Account information — Name, email address, and optional phone number. Stored encrypted.
Financial data — Card names, banks, reward preferences, and spending categories. All
financial data is encrypted client-side using AES-256 before being stored. Our servers never see your
plaintext financial data.
Usage data — Optimization queries, feature interactions, and anonymized analytics to improve
the service.
AI interaction data — Queries sent to our AI engine for card recommendations. No personally
identifiable information is included in AI prompts.
WhatsApp data — If you link your WhatsApp number, we store your phone number and message
history to provide card recommendations via WhatsApp.
How We Protect Your Data
Zero-knowledge encryption — All financial data is AES-256 encrypted on your device before it
leaves your browser. Your password is used as the encryption key and is never sent to our servers.
Key derivation — PBKDF2 with 600,000 iterations is used for secure key derivation, leveraging
native SubtleCrypto when available.
Card scanning privacy — Our AI card scanner extracts only non-sensitive data (bank name, card
variant, network). Full card numbers, CVV codes, and cardholder names are explicitly ignored and redacted.
No plaintext storage — Our servers store only encrypted blobs. We cannot read your financial
data even if compelled to.
Third-Party Services
We use the following third-party services to operate Pryz:
Firebase — Authentication and encrypted data storage (Google Cloud).
Supabase — Anonymized vector search for merchant matching and offers data.
Google Gemini AI — Card recommendation engine. No personally identifiable information is
included in AI queries.
Meta WhatsApp Business API — For users who opt into the WhatsApp bot. Phone number and
messages are processed by Meta.
Sentry — Error monitoring with PII collection explicitly disabled.
Vercel — Application hosting.
Data Retention
Your data is retained for as long as your account is active.
Encrypted data blobs are permanently deleted upon account deletion.
WhatsApp message history is retained for 90 days after your last interaction.
Anonymized, aggregated analytics data may be retained for service improvement.
Your Rights
Access — View all your stored data from the Profile page.
Deletion — Request complete deletion of your data. See our
Data Deletion page.
Opt-out — Unlink your WhatsApp number at any time from your Profile.
Correction — Report incorrect card or reward data through the app.