đĄī¸ Privacy by Design âĸ 100% On-Device
LiftSavings Privacy Policy
At LiftSavings, your privacy is our primary engineering requirement, not an afterthought. We built LiftSavings
with a zero-knowledge, on-device architecture so you never have to trust anyone with your financial credentials.
đ
Effective Date: October 31, 2026
âĸ
đ Version 1.2 (CCPA, GDPR & Google Limited Use Compliant)
đ
Zero Password Storage
We never ask for, view, intercept, or store your banking usernames or passwords.
đž
100% On-Device Storage
Your discovered merchant discounts are stored securely in your browser's private
database.
âī¸
Isolated Drive Sync
Optional cloud backup uses Google Drive AppData folder only, with zero access to
your files.
đĢ
No Ads or Data Brokering
We never sell, rent, or monetize your personal information or financial activity.
To eliminate any risk of data exposure or credential leaks, LiftSavings is intentionally architected so that
sensitive financial data cannot reach any remote server:
- No Banking Credentials: We never collect, process, or transmit your online banking
usernames, passwords, PINs, security challenge questions, or multi-factor authentication (MFA) tokens.
- No Card Numbers or CVVs: We never capture or store full 16-digit credit card numbers, CVV
security codes, card expiration dates, or bank routing/account numbers.
- No Transaction History: We do not track your banking transactions, account balances,
paychecks, or personal spending habits.
- No Credit Score Inquiries: LiftSavings does not query or interact with consumer credit
reporting agencies (Experian, Equifax, TransUnion).
â
How it works: You log in to your official bank portals (American Express, Chase, Bank of
America, Citibank, Capital One, U.S. Bank, or Wells Fargo) directly through your own browser. The LiftSavings
extension only parses the merchant promotional offers (e.g. "$10 back on $50 purchase") made
available to you on that page.
When you visit your credit card rewards dashboard with the LiftSavings browser extension installed, the tool
reads
promotional merchant discounts and saves them exclusively to your browser's local on-device
storage:
- Merchant Offer Metadata: Merchant name, promotional headline, discount terms, category,
offer expiration date, and enrollment status (Enrolled vs. Available).
- Card Isolation Identifiers: The masked last 4 digits of your card (e.g.,
Card âĸ4012) are stored solely to distinguish between multiple cards in your wallet and prevent
duplicate activations.
- User Preferences: Custom delay intervals, auto-enrollment toggles, and sorting options.
This information remains 100% on your local computer or phone. It is never uploaded to any LiftSavings server.
LiftSavings provides an optional feature allowing you to synchronize your saved offers between multiple personal
devices (e.g., laptop and desktop). This feature utilizes your personal Google account.
Requested Google OAuth Scope:
| OAuth Scope |
Purpose |
Access Boundary |
drive.appdata |
Stores your offers library in an encrypted private JSON file. |
Strictly restricted to the isolated AppData folder. LiftSavings has zero
access to your personal files, Google Docs, photos, or emails. |
userinfo.email |
Displays your signed-in identity avatar in the top navigation bar. |
Read-only basic profile. Never shared with third parties. |
âšī¸
Google API Services User Data Policy Compliance:
LiftSavings' use and transfer to any other app of information received from Google APIs will adhere to the
Google API Services User Data Policy,
including the
Limited Use requirements. We do not use Google user data to serve
advertisements, train machine learning models, or sell to data brokers.
In accordance with Google Chrome Web Store Manifest V3 guidelines, we follow the principle of least privilege.
Here is why each permission in manifest.json is required:
| Permission |
Why We Request It |
storage |
Stores local user settings (such as enrollment speed delays and filter preferences) on your device. |
activeTab / tabs |
Detects when an active tab belongs to a supported bank portal (e.g. Chase Offers or Amex Offers) so you
can trigger one-click synchronization. |
identity |
Enables secure, native Google Sign-In for Google Drive cloud sync. |
sidePanel |
Allows you to open the Offers Hub inside Chrome's native browser side panel. |
alarms |
Schedules lightweight background checks to update the extension badge icon when new deals are
discovered. |
scripting |
Executes the in-page offer parsing script on authorized bank domains only when you initiate
synchronization. |
When you choose to participate in the LiftSavings Referral Marketplace (sharing or unlocking referral links):
- Masked User Identity: To safeguard privacy, public referral listings show only your masked
name (e.g.,
Alex W.) and public referral link/code. Your full email address is never published to
other users.
- Lift Points (LP): Lift Points are internal anti-spam rate limiting tokens. They possess
$0.00 cash value and cannot be traded, sold, or redeemed for currency.
- Error Reports & Moderation: If a user reports an invalid referral code, our administrator
panel reviews the submission solely to maintain inventory quality.
Because data is stored on-device, you maintain total sovereignty over your information at all times:
- Instant Deletion: Clicking "đī¸ Clear All" inside the Offers Hub immediately
purges all stored offers, cards, and cache from your browser's local wallet.
- Clear Expired: Clicking "â° Clear Expired" automatically purges deals that have
passed their valid redemption date.
- Drive Backup Deletion: You can delete your backup file directly from your Google Drive
AppData storage or by clicking "Sign Out" in the extension.
- Uninstalling the Extension: Removing the LiftSavings extension instantly purges all local
storage and isolated cache maintained by the extension.
Under California Consumer Privacy Act (CCPA) and General Data Protection Regulation (GDPR), you have the right
to
access, rectify, or delete any information we hold. Since we store zero personal identifiers on remote servers,
clearing your local browser storage completely fulfills data erasure requests.
We employ standard modern cryptographic protocols:
- All network transmissions to Google APIs and the LiftSavings website use HTTPS (TLS 1.3).
- Extension content scripts execute in isolated sandboxed contexts preventing third-party script injection.
- We conduct regular vulnerability audits of our open codebase.
If we make material updates to this Privacy Policy, we will post the revised terms on this page with an updated
effective date and notify users through an extension update notification.
If you have any questions, feedback, or inquiries regarding this Privacy Policy or our on-device security model,
please contact our privacy team:
