Privacy Policy

Effective date: April 20, 2026 Last updated: April 20, 2026

---

1. Who we are

Steward Technologies ("Steward," "we," "us," "our") operates the Steward iOS application (the "App"), which helps you decide which of your credit cards to use based on nearby merchants, your spending profile, and loyalty memberships.

Contact: support@stewardflow.com

2. What this policy covers

This policy describes the personal information the App collects, how we use it, who we share it with, and the choices you have. It covers the mobile app, our backend API, and the lock-screen widget.

It does NOT cover:

• Websites, products, or services operated by third parties we link to (Google Maps, issuer websites, etc.)
• Actions you take inside your credit card issuer's own app or website

3. Information we collect

3.1 Information you provide

• Name and email — optionally, via Sign in with Apple
• Survey answers during onboarding: spending goals, top categories, monthly spend level, annual fee tolerance, notification preferences
• Your card list — which credit cards you have selected in the app. We do NOT access your actual card numbers, statements, or transaction data. You tell us which cards you hold; we advise on which to use.
• Loyalty program memberships and tiers you enter
• Trips you plan in the app (destination, dates, travelers)
• User-reported merchant network acceptance (e.g. "Costco accepts only Visa")

3.2 Information collected automatically

• Location data — precise location (via Apple Core Location, with your permission) to recommend cards for nearby merchants. You can grant "While Using" or "Always" access, or deny the App location entirely. Denying location removes the proximity-based features.
• Device and app information — iOS version, app version, device model, language, time zone
• Usage analytics — which screens you view, which features you use, and how long sessions last. We use PostHog for this. Analytics events include card additions, recommendations viewed, trips created, and similar product interactions.
• Crash and performance diagnostics — when the App crashes, encounters an error, or a feature is slow, we send a diagnostic event to Sentry. These events include the error message, a stack trace, the device model and iOS version, the App version, and — for the purpose of correlating crashes across a user's sessions — your IP address and a device identifier. We do not send the contents of your cards, trips, loyalty memberships, survey answers, or any financial data to Sentry.

3.3 Information we do NOT collect

• Your credit card numbers, PINs, expiration dates, or security codes
• Transaction history from your credit card accounts
• Your credit score or credit report data
• Contacts, photos, calendar, microphone, or camera (unless a feature clearly asks permission in the future)

4. How we use information

• Provide the core feature: recommending which card to use at a merchant
• Suggest merchants near you via map search
• Help you plan trips and earn rewards on travel bookings
• Sync your profile across devices
• Debug problems, measure feature adoption, and improve the App
• Send you notifications about relevant offers, if you have enabled them

5. Who we share information with

We share limited information with a small set of service providers needed to run the App:

We do NOT sell your personal information. We do NOT share your information with advertisers or data brokers. We do NOT share it with credit card issuers.

We may disclose information if required by law, subpoena, or court order, or to protect the safety or rights of Steward, our users, or the public.

6. Data retention

• Profile data, card lists, trips, and loyalty data: retained while your account is active. Deleted within 30 days when you delete your account (in-app) or email us a deletion request.
• Location data: not stored long-term on our servers — used only to answer the immediate merchant-search query. Cached by Apple on your device per iOS standards.
• Analytics events: retained by PostHog for up to 7 years on default plans (you can request shorter retention in PostHog project settings).
• Crash and performance events: retained by Sentry for 90 days on default plans, after which they are automatically deleted.
• Server logs: rotated every 30 days.

7. Your rights and choices

You can:

• Revoke location permission at any time in iOS Settings → Privacy & Security → Location Services → Steward.
• Revoke notification permission in iOS Settings → Notifications → Steward.
• Disable analytics — tell us and we'll opt out your device ID from PostHog collection. (A self-serve toggle is on our post-launch roadmap.)
• Request a copy of your data — email support@stewardflow.com.
• Delete your account in-app — open the App → Settings → Account → Delete Account. This permanently deletes your profile, cards, trips, and loyalty data from our servers. You can also email support@stewardflow.com with the email tied to your Apple Sign-In and we will delete your data within 30 days.
• Revoke Sign in with Apple — iOS Settings → Apple ID → Password & Security → Apps Using Your Apple ID.

California residents (CCPA/CPRA)

You have the right to know, delete, correct, and limit use of your personal information. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

EU/UK residents (GDPR/UK GDPR)

The legal bases we rely on are (a) your consent (analytics, location), (b) performance of our contract with you (providing the App's features), and (c) legitimate interest in improving the App. You have rights of access, rectification, erasure, restriction, portability, and objection. Contact support@stewardflow.com.

8. Children

Steward is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have, contact support@stewardflow.com and we will delete it.

9. Security

We encrypt data in transit using HTTPS/TLS. Our database is operated by Railway with provider-managed backups. Your Apple identifier is stored on our servers; any authentication tokens are stored in the iOS Keychain on your device. No system is perfectly secure, but we use standard industry practices and commit to disclosing breaches to affected users as required by applicable law.

10. Third-party links and data

The App may link out to issuer websites or mapping services. Those services have their own privacy policies; this policy does not cover them.

11. Beta testing disclosure

During the initial TestFlight beta (April 2026), the App may log additional diagnostic information to help us identify and fix issues. This information is used only to improve the App, is not shared with advertisers, and is deleted on the same cadence as our regular logs.

12. Changes to this policy

We may update this policy as the App evolves. Material changes will be announced in-app or via email. The "Effective date" at the top reflects the latest version.

13. Contact

Steward Technologies support@stewardflow.com