Privacy Policy

Last updated: October 20, 2026

This policy covers all information collected on the Miles website and in your conversations with Miles, on any device.

Miles is built and run by one person, Andy Assareh. This policy says “I” because there is no company.

Information I Collect

Account Information

When you create an account, I collect your email address. It is used for sign-in and account email. Cookies keep you logged in.

When email sign-in is busy, Miles may hold a sign-in email in a bounded delivery queue for up to seven days. A keyed hash of the email address and a keyed hash of the requesting IP address are kept for up to 24 hours to limit repeat requests; the admission record does not contain the email address or IP address.

If you sign in with Google, I also keep the name and profile photo link Google sends, so Miles can show your photo or your initials. The link is encrypted, replaced each time you sign in with Google, and removed when you sign in with Apple or disconnect Google.

You can give Miles a first name to call you by. That is optional, and it is the only name Miles asks for. No phone number is collected.

Conversation Data

I store every message you send to Miles and every response it gives you. That includes:

• Your questions and requests
• Miles' responses to you
• Conversation history and context
• Timestamps and usage patterns

Memory and Profile Data

Miles keeps notes from your conversations so it can remember your situation. These notes can include:

• Travel preferences: Airlines, hotels, destinations you prefer
• Spending patterns: Categories you spend in, types of purchases you make
• Credit card preferences: Types of cards you're interested in, annual fee tolerance
• Personal context: Family size, location, travel frequency
• Current goals: Card applications in progress, upcoming trips, financial goals

Household Members and Companion Devices

If you add people to your household, Miles keeps their names, which of your cards are assigned to each, and whether a person's cards count toward Which card. These are encrypted with your key like the rest of your wallet.

If you add a companion device, Miles shows you an eight-digit code that works once and expires after ten minutes. The phone that enters it can see your household's card list: each card's name, art, issuer, network, whether it is closed, and the name of the household member it is assigned to. It can ask Which card and show your widgets. What it asks (the merchant, category and amount) goes to Miles under your account, the same as your own questions. It cannot see your conversations, settings or billing, and it cannot change your wallet. It has to check in with Miles at least every 24 hours to keep showing names. Miles keeps the name you give the device (encrypted with your key), the date it was linked, when it was last used, and a one-way hash of its credential, which Miles cannot turn back into the credential. To limit code guessing, Miles keeps a keyed hash of the requesting network address for up to a day. You can remove a device in Settings. A removed device's record is kept for 30 days and then deleted, and deleting your account removes all of them.

Technical Information

The server logs basic technical information: your IP address, browser version, and usage data.

Alongside a guest conversation I keep a coarse note of where it came from, so I can tell real visitors from bots and crawlers. That note holds the city and country Cloudflare resolves at its edge, your browser version, and a one-way keyed hash of your IP address, never the address itself. The hash lets me count distinct visitors and recognize a repeat visit. It cannot be reversed into an IP, matched against any other site, or used to look you up. Nothing here is shared with anyone or used for advertising.

Cookies

Miles sets three kinds of cookies:

• Authentication cookies: Keep you logged in across sessions
• Preference cookies: Remember your display settings (e.g., dark/light mode)
• Analytics cookies: Show me how visitors use the site. They may also assign you a version of a page when I am testing two versions of it.

All cookies are first-party, set by askmiles.ai. There are no third-party tracking cookies, and no cookie data goes to advertisers.

Feedback

I collect any feedback you send me via email, which may include your name, email address, and any other information you include. Send feedback in the iPhone app and on the website opens a Google Form. What you type there goes to Google Forms, which Google processes under its own privacy policy, and I read it there.

Where Your Data Is Stored

Your account, conversations, wallet, and memory notes are stored in a database on hardware I own and control.

Your conversations, wallet, and memory notes are encrypted with a key that belongs to your account alone. Encryption happens before anything is copied to backup storage on Cloudflare R2. Deleting your account destroys the key. The security page explains how this works and where it ends.

