1. Who we are
Perkival ("we", "us") provides a browser extension and the required account service that track credit-card benefits, credits, and signup bonuses. Operator and legal entity: Perkival Inc. Contact: admin@perkival.com.
2. The short version of the architecture
The extension captures your card benefits on your device, by reading the responses your own browser receives while you are signed in to your bank's website. We never receive, store, or transmit your bank credentials or session, and we never log in to your bank from our systems. This is an architectural property of the product, not just a policy statement — see the trust & security page for the full technical description.
3. What data we process, and why
| Data | Where it lives | Purpose |
|---|---|---|
| Your benefits wallet — cards you hold (product name, masked card number, account-owner label), credits and benefits (amounts, used/remaining, cycles, reset dates), usage history, loyalty point balances, your settings | Our servers, encrypted in transit (TLS) and at rest, isolated per user. Captured on your device, then sent to your account. | Showing your benefits dashboard, reminders, and exports. |
| Account identity — your sign-in email or Apple/Google identity | Our servers, encrypted in transit (TLS) and at rest, isolated per user. | Authenticating you and showing the same wallet on any device you sign in from. |
| Waitlist email (only if you submit it on this site) | Our servers. | Contacting you about beta access. Nothing else. |
| This website | — | perkival.com runs no analytics or third-party trackers, and we set no advertising or tracking cookies. The Perkival web app sets only first-party cookies that are strictly necessary for sign-in and security: bt_session keeps you signed in (up to 30 days); bt_oauth_csrf protects an Apple or Google sign-in (10 minutes); bt_pw_registration protects a password sign-up and bt_auth_recovery_vault protects an account recovery (15 minutes each); bt_browser is set when you connect the extension, not when you sign in, and lets sign-out also stop the extension in this browser (up to 400 days, renewed each time you open the app signed in). Our staff admin console uses its own bt_admin_session cookie. |
4. What we never collect
- Your bank or card-issuer username, password, or one-time codes.
- Your bank session cookies or tokens.
- Your full card numbers (only the last digits are parsed, to tell cards apart).
- Your bank transactions or statements.
5. Telemetry and diagnostics
Perkival always sends a value-free fingerprint when a supported issuer changes an account or benefit response shape. The report contains approved field paths, value types, a shape digest, and closed parser and endpoint labels. It contains no response values, account data, card data, names, identifiers, or payload samples. The diagnostics sharing setting does not control this safety report. The extension has an opt-in channel for usage counts that is off by default. You control it in Settings → Privacy (“Share anonymous diagnostics”). While it is off, the extension collects and sends no usage counts, and it keeps no usage counts on your device.
If you turn it on, the extension sends us anonymous, aggregate counts that help us catch card-issuer page changes early: how often a sync starts, succeeds, or fails (including signed-out syncs and per-card-issuer failures), how long syncs take, and a signal when an issuer page loads with nothing to read, and one-per-install counts of the setup milestones you reach (installed, first sync, first credit found, issuer connected, annual review opened). These carry no account data and no identifiers — no names, card numbers, balances, amounts, dates, or account tokens.
Error reports are always on while you are signed in. They are not optional. When a step in the extension fails while you are signed in, the extension sends a short error report to our service at app.perkival.com, so that we can find and repair the failure and keep your sync working. The diagnostics sharing setting does not control these reports. A report contains only: the name of the step that failed, a failure code from a fixed list, the build of the extension, masked references (at most the last four characters), how long the step took, and how often and when the failure occurred. A report contains no personal data, no credentials, no benefit values, and no card numbers, names, or account data. We do not store it with your account. It becomes eligible for provider deletion within 90 elapsed days after the provider accepts it. Provider processing can delay physical deletion. When you are signed out, the extension sends no error reports.
Extension action events are always on. We record when you open the extension, sign in or out, connect or disconnect an issuer, and when a sync starts, succeeds, partly succeeds, fails, is interrupted, or is cancelled. Each record contains the fixed action name, time, and extension version. Our service also receives the account tied to the signed-in connection, the network address, and browser information used to deliver the request. It contains no issuer credential, bank session, card data, balance, amount, or client identifier. We use these records to operate and improve the service. Access is limited to authorized operators. Delivery is best effort and capped, so records can be incomplete. We keep them for 180 days and then delete them.
You can turn the usage counts off at any time. When you do, we stop collecting them, and the extension discards the counts that it keeps on your device. The diagnostics endpoint is our own backend (the same service that hosts your account). It is a real, live production endpoint.
