Credit and Habit

TRANSPARENCY

Privacy notice

How this website handles browsing, credit card comparisons, AI chat messages, and service-provider processing.

Browsing the site

You can browse without creating an account. Cloudflare hosts the site and may process IP addresses, device information, request details, and security logs to deliver and protect the service. The application does not add advertising analytics or tracking pixels in this version. Third-party sites have their own privacy practices.

Comparison selections

Selected comparison card IDs are stored in your browser's session storage so you can move between pages. This application does not store a personal financial profile. You can clear selections using the comparison controls or by closing the browser session.

AI chat

When you use the card helper, your messages and recent conversation context are sent through our server to OpenAI to generate a response. Chat history is held in page memory and is not saved as a conversation transcript in our D1 database. Requests specify store:false; this does not mean a service provider retains no data for security or other purposes. OpenAI's applicable service policies govern its processing.

Abuse prevention

The server derives a hash from an IP address and date and stores hourly request counters in D1 to enforce chat limits. These records are not conversation transcripts. Infrastructure providers may separately retain request or security logs. Avoid entering sensitive personal or financial information into the helper.

Your choices

Using the AI helper is optional. You can browse issuer summaries without sending chat messages. Clear the chat to remove the on-page conversation. Review Cloudflare's and OpenAI's privacy information for their practices, and the issuer's policy before following an external link.

Administrator access

Authorized administrators sign in using credentials configured by the site owner in Cloudflare secrets. A secure, HTTP-only session cookie lasts up to eight hours. D1 stores hashed session tokens, administrator email addresses, session expiration, and hashed login-attempt counters. Expired sessions and counters are cleaned up on subsequent logins. Published site edits and revision history record the editing administrator and time and remain until the owner removes them. Regular visitors do not need an administrator account.

Changes

This notice describes the implemented version of the site. It must be updated when accounts, analytics, advertising, additional data collection, retention rules, or service providers are introduced.