Third-Party Services

Artificial Intelligence Processing

Your conversations, the memory notes and parts of your wallet an answer needs (such as your cards, balances, and valuations), and any spreadsheet you upload to build your wallet, are sent to third-party AI services:

• Anthropic: Generates most responses, writes thread titles, and extracts the memory notes Miles keeps for you. It also reads the contents of a spreadsheet you upload to build your wallet. Some recent answers are also graded for quality, as part of the same AI processing (see Answer checks below).
• OpenAI: Generates responses, thread titles, and memory notes when Anthropic is unavailable, and reads a spreadsheet you upload when Anthropic cannot. It also sorts each question before it is answered.
• OpenRouter: The backup route for answers, thread titles, memory notes, and the steps that read a spreadsheet you upload. It also takes the first look at a spreadsheet, to find the sheets that hold your cards. On that route, OpenRouter passes the text to the model host it picks, which can be OpenAI, Google, DeepInfra, or Cloudflare Workers AI.
• Google: A backup model for thread titles and memory notes, reached through OpenRouter.
• Ollama: Runs the web searches Miles makes when an answer needs current information. It receives only the search query Miles writes from your question; your conversation and wallet are not sent with it.

When you upload a spreadsheet to build your wallet, Miles sends it to an AI model to read it. The sheet names and a sample of rows are sent first, then the contents of the sheets that hold your cards.

Your data is stored here, not with them. Each service processes what it receives and may keep it for a limited time under its own privacy policy:

• Anthropic Privacy Policy
• OpenAI Privacy Policy
• OpenRouter Privacy Policy
• Google Privacy Policy
• Ollama Privacy Policy

Cloudflare

Cloudflare handles three things for Miles. Encrypted database backups replicate to Cloudflare R2 storage. Traffic to askmiles.ai is served through a Cloudflare tunnel, so Cloudflare handles your requests in transit. Inbound mail is routed through Cloudflare Email Routing and delivered to the Gmail account described in the Gmail section below. See Cloudflare's Privacy Policy.

Resend

Outbound account email (sign-in codes, verification links, and account notifications) is relayed through Resend. Resend processes your email address and the contents of those messages in order to deliver them. See Resend's Privacy Policy.

Gmail

Inbound mail for askmiles.ai addresses is forwarded to Gmail and stored there. Anything you write to support@askmiles.ai is held in Google's mail service. See Google's Privacy Policy.

Google Places

To find the category of a purchase you ask about, Miles looks the merchant up in Google Places. Google Places receives the merchant name and city Miles looks up, and none of your wallet. See Google's Privacy Policy.

Stripe

Payments on the web are processed by Stripe, which may receive payment information and basic technical data. See Stripe's Privacy Policy.

Apple

When you open Membership in the iPhone app, Miles issues your account a random token. If you buy Membership, Apple charges you through the App Store. Miles never sees your card details. Miles receives a signed purchase record from Apple, tied to that token. I keep the token, Apple's original transaction id, the product and plan, Membership status, Membership and trial end dates, whether renewal is turned off, whether Membership has been active, whether the purchase is live or a test, and the token creation and transaction signing dates. I keep these with your account until you delete it. The token and subscription link are removed from the live database during account deletion, and the Membership details are erased with your account data. Backup copies of the token and subscription link can remain until those backups expire, as described below.

When the Miles iPhone app can show notifications, it gives Miles a device token, the address Apple uses to deliver notifications to that phone, and Miles stores it with your account. It also gives Miles the name of your phone's time zone (for example, America/Los_Angeles), which Miles keeps with your account until you delete it so reminders arrive at a local hour. No coordinates are sent. A backup copy of the time zone can remain until that backup expires, as described below. If the app is closed before an answer you asked for on that phone finishes, Miles sends that phone one notification through Apple Push Notification service. It reads “Miles answered” and “Your answer is ready.” and carries the conversation's id so a tap opens it; nothing you asked or were told is in it. To stop these notifications, turn notifications off for Miles in iOS Settings. See Apple's Privacy Policy.

If Deadline alerts is on, Miles also sends that phone a notification through Apple Push Notification service a week before, and the day before, something in your wallet ends or posts: a card credit, a certificate, an annual fee or a card review date you set, a welcome bonus deadline, expiring points, or a transfer bonus. It names the kind of item, the credit for a card credit (for example, “CLEAR Plus credit ends”), the program for points and transfer bonuses (for example, “World of Hyatt points expire”), and the date. A deadline notification does not include card names, nicknames, amounts, balances, or anything you wrote. If you are a Member, Miles also sends one notification when a card you added at least a week earlier has no autopay recorded. That notification does not name the card. To stop these, turn off Deadline alerts in the app's Settings, or turn notifications off for Miles in iOS Settings.

