Privacy Policy
This policy explains what information MaxUrPoints (United States) collects through the maxurpoints.com website and the MaxUrPoints web app, and how we use it. Questions: support@maxurpoints.com.
Information we collect
- Account information: your email address and a password, which we store only as a one-way hash (we cannot read it).
- Information you enter: the point balances, card tiers and optional card notes you type into the app. We never ask for bank or card logins, card numbers, or loyalty account passwords.
- Subscription information: your plan, renewal date and payment status. Payments are processed by Stripe; card details go directly to Stripe and are never stored on our servers. Stripe handles payment data under its own privacy policy.
- Technical information: our hosting provider automatically records basic server logs (such as IP address, browser type, pages requested and timestamps) for security and troubleshooting.
- Anonymous destination searches: when you search for or open a destination in the app, we record only the destination country, how it was opened (search or tap) and the time, to power the “Trending searches” list. This record is not linked to your account, email or IP address.
- Emails you send us: if you contact support, we keep the conversation so we can help you.
Connecting your seats.aero account (First Class Finder)
If you use the First Class Finder add-on, you can connect your own seats.aero PRO account with “Login with seats.aero” (OAuth). You sign in on seats.aero; we never see your seats.aero password. When you connect:
- What we receive: an access token and refresh token (scope “openid”), and from seats.aero’s user-info endpoint your name, email and PRO subscription end date.
- What we keep: the tokens, encrypted on our server with a key unique to your account; they are never sent to your browser or written to logs. Your seats.aero email (shown masked), PRO end date and award search results are kept only in a short-term cache that is automatically deleted within 24 hours. Watch alerts that quote award data are deleted after 24 hours.
- How we use it: only to run the searches, route watches and weekly digest you ask for, using your own seats.aero daily data allowance. We never share your connection, tokens or results with other members or third parties, and we don’t sell award data.
- Disconnecting: click Disconnect in First Class Finder (or revoke access on seats.aero) and we immediately delete your tokens and any cached seats.aero data. If seats.aero reports that your access was revoked or your PRO subscription ended, we delete them automatically too.
seats.aero’s own handling of your data is covered by seats.aero’s privacy policy. MaxUrPoints is not affiliated with or endorsed by seats.aero.
Free weekly email digest
- What we collect: only the email address you enter, the date you signed up and confirmed, and where you signed up (home page, pricing page or app). We don’t record your IP address with the subscription.
- Double opt-in: nothing is sent except a confirmation email until you click the confirmation link (it expires after 48 hours).
- How it’s stored: your address is encrypted on our server and looked up by a keyed hash. Confirmation and unsubscribe links use random tokens that we store in hashed form.
- Unsubscribe: every digest has a one-click unsubscribe link (and supports your email app’s built-in unsubscribe button). You can also email support@maxurpoints.com.
- Who sends it: our email delivery provider sends the digest on our behalf and receives your address only to deliver it.
The digest is separate from your account and from the First Class Finder digest; subscribing to one doesn’t subscribe you to the other.
Free Pro signup (email)
- What we collect: when you sign up for free Pro, we store the email you enter, that you ticked the consent box, and when you signed up (Netlify Blobs, United States). The app gets a signed Pro token that stays in your browser’s local storage.
- What we use it for: to send you one welcome email when you sign up (what free Pro includes and where to start), to match partner-deal claims you make through MaxUrPoints (so partners can credit the referral) and, only if you turn them on, to send Pro bonus alerts. After the welcome email we don’t send any other email from this signup unless you turn on bonus alerts, and we don’t sell your email.
- Unsubscribe anytime: the welcome email and every bonus alert have a one-click unsubscribe link (a random token unique to you). Unsubscribing from the welcome email’s link stops all MaxUrPoints email to you, including bonus alerts; your free Pro access is unchanged. You can also email support@maxurpoints.com.
- Who sends it: our email delivery provider (Resend) sends these emails on our behalf from support@maxurpoints.com and receives your address only to deliver them.
- Abuse protection: to limit automated signups we keep a short-lived counter keyed by a one-way hash of your IP address; we don’t store the IP address itself.
- Deletion: email support@maxurpoints.com and we’ll delete your signup record.
Pro bonus alerts (optional)
- Opt-in only: Pro members (including free signups) can turn on bonus alert emails in the app. They’re off until you turn them on, and we email only when a program you chose to follow gets a new transfer bonus or a transfer ratio change.
- What we store: your member ID (a Stripe customer ID for earlier paid members, or a free-signup ID), the email on your Pro signup or subscription, the programs you follow, whether alerts are on, and when you last changed them. Stored with our hosting provider (Netlify) in the United States.
