Privacy policy
Last revised November 6, 2026. This page says what BonusGPS collects, why, and what you can do about it, in plain language.
Using the planner without an account
The planner runs in your browser and on our server. The numbers you enter (state, paycheck, cash, spending, cards opened) are sent to our server to compute your plan and are not stored there. Your browser keeps them in its local storage so they are there next time; clearing site data removes them. We keep standard server logs (IP address, time, page requested) for up to 30 days to run and secure the service and to limit abuse.
If you create an account
- Email address and password. The password is stored only as a salted hash. We use the email to sign you in, to send password resets, and, if you choose reminders, to send them.
- Your planning profile and tracked bonuses, with the dates and notes you add, so they follow you across devices.
- Session cookie. One HttpOnly cookie keeps you signed in. We set no advertising or tracking cookies.
- Calendar feed. If you subscribe a calendar, it fetches your deadlines using a secret link you can rotate at any time.
Anonymous data points
When you mark a bonus as received, or record which direct-deposit source a bank counted, we add that to aggregate statistics per offer: counts and medians only. Nothing published can be traced to you, and we never show individual reports.
Who else sees data
- Email delivery. Reminders and resets are sent through an email provider, which processes your address and the message to deliver it.
- Analytics. We do not currently run third-party analytics.
- Hosting. Our server runs with a hosting provider in the United States.
We do not sell personal data, and we do not share it with banks, card issuers or advertisers. We may disclose data if the law requires it.
Retention and deletion
Account data is kept while your account exists. You can delete your account from the Tracker tab; that removes your profile, tracked bonuses, sessions and email address immediately. Backups that contain the deleted data are overwritten within 90 days. Aggregate data points stay, because they cannot be linked back to you.
Your rights
You can export your tracked bonuses as CSV from the Tracker tab, change your email and password, and delete everything. Residents of California and other states with privacy laws, and of the EU and UK, have the right to access, correct and delete their data and to object to processing. Write to us and we will respond within 30 days.
Children
BonusGPS is for adults who can open bank accounts. We do not knowingly collect data from anyone under 18.
Changes
If this policy changes in a way that matters, we will note the new revision date here and, for account holders, say so by email.
Contact: support@bonusgps.com