If you are a Member and Deadline alerts is on, Miles also sends that phone one summary on the morning card credits reset, at the hour you choose in the app's Settings (9 AM in your phone's time zone unless you change it, from 7 AM to noon). If a morning is missed, the next summary covers up to three days. It lists up to four credits, one per line, each with the amount it is worth (for example, “Resy: $100” or “Dell: $1,000 after $5,000 spend”), and counts the rest (“+2 more”), so credit names and dollar amounts appear on your lock screen and pass through Apple Push Notification service. Monthly credits are not named unless you turn on Include monthly credits; the summary only says how many reset (for example, “+3 monthly”). The summary does not include card names, nicknames, balances, or anything you wrote. To stop it, turn off Credit reset alert under Settings > Decisions or turn off Deadline alerts in the app's Settings, or turn notifications off for Miles in iOS Settings.

If Best card changes is on, Miles also sends that phone a notification through Apple Push Notification service on the day a rotating or limited-time bonus starts or ends and that changes which of your cards earns the most for dining, groceries, gas, travel or everything else. It names the card (for example, “Dining: use Freedom Flex”), the category, the rate and the date the bonus ends. It does not include nicknames, amounts, balances, or anything you wrote. Miles does not know whether you have activated a bonus, so when one needs activating the notification says so. To stop these, turn off Best card changes in the app's Settings, or turn notifications off for Miles in iOS Settings.

How I Use Your Information

I use collected information to:

• Provide AI responses: Process your questions through AI services
• Account management: Manage your account, send account-related emails
• Improve personalization: Use conversation history and memory data to provide better recommendations
• Send notifications: Account-related email updates, and notifications on your iPhone when an answer is ready or a deadline in your wallet is near
• Process payments: Handle support payments and billing
• Improve the service: Analyze usage patterns and service performance
• Answer checks: From time to time an automated check sends Anthropic recent answers of particular kinds, each with its question and the tool results behind it, to grade their quality, as part of the same AI processing. From each run Miles keeps a list of the answers flagged, by message id, for 7 days, and totals with no content in them. I may read a flagged conversation to improve Miles, and write a test question from it in my own words. That test question keeps the conversation's id as its source.
• Estimates from other members' records: Once a day, Miles reads the statement-credit records of members who track a card and counts, for each credit on that card, how many past periods were marked used and how many were not. When you have no record of a credit, your keep-or-cancel analysis uses that share as one input to its estimate. A share is kept only once at least 30 separate accounts have tracked that credit on that card. It holds counts, not who they came from, and your own record is left out of the share used for you.
• Legal compliance: Meet legal obligations and protect my legal rights

Data Retention

Your data is not automatically deleted while your account is active. Information is retained as follows:

• Active accounts: All data is kept while your account is active
• Deleted accounts: When you delete your account through Settings, your encryption key is destroyed and the following become permanently unreadable, immediately, everywhere, backups included:
  • All conversation history
  • All AI-extracted memory and profile data
  • Your wallet and card information
  • Point valuations and preferences
  • Email address, name and Google profile photo link
  • All other account data

  What remains is the account record and the billing bookkeeping behind it: an id and timestamps, a keyed hash of your email address, the customer id the payment provider uses for billing, your monthly usage totals, a record of which account emails were sent and when, and the revoked connections to other apps. There is no name, email, or content in any of it. It is kept for 30 days so that signing in again with the same email reopens the account, empty. After 30 days the record is permanently removed, and everything listed here with it. A copy can remain in a backup until that backup expires (see Backups below).

