Privacy Policy

Overview

Tofula LLC ("Tofula," "we," "our," or "us") built the Tofula app to help you use the right credit card at every store. We take your privacy seriously.

We never sell your personal information. We never share your financial data with advertisers. We are not a bank, credit card issuer, or financial advisor.

Questions? Email privacy@tofula.app — we respond within 48 hours.

What we collect

Account information — Your email address and name (if provided). Used to identify your account and contact you about your subscription.

Card information — The name of your credit cards and the last 4 digits you enter. We NEVER collect full card numbers, CVV codes, expiration dates, billing addresses, or any payment data.

Location data — We access your GPS location while the app is open to identify nearby stores. We do NOT store your precise GPS coordinates — we convert your location to a store name and immediately discard the raw coordinates.

Transaction history — When you use Tofula, we log store name, card used, reward category, and estimated rewards earned. We do not know your actual transaction amount unless you scan a receipt or log it yourself.

Usage data — Anonymous information about which screens you visit and which features you use, plus crash reports. Not attached to your name or email.

Device information — Device type, OS version, and a random device identifier. We do not collect your phone number, contacts, photos, or data from other apps.

How we use your information

We use your information to: identify nearby stores and recommend the best card; send push notifications at stores, with your permission; calculate and display your savings history; respond to support requests; send account notifications; improve the app through anonymous analytics; detect and prevent fraud and security incidents; comply with legal obligations.

We do NOT: sell advertising with your data; build profiles for third-party advertisers; share with data brokers; make automated decisions about your creditworthiness; access your actual bank or credit card accounts.

Who we share data with

We share data with a small number of service providers, all contractually required to protect your data:

• Firebase (Google) — authentication, database, cloud functions
• RevenueCat — subscription management
• Sentry — crash reporting, configured to exclude personally identifiable information
• Anthropic (Claude AI) — receipt scanning and AI support chat; we do not send your name, email, or card numbers to Anthropic

We do not share your data with credit card companies, banks, advertisers, data brokers, or marketing firms.

How long we keep your data

• Active account: kept until you delete it or close your account
• Deleted account: immediately deleted from our database; may persist in encrypted backups for up to 30 days
• Transaction history: stored until you delete it or close your account; exportable at any time
• Support conversations: retained for 12 months, then automatically deleted
• Anonymous analytics: aggregated after 90 days and cannot be tied back to you

How we protect your data

• Encryption in transit: all data encrypted with TLS 1.2+
• Encryption at rest: Firebase Firestore encrypts all stored data; auth tokens stored in iOS Keychain / Android Keystore
• Access controls: Firebase Security Rules prevent any user from accessing another user's data
• Session security: app locks after 15 minutes of inactivity; biometric or PIN required to unlock
• Jailbreak detection: we detect compromised devices and warn you
• Breach notification: we will notify users and authorities within 72 hours of a confirmed breach

Children's privacy (COPPA)

Tofula is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you are under 13, do not use this app.

If we learn we have collected information from a child under 13 without parental consent, we will delete it immediately. If you are a parent and believe your child has used Tofula, contact privacy@tofula.app immediately.

California residents (CCPA / CPRA)

California residents have the right to: know what categories of personal information we collect and why; access a copy of the personal information we hold about you; delete your personal information; correct inaccurate personal information; opt out of sale (we do not sell your personal information); limit sensitive data use; and non-discrimination for exercising these rights.

To exercise these rights, email privacy@tofula.app with subject line "California Privacy Request." We respond within 45 days.

European users (GDPR)

We process data under: contract performance, legitimate interests, consent (for optional features), and legal obligation. You have the right of access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests.

Data is stored in the United States. We use Standard Contractual Clauses for international transfers. Email privacy@tofula.app — we respond within 30 days.

Financial disclosures

Not financial advice. Nothing in Tofula constitutes financial advice, investment advice, or a recommendation to apply for any credit product.

Not a financial institution. Tofula LLC is not a bank, credit union, credit card issuer, or licensed financial institution. We are a technology company, not regulated by the FDIC, OCC, CFPB, or banking regulators.

Reward rate accuracy. Reward rates shown are based on publicly available information and may not reflect current rates or your specific card terms. Always verify with your card issuer.

Estimated earnings. Dollar amounts shown are estimates only. We make no guarantee about actual earnings.

Affiliate relationships. Tofula may display links for credit card products. If you apply for a card through a link in Tofula, we may receive a referral fee from the card issuer. This does NOT affect which cards we recommend.

No credit decisions. Tofula plays no role in credit decisions. We do not access your credit file, credit score, or credit report, and do not report to credit bureaus.

Your rights and how to exercise them

Within the app, you can access your data (Settings → Privacy & data → Export all my data), delete your data (Settings → Privacy & data → Delete my account), opt out of analytics or marketing, disable location, clear location history, disable notifications, or close your account entirely — all from Settings. For anything else, email privacy@tofula.app.

Changes to this policy

We may update this Privacy Policy. For material changes, we'll notify you in-app at least 30 days before changes take effect, send an email notification, and update the date at the top of this page.

Contact us

Privacy questions: privacy@tofula.app
Security vulnerabilities: security@tofula.app
Legal process: legal@tofula.app
General support: support@tofula.app

Tofula LLC — Indiana, United States
Response time: 48 hours for general questions, 30 days for rights requests.