Privacy Policy

1. What Spur is

Spur helps you pick the right credit card for a given purchase. You tell Spur which cards you carry (by product name — never a card number), and Spur returns the card most likely to earn the most rewards. Spur does not process payments, store card numbers, or move money.

Spur is offered through: (a) a web-based onboarding page at mcp.spur.cards, (b) a hosted Model Context Protocol (MCP) server that AI assistants (including Meta's Muse) can connect to under your control, and (c) an iOS app.

2. What Spur collects

• Account details. Email and password when you register at mcp.spur.cards. Passwords are stored only as a bcrypt hash (cost 12) — Spur cannot recover the plaintext. If you use Sign in with Apple through the iOS app, Apple provides your name and email (or a private-relay address) and Spur stores those.
• API keys. When you generate a Muse key, Spur stores only a SHA-256 hash of the key and a 16-character prefix for display. The plaintext key is shown to you exactly once, in the browser tab where you created it. Spur cannot retrieve or re-display it afterwards.
• Wallet contents. The cards you add to your wallet (product names and Spur catalog IDs) and any spending goals you set.
• Request context per query. The merchant name, category, and amount you ask about; the specific cards you name in a comparison. These are used to compute the answer to that one request.
• Operational data. Rate-limit counters and timing metrics. Structured logs of API events, keyed by an opaque user ID rather than by email.

3. What Spur does not collect

• No card numbers. Spur has no field for a card number, CVV, or expiration date.
• No bank logins. The Plaid integration is currently disabled in production. Spur has no path today for you to link a bank; if that changes, this policy will be updated first.
• No advertising trackers on the API surface. The MCP onboarding page and the API do not load third-party ad or social pixels. Website analytics on marketing pages (spur.cards) are described separately in the analytics section.

4. How Spur uses it

Spur uses your data only to answer your requests, keep your account secure, and improve the service. Specifically:

• Recommend a card in response to a request you (or your AI assistant) send.
• Compare cards you name in a comparison request.
• Track progress toward goals you have set.
• Deliver push notifications you have opted into (iOS app only).
• Rate-limit and detect abuse.
• Fix bugs and monitor operational health.

Spur does not sell your data. Spur does not use your data for advertising or ad targeting.

5. Subprocessors (who else touches your data)

Spur runs on Google Cloud in the United States (Cloud Run and Cloud SQL in the us-central1 region). Some third parties may process your data on Spur's behalf, under contract. The list differs by surface:

Provisioning of PostHog and Sentry is set at the infrastructure level; those keys are not mounted in the default deployment today. This policy will be updated to name any additional live subprocessor before it is added.

6. How Spur protects it

• TLS on every connection. Every request to spur-api-1093121987196.us-central1.run.app and spur-mcp-1093121987196.us-central1.run.app is served over HTTPS. Plain HTTP is redirected. The customapi.spur.cardscertificate is currently provisioning as of the draft date; traffic still reaches the encrypted Cloud Run endpoint via the run.app hostname.
• Passwords are salted and bcrypt-hashed at cost 12. Spur cannot read your password.
• API keys are SHA-256 hashed at rest. The plaintext key exists only on the machine where it was generated and wherever you paste it (Muse's secure credential store).
• Revocation is prompt. Revoking a key marks it inactive in the database and evicts the cache entry in the same request. The database lookup that runs on the next cache miss immediately rejects the revoked key. In the rare event that cache eviction fails while the database update succeeds, the revoked key may continue to authenticate for up to five minutes.
• Encrypted at rest where required. Sensitive token material (Apple refresh tokens, and Plaid access tokens when the Plaid integration is enabled) is encrypted with AES-256-GCM before it is written to the database.
• Rate limits on every public endpoint. Sign-in, key creation, deletion, and every recommendation route are rate-limited per user or per key.

7. Retention and deletion

Your account and its data persist as long as your account is active. You have the right to delete your account at any time.

How to delete today: the DELETE/v1/meendpoint deletes your account and cascades to your API keys, refresh tokens, wallet, goals, notification preferences, sign-up bonus tracker rows, manual spending entries, analytics events, push tokens, Plaid link state, and any waitlist row that matched your email. Your users row is anonymized (email rewritten todeleted_<id>@deleted.spur.app, name / avatar / Apple ID / Apple refresh token ciphertext / date of birth / phone number all cleared) and marked deleted.

A user-facing delete button is not yet exposed on the Muse onboarding page at mcp.spur.cards. Until that ships, you can delete your account by:

• Emailing contact@spur.cards with subject "delete my account". Requests are actioned within 30 days, typically within 48 hours.
• (For technical users) calling DELETE https://api.spur.cards/v1/me with a valid access token.

After deletion, anonymized aggregate counters (used only for service-health metrics) and records Spur is legally required to retain may persist. Encrypted backups age out on a rolling schedule.

8. Your rights

Wherever you live, Spur honors the following on request. For users in the EU/UK (GDPR) and California (CCPA/CPRA) these are legally required:

• Access and portability — a copy of what Spur holds about you.
• Correction — fix anything that is wrong.
• Deletion — see section 7 above.
• Objection and restriction — ask Spur to stop a particular use.
• No sale, no cross-context behavioral advertising. Spur does not sell personal information and does not share it for cross-context behavioral advertising, so there is nothing to opt out of.
• No discrimination for exercising a right.

Requests go to contact@spur.cards. If you are in the EU/UK and Spur does not resolve something, you can complain to your local data-protection authority.

9. Affiliate links and commissions

Some card recommendations may include an application link that earns Spur a commission when a user applies for and is approved for a card. When any such link appears in a response, the API attaches the following disclosure verbatim:

“Heads up: Spur may earn a commission if you apply through this link.”

A commission does not change which card Spur recommends. The recommendation engine scores cards on the rewards they earn against the merchant and amount you asked about; the affiliate relationship is a separate field on the card catalog and is neither an input to nor a tiebreaker for the score.

10. Location data

The Muse connector does not use location. If you also use the iOS app and turn on smart location alerts, your iPhone watches for place visits on-device. When you arrive somewhere, the app sends the coordinate to Spur's servers to identify the merchant. Spur stores aggregate counters only — never a per-person location trail. Sensitive place categories (medical, legal, religious, and similar) are filtered on-device and never trigger an alert. Turning off smart alerts stops the monitoring itself, not just the notifications.

11. Age

Spur is for adults. You must be 18 or older. Spur does not knowingly collect data from anyone under 18; if Spur learns it has, that data will be deleted.

12. Changes and contact

Spur will update this page when the service changes what it collects, who processes it, or how long it is kept. Material changes will be announced in-app or by email before they take effect, not after. The date at the top of this page always reflects the current version.

Questions or requests go to contact@spur.cards. A human answers.