• Connected apps: Deleting your Miles account deletes Miles' data only. If you connected another AI app to Miles through Connected Apps in Settings, anything you created there stays there, under that app's own privacy policy, until you delete it there. Disconnect and delete there separately.
• Audit logs: When you delete your account, erase your conversation history, download your data, or delete what Miles remembers, and when a deleted account is permanently removed, Miles records that it happened: the type of event, the time, and a one-way keyed hash of your account id. There is no name, email, IP address, or content in the record. The hash cannot be reversed to your account id; it can only be matched by someone who has both the id and a server-side secret key. These records are kept for 90 days.
• Shared pages: A wallet snapshot or a chat answer becomes a public page only when you click Share. The page is a copy made at that moment, published under a random link with no name, email, or account id on it. Deleting a share (or your account) removes the page; a copy may persist in an edge cache for up to a minute afterwards.
• Notification tokens: A phone's device token is kept until you sign out of the iPhone app on that phone, another account signs in on it, Apple reports the token is no longer valid, or you delete your account. An account keeps at most ten phones; the one seen least recently is removed first.
• Sent alerts: A record that a deadline or best card alert was sent (which item or day, which reminder, and when) is kept until you delete your account. It holds no card name, nickname or amount.
• Session analytics: Which pages a browsing session reads, whether it starts a chat, the country, region and city Cloudflare resolves at its edge for that session, and (if you arrived via a marketing link) the campaign tag and the referring site's domain, are kept for up to 400 days. This is stored under a random identifier in your browser's local storage or the iPhone app's storage, not a cookie, and is never linked to your account, your email, or a user id.
• Server logs: Every request to Miles is logged: your IP address, your browser's user agent, the address requested (without its query string), the response status, and how long it took. The application's own logs are kept alongside. These logs are used to keep Miles running and secure, and are deleted automatically after 30 days.
• Backups: Backups are encrypted with your key, and deleting your account destroys the key. So your data becomes unreadable in every backup already taken, the moment you delete. The backup files themselves expire from Cloudflare R2 after 7 days. Some small records are not encrypted with your key, so a backup copy of them can remain until the backup expires. For example: your settings (including the time zone your iPhone sends), the App Store purchase token and subscription link, your phone's notification tokens, records of which alerts were sent, passkey device names, and the hashes and dates of a companion device, including the hashed network addresses kept to limit code guessing. Other apps you have connected keep their own backups. See their privacy policies.

You can delete your account at any time through your Settings page, or by contacting me at support@askmiles.ai.

Data Sharing

I do not sell your personal information. In the ordinary course of business, data may be shared only as follows:

• Service providers: AI services, backup storage and network delivery, email delivery and storage, payment processing, notification delivery (each listed above)
• Aggregate statistics: Anonymous, aggregated data about service usage
• Legal requirements: When required by law, court orders, or to protect my legal rights
• Business transactions: In an asset sale or transfer of the service, user information may be transferred

Your Rights and Choices

Access and Control

• Account data: Access and modify through your account Settings page
• Data export: Download all your data in JSON format using the “Download My Data” button in Settings
• Account deletion: Permanently delete all your data using the “Delete Account” button in Settings
• Alternative: Contact me at support@askmiles.ai for assistance with data requests

For EU Residents (GDPR Rights)

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (“right to be forgotten”)
• Restrict processing
• Data portability
• Object to processing
• Lodge complaints with supervisory authorities

For California Residents (CCPA Rights)

You have the right to:

• Know what personal information is collected
• Delete personal information
• Opt out of sale (I don't sell data)
• Non-discrimination for exercising rights

Security

Security measures include:

• Your conversations, wallet, and memory notes are encrypted with a key that belongs to your account alone. That key is itself locked by a master key the application can use but never read or copy
• Deleting your account destroys your key, which makes everything encrypted with it unreadable
• Encryption happens before anything is copied to backup storage
• HTTPS for all communications
• Storage on hardware I own and control
• No passwords: sign-in uses emailed codes and passkeys
• Regular security updates and monitoring

The security page describes the full design and its limits.

International Data Transfers

Your information may be processed, stored, and used outside your country of residence, including in the United States. By using the service, you consent to these transfers. Data privacy laws vary by jurisdiction.

Children's Privacy

I do not knowingly collect information from children under 13. If you believe I have collected such information, please contact me immediately.

Contact

For privacy questions, data requests, or to exercise your rights, email miles@askmiles.ai.

Changes to This Policy

I may update this policy and will post changes here with revision dates.

Change Log: