Missing Points runs in your browser. Your calendar, your statements and your results are analysed on your device and are never sent to us: we don't run a server that could receive them, and there's no account to sign up for.
What the app reads
- Google Calendar, if you choose to connect it. You grant read-only access (the
calendar.readonlypermission), and the app reads the title, description, location and dates of the events in your primary calendar from the last 24 months. The request goes straight from your browser to Google. The access Google issues is held in the open tab only, is never stored or sent anywhere else, and is gone when you close or reload the page. - Calendar files (.ics) and card statements (CSV) that you pick. They're read in your browser and never uploaded.
What is kept, and where
From your calendar, the app keeps only the flights and hotel stays it finds: airline, flight number, route, hotel name, city, dates and the estimated price. Every other event is discarded once the scan finishes. From statements it keeps each purchase's date, description, amount and category. These, and your settings, are saved in your browser's local storage on this device, so your results are still there when you come back.
To delete them, use Settings → Delete all data, or clear this site's data in your browser. To remove Missing Points' access to your Google account, visit your Google account permissions.
Google user data
Data from your Google account is used only to find your flights and hotel stays and show what credit cards would have earned on them, on your device. It isn't transferred to us or anyone else, isn't used for advertising, isn't sold, isn't used to train AI models, and no person reads it.
Missing Points' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Anonymous usage analytics
We use PostHog, hosted in the EU, to count how people use the site so we can improve it. It runs without cookies and stores nothing in your browser, so visits can't be linked together. It records which pages and tabs are viewed, clicks on buttons (without reading any text on the page), and a few steps such as which kind of source you connected, how many flights and stays were found, whether you picked the card you paid with, the country you chose, whether you shared your result, and which recommended card's link you followed.
It never records event titles, places, amounts, file names, which cards you hold, or anything else from your calendar or statements. Like any web request, these reach PostHog with your IP address and browser type; we don't use them to identify you.
Other services involved
- The site is hosted on Firebase Hosting (Google), and its typeface comes from Google Fonts. Like any website, they receive your IP address and browser details when your browser loads the page.
- Connecting Google Calendar uses Google sign-in, which is covered by Google's privacy policy.
- Links to card issuers take you to their websites, where their own privacy policies apply. We don't pass any of your data to them.
Sharing your result
The share image is drawn in your browser. It shows only the headline amount, the period and a card name, and it goes nowhere unless you choose to share or save it.
Cookies, children and your rights
We don't set cookies. The site isn't intended for children under 16. Because your data stays on your device, you can see, export or delete it yourself at any time. For anything else, including questions about analytics data, write to privacy@missingpoints.ai.
Changes
If this policy changes, the new version will be posted here with a new date.