Web dashboard usage events are always collected. When you use the web dashboard while signed in, the dashboard sends us four kinds of event: the dashboard opened, the extension detected, your Perkival account ownership confirmed to the extension (succeeded or failed), and a dashboard control used (which control, succeeded or failed). Each event carries the time, the app version, a random event id, and a random visit id that groups the events of one visit. These events are linked to your account, because the dashboard sends them within your signed-in session. They carry no card numbers, balances, amounts, transactions, or issuer credentials. There is no switch for these events; they are part of running the service. The extension sends no such events.
6. Sharing
We do not sell personal data, we do not run advertising, and we do not share your data with data brokers. Your account data is processed by the infrastructure providers that host our service (e.g., database and server hosting) under data-processing agreements; they process it on our instructions only. We would disclose data if legally compelled to, and would tell you unless prohibited.
7. Retention
- Live account data. We keep live account data from its creation while your account exists. We delete the live server rows when the account-deletion transaction commits. A restore denies the subject until reconciliation succeeds.
- Deletion request. A confirmed deletion request stays active until the live account-deletion transaction commits. A failed attempt stays unavailable and retryable.
- Automated backup residue. Automated backup residue remains restore-eligible for at most 7 elapsed days from its Aurora continuous point-in-time recovery source instant. A restore rejects expired, overdue, unknown-lineage, or incompletely inventoried sources.
- Manual and final snapshot residue. Manual or final snapshot residue is deleted within 30 elapsed days from the start of its Aurora snapshot source capture. A restore rejects expired, overdue, unknown-lineage, or incompletely inventoried sources.
- Erasure record. A pseudonymous erasure record remains customer data. It expires within 31 elapsed days after a valid erasure request is accepted. A pending or committed record denies service until reconciliation succeeds.
- Waitlist email. From intake commit, we keep a waitlist email until onboarding or a verified removal commits, whichever happens first. Restore replays pending and committed erasure records before service opens.
- Identified security-audit data. We anonymize the target reference within 90 elapsed days of the immutable original record time. Restore preserves that time and runs the inclusive retention sweep before service opens.
- Anonymized security-audit row. We purge the anonymized row within 400 elapsed days of the immutable original record time. Restore runs the inclusive retention sweep before service opens.
- Operational logs. PII-free logs become eligible for provider deletion within 90 elapsed days after the provider accepts the event. Provider processing can delay physical deletion. Logs are not a customer-data backup or restore source.
- Exports. An export is a response stream that starts with an authenticated read. We do not create a durable server copy. A partial or failed read emits no response artifact. No durable export exists to restore.
- Device-local data. Your browser or operating system controls data from a shipped host-device write. Perkival server deletion and restore do not control it. Perkival does not ship a Settings control that clears all local data.
- Email delivery events. When our email provider reports a bounce, a spam complaint, a delivery, a reject, or a rendering failure, we keep that report for at most 90 elapsed days from the time we accept it. The record holds a one-way hash of the email address, not the address.
- Email suppression. If an email address rejects our mail permanently, or reports it as spam, we keep a one-way hash of that address so that we stop sending to it. We keep it until a verified operator clears it. Account deletion does not clear it, because we would otherwise send to the address again.
8. Your rights (access, export, deletion)
- Export: export to CSV or Excel (.xlsx) is a Plus feature; any user can request access to their data through the access request below.
- Deletion: after you confirm account deletion, we delete the live server rows tied to your account. Limited backup residue, security-audit records, and a pseudonymous erasure record follow the maximum periods in the Retention section. Data stored on your device is controlled separately by your browser or operating system.
- Access & correction: contact admin@perkival.com and we will respond within 30 days.
Depending on where you live (e.g., EEA/UK GDPR, California CPRA), you may have additional statutory rights; we honor deletion and access requests regardless of jurisdiction.
9. Security
Synced data is treated as sensitive financial information: TLS in transit, encryption at rest, per-user row isolation, least-privilege access, and identifiers masked out of logs and metrics. The deepest security control remains architectural: the most damaging secrets — your bank credentials — are never in our systems at all.
10. Children
Perkival is a financial tool for adults who hold credit cards. It is not directed at children, and we do not knowingly collect data from anyone under 18.
11. Changes to this policy
Material changes will be announced in the product and on this page with a new effective date, before they take effect.