- Unsubscribe: every alert has a one-click unsubscribe link (a random token unique to you). You can also turn alerts off in the app or email support@maxurpoints.com. Unsubscribing doesn’t affect your Pro access.
Share card
The “My points are worth $X” image is generated on our server from the balances you’ve saved and returned only to you. By default it shows only your estimated total; your individual program balances appear on it only if you tick that option. Nothing is posted anywhere unless you share it yourself.
Referrals, creator links and reminder emails
If you open a member’s referral link (/?ref=CODE or /r/CODE) or a creator’s link (/c/CODE), the site stores that code and the time in your browser’s local storage for 30 days (any UTM tags on the link are kept the same way), and passes them to Stripe as a reference when you check out, so the right person gets credit if you sign up. For creator links we also count the click (code and time only, no IP address). When you sign up, we record who referred you; referrers and creators see totals only (for example “3 sign-ups”), never your email or name. If you’re on the free plan and haven’t opened the app for a while, we may send an occasional reminder email about live transfer bonuses (at most one every 90 days); every one has a one-click unsubscribe link, and unsubscribing doesn’t affect account or billing emails.
Anonymous visit counting
Since October 14, 2026 every page loads a small first-party script (/assets/t.js) that sends one request to our own server (/api/hit) when a page opens. It sends the page path, the referring website and any utm_source in the link. On our server (Netlify) we add one to a daily counter for that page, the referring domain (only the domain, for example google.com) and the utm_source. To count unique visitors per day without cookies, we compute a one-way hash of your IP address and browser user-agent combined with a random value that changes every day. We store only that shortened hash, never your IP address or user-agent. The daily random value is deleted after the day ends, so hashes can’t be linked across days or traced back to you. No cookies or local storage are used, nothing is shared with third parties and the counts are not used for advertising. If your browser sends Do Not Track or Global Privacy Control, the script doesn’t send anything and the server ignores the request. Known bots are not counted. Daily totals are kept in Netlify Blobs for as long as we need them for traffic reports.
Cookies and tracking
This marketing website sets no cookies and uses no advertising or third-party tracking scripts. It does run our own small, cookieless visit counter, described under Anonymous visit counting. Links we share on social media or in the digest may carry UTM tags (for example, utm_source=x) so we can count visits by campaign; they contain no personal information. The map in the app loads tiles from OpenStreetMap’s tile servers, which receive your IP address and the map area requested, under the OpenStreetMap Foundation privacy policy. The web app uses an essential, HttpOnly session cookie to keep you logged in, plus the referral/creator attribution cookie described above when you arrive through such a link. We do not use ad trackers or sell data to advertisers.
How we use information
- To provide the Service: calculate your transfer estimates and run your account.
- To run free Pro signups and to manage earlier paid subscriptions (which no longer renew).
- To respond to support requests.
- To keep the Service secure and prevent abuse.
We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising.
Who we share it with
Only service providers that help us run MaxUrPoints, under their own confidentiality and security obligations: our hosting provider, Stripe (payments), and our email provider (account and billing emails). We may also disclose information if required by law or to protect the rights and safety of our users or the Service.
Retention and deletion
We keep your account information while your account is open. You can ask us to delete your account and associated data at any time by emailing support@maxurpoints.com from the address on your account; we will do so within 30 days, except for records we must keep for tax, accounting or legal reasons (for example, payment records), which Stripe and we retain as required by law.
Your rights
You can request access to, correction of, or deletion of your personal information by emailing support@maxurpoints.com. Depending on where you live (for example, California), you may have additional rights under local law; we will honor them and will not discriminate against you for exercising them.
Partner perk claims
If you click “Claim” on a partner perk in the app and tick the consent box, we store your email, the perk, a random click ID and the time. The click ID is passed to the partner through our partner link so we can match your signup when the partner confirms it in their dashboard. We use your email only to match the claim with the partner (so we can earn the referral fee) and to contact you about that claim, not for marketing. You sign up with the partner yourself and their own privacy policy applies there. Ask us to delete a claim any time at support@maxurpoints.com.
Security
We use HTTPS, hashed passwords, hashed server-side session tokens and limited data collection. No method of transmission or storage is completely secure, but we work to protect your information.
Children
MaxUrPoints is not directed to children under 13 and we do not knowingly collect their information. Accounts are for users 18 and older.
Where data is processed
MaxUrPoints is operated from the United States, and your information is stored and processed in the United States.
Changes
If we make material changes to this policy we will update the date above and notify account holders by email or in the app.
Contact
Operated by MaxUrPoints, United States. Email: support@maxurpoints.com.