No bank connection. No card numbers. No credentials we hold. We know which shops are interesting, and which card products you told us you carry — nothing that could be used to spend money.
Last updated 28 July 2026
We never have a card number. Not a PAN, not an expiry date, not a CVV, not a bank login. There is no screen in the app that could ask for one and no column in our database that could hold one. If a feature ever needed that, it would be a different product.
What we do have, once you are signed in, is the list of card products you told us you carry — "this account holds a Blue Cash Preferred" — plus which bonus category you picked on a card that lets you choose one, and any earn rate you corrected by hand. It is saved under your account so a new phone, or a private browser window, gets your wallet back instead of starting empty. It is readable only by you, enforced by the database itself rather than by our code remembering to be careful.
This changed on 17 August 2026, and the old wording is worth stating so the change is legible. It used to say your card list never left your device. That was true, and what it cost was a wallet that emptied itself every time you opened the app somewhere new, with no recovery except re-entering every card by hand.
The offers the browser extension finds are a different thing, and are still sealed to us. Those are your targeted offers, read from your issuer's own site, and their key is generated in your browser and reaches us at no point — you carry it to your phone yourself with the linking code. We hold the ciphertext so your phone and your browser can stay in step; we cannot decrypt it, and neither can anyone who takes it from us.
The comparison — which card is best here — still happens on your phone, against shop data our servers send down. It never happens on our side, and we never ask for a bank login.
| What | Why | Kept |
|---|---|---|
| An anonymous identifier | So contributions can accrue a track record, and so votes can be rate-limited and weighted. Created automatically; it isn't linked to your name, email, phone number or Apple/Google account. | Until you delete the app |
| Shops you look up or contribute about | To return deals for that shop, and to record which shop a contribution concerns. | Indefinitely, tied to the anonymous identifier |
| Your contributions | Split deals you post, votes, confirmations that a deal worked or failed, and reports. This is the shared data the whole product runs on. | Indefinitely; may be retained anonymised if removed, so other people's confidence scores don't silently shift |
| Device attestation | Apple App Attest and Google Play Integrity confirm the app is genuine before a vote counts. Without this, the community data would be trivially farmable. | A flag only; we don't retain the attestation payload |
| Crash and error diagnostics | To find bugs. | Limited period |
Purple Wallet asks for background location because the entire point is that the answer is ready before you open the app. Without it, you'd have to launch the app at the counter — which is the problem we're trying to remove.
Location matching happens on your device. Your phone monitors a small rolling set of nearby shops and notices when you arrive at one. We ask our servers which shops are near a coarse area so we know what to monitor, but we do not build or keep a history of everywhere you have been, and we do not sell or share location data with anyone.
You can decline background location. The app still works — you'll open it and look up a shop yourself.
Setting up your cards by speaking sends audio to OpenAI for the duration of that one session, so the model can recognise card names. This happens only during card setup, never in the background, and never while you're at a shop.
Your phone is given a temporary credential that expires after about a minute; it never holds our OpenAI key. Audio is sent to OpenAI under their API terms, which at the time of writing do not use API data to train their models. We do not store recordings — only the resulting list of cards, which stays on your device.
You can skip voice setup entirely and pick your cards from a list.
Split deals, votes and confirmations are shared with other users — that's what makes them useful. Please don't put personal information into a deal title or note.
Contributors who build up a strong record may choose to display a handle and an accuracy ring. That's optional, off by default, and it is the entire public identity surface: there are no profiles, no followers, and no feed.
We do not sell personal information, and we do not share it with advertisers or data brokers. There are no third-party advertising or analytics SDKs in the app.
There is no account to close. Your identity is tied to your app install, so deleting the app ends it, along with any karma or accuracy record attached to it. That is deliberate, and it cannot be undone or recovered — including by us.
To have contributions removed as well, email team@purplewallet.app from the device concerned. Depending on where you live you may also have rights to access, correct, or export your data; write to us and we'll help.
Purple Wallet is not directed at children and is not intended for anyone under 13. We don't knowingly collect data from children. If you believe a child has used the app, contact us and we'll remove what we can.
Purple Wallet tells you what the community has found and what public card data says. It is not financial advice, we are not your financial adviser, and rewards programmes change without notice. Confirm anything that matters with your card issuer.
If this policy changes materially we'll say so in the app before the change takes effect, rather than quietly editing this page.
| team@purplewallet.app | |
| Publisher | Artefaktx |