeted advertising. Public-site affiliate and analytics services have their own practices; certain laws may treat some advertising or attribution activity as sharing.

Your choices and privacy requests

You can edit tracker information in the app or website, manage household login access in Account settings, disconnect financial connections through Bank connections, change activity preferences, and turn off push delivery through the app or iPhone Settings. For access, correction, export, or deletion requests, use our privacy contact form or email info@mostlypoints.com from the address associated with your account. We may verify ownership before acting. Specify whether your request concerns your login, shared household information, connected banks, or newsletter subscription. Rights vary by location and applicable exceptions.

Data retention and deletion

Our retention schedule provides for account and tracker data to be retained while the account is active and deleted within 30 days after a verified deletion request. Connection credentials and connected-account records are retained while needed for an authorized connection; access is revoked and stored connected-account data is deleted within 30 days after a verified deletion or disconnection request. Transaction data is retained while the connection and account remain active and deleted within 30 days after a verified account-deletion request.

Security, diagnostic, and backup records may remain for up to 90 days where needed for security, reliability, fraud prevention, or legal obligations. Subscription, payment, and reward records may be retained as required for accounting, legal obligations, disputes, or fraud prevention. Newsletter records are retained until you unsubscribe or request deletion, subject to limited suppression records needed to honor an unsubscribe. Providers may retain records under their own legal obligations. Household requests require care to protect information belonging to other members.

Security and international processing

We use encrypted connections, managed infrastructure, and access controls. Optional additional verification protects sensitive connected-account actions. No online service can guarantee absolute security. Mostly Points and its providers may process information in the United States and other countries where they operate.

Children

Mostly Points is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided personal information so we can investigate and address it.

Changes

We update this policy when the service or its information practices change. The date above identifies the current version.