Deck ("the app") helps you choose which of your own credit cards to pay with. This policy explains what we collect, why, and your rights. The short version: we collect the minimum needed to run the service, we never collect card numbers, and you can delete everything yourself, in the app, at any time.
What we collect
Account: your email address and a password (stored only as a salted bcrypt hash), or your Apple/Google account identifier if you sign in with them. Apple's "Hide My Email" relay addresses are fully supported.
Your deck: which card products you add (e.g. "Maybank 2 Platinum") and an optional statement day. We never ask for and cannot store card numbers, CVVs, expiry dates, or banking credentials — there is no field for them.
Logged purchases: the amounts, merchant names, and categories you choose to log so the app can track reward caps and tiers. These come only from what you type; Deck has no access to your bank, statements, or transactions.
What we don't do
No advertising, no analytics SDKs, no trackers, no selling or sharing of personal data.
No connection to your bank or card networks. Recommendations are computed from published card terms and the purchases you log.
No card numbers — ever, by design.
How data is used
Solely to operate the app: authenticating you, computing card recommendations, and showing your own activity and reward progress back to you. Reward values shown are estimates derived from banks' published terms and are not financial advice.
Where data lives
Application data is stored with Neon (managed Postgres) in the AWS Singapore region (ap-southeast-1); the API runs on AWS Lightsail in Singapore.
Card artwork is served from Cloudflare R2. It contains no personal data.
If you sign in with Apple or Google, they act as identity providers under their own privacy policies; we receive only your verified identifier and email.
Deleting your account
In the app: Profile → Delete account. This permanently and immediately deletes your account and everything attached to it (deck, activity, sessions) from our database, and revokes Sign in with Apple tokens with Apple. You can also email us (below) and we will delete your account within 7 days.
Your rights
Under Malaysia's Personal Data Protection Act (PDPA) and equivalent laws, you may request access to, correction of, or deletion of your personal data at any time via the contact below.