Privacy Policy

SteddiCard ("SteddiCard," "we," "us," or "our") is a credit card due-date tracking service operated by SteddiCard, located in Florida, USA. You can reach us at support@steddicard.com.

This Privacy Policy explains what information we collect, how we use it, how we protect it, and your choices. It applies to our website and app (the "Service").

• We collect your account info (name, email, optionally phone), the card details you enter (nickname, due date, and only the last 4 digits of a card — never a full card number, never a CVV), and, only if you choose to connect a bank, financial account data (balances, account names, statement/due dates) obtained through Plaid.
• We never see or store your bank login credentials — those are entered only in Plaid's secure flow.
• We do not sell your personal information.
• We encrypt sensitive data and restrict access so users can only see their own data.

Information you provide

• Account information: first name, last name, email address, and (optional) phone number.
• Card tracking information: for each card you add manually, the nickname, issuer, card network, last 4 digits only, credit limit, APR, statement closing date, and payment due date. We do not collect or store full card numbers or CVV/security codes.
• A PIN you optionally set to lock the app (stored only as a secure hash, never in plain text).

Information from connecting a bank account (optional, "Pro" feature)

• If you choose to connect a financial account, we use Plaid Inc. ("Plaid") to establish the connection. You enter your bank login only within Plaid's own secure interface — SteddiCard never sees, receives, or stores your bank username or password.
• Through Plaid, we receive and store: connected account name/institution, account type, the last 4 digits of the account, current balance, and (where available) statement and payment due dates.
• Your use of Plaid is also governed by Plaid's own privacy policy (plaid.com/legal).

Information collected automatically

Basic technical data necessary to operate and secure the Service (e.g. authentication session data). We do not use third-party advertising or analytics trackers.

Payment information

Subscription payments are processed by Stripe, Inc. ("Stripe"). We do not receive or store your full payment card number — Stripe handles that directly. We receive limited billing status information (e.g. whether a subscription is active) from Stripe.

We use your information only to:

• Provide the Service (track your cards, show due dates, sync connected-account data);
• Create and secure your account, and authenticate you;
• Send you service-related communications (e.g. account verification, payment reminders and receipts, important notices);
• Process your subscription through Stripe;
• Protect the Service and our users from fraud and abuse, and comply with law.

We do not use your financial data for advertising, and we do not sell it.

We share information only with:

• Service providers who help us operate, specifically: Plaid (bank connections), Stripe (payments), our hosting/infrastructure provider(s), and our email delivery provider(s) — each only as needed to perform their function.
• Legal/safety reasons: if required by law, legal process, or to protect rights, safety, or the integrity of the Service.
• Business transfers: if the Service is acquired or merged, subject to this Policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

• Encryption in transit (TLS/HTTPS) and encryption at rest (AES-256).
• Sensitive data (including any connected-account access tokens and balances) is additionally encrypted at the application level using a key-management service, so keys are protected and access is logged and revocable.
• Access controls: database-level rules ensure each user can only access their own data.
• We store only the last 4 digits of any card or account number, never full numbers, and never CVV/security codes.
• No system is perfectly secure; we cannot guarantee absolute security, but we work to protect your data using industry-standard measures.

We keep your information for as long as your account is active or as needed to provide the Service, then delete or de-identify it within a reasonable period, except where longer retention is required by law. You can delete cards, disconnect bank connections, or delete your account at any time.

• Access, correct, or delete your account information from within the app.
• Disconnect any bank connection at any time (which removes the stored connection and its data on our side and revokes it with Plaid).
• Delete your account, which removes your personal data as described above.

California residents (CCPA/CPRA): you have rights to know, access, delete, and correct your personal information, and to not be discriminated against for exercising them. We do not sell or share your personal information as those terms are defined under California law. To exercise these rights, contact us at support@steddicard.com.

Other US state privacy laws (e.g. Virginia, Colorado, Connecticut, Utah) may grant similar rights; we honor applicable rights for residents of those states.

International users (EU/UK/others): the Service is currently intended for US users. If we expand internationally, we will update this Policy to address GDPR/UK-GDPR requirements (legal bases, data transfers, DPO/representative, etc.).

The Service is not directed to children under 18, and we do not knowingly collect their information.

We may update this Policy; we will post the new effective date and, for material changes, provide additional notice.

Questions about this Policy: support@steddicard.com.