01 / Summary
What data is handled, and why
Points Tracker handles user data to show and maintain a rewards ledger. It checks the current URL and extracts only supported fields from an enabled provider account page, and accepts values you enter manually. A few site readers use specific account fields embedded in the page as well as visible page elements; Points Tracker does not save a full page or raw HTML. Passive capture can run when you visit an enabled account page; an explicit Refresh opens the provider’s official page. Both wait until the local vault is unlocked.
The extension extracts supported balances, member numbers, and expiration details for the ledger. It does not retain browsing history or upload rewards records to the publisher, a project server, or an analytics provider. Version 2.2.0 adds separate records for up to four people in one local vault; one vault credential unlocks all of them.
02 / Local data
Local data and encryption
The saved rewards ledger is encrypted with a local PIN and stored in chrome.storage.local in the current Chrome profile. Lock when Chrome closes is on by default. While the vault is unlocked, usable key material remains in Chrome session storage and is cleared when Chrome restarts or the extension is reloaded, updated, or disabled. If you turn that setting off, the usable key is saved in trusted extension storage in this Chrome profile so access can resume after those events. The saved key and encrypted ledger are sufficient to decrypt the ledger without the local PIN or an older vault's text passphrase. Those credentials are used to derive the encryption key and are never saved by the extension. Existing vaults created with text passphrases continue to use those credentials. The encrypted ledger contains:
- User-entered person names and account ownership.
- Each person’s program selections and rewards accounts.
- Program-level rewards balances.
- Loyalty member numbers where the supported row uses one.
- Supported expiration dates, months, amounts, or status notes.
- Values and expiration details you enter manually.
- Per-account expiry reminder delivery history.
- Authenticated recovery data for protected manual values.
These records, including person names, account ownership, program selections, and reminder history, are encrypted in the local vault. The optional desktop-reminder preference and Chrome notification permission are stored separately in this Chrome profile. Credit-card rows store only the supported program-level total. Chase stores a combined total rather than per-card balances. Southwest Flight Credits stores a combined amount and earliest supported expiration, not individual credit details.
While a refresh is active, trusted Chrome session storage also holds a temporary checkpoint with its owned tab, grouped-row progress, original deadline, unlock session and ledger version that authorized it, plus any manual value you confirmed replacing. This lets the refresh resume if Chrome suspends its background worker. The checkpoint contains no raw page content or plaintext ledger. It records if the refresh is waiting for sign-in or verification, without saving credentials. The checkpoint is removed when the refresh completes, expires, or its tab closes. Session storage clears when Chrome restarts or the extension is reloaded, updated, or disabled.
03 / Excluded data
Information the extension does not collect
- Airline, hotel, or card-provider usernames or passwords.
- Provider cookies, authentication tokens, or session credentials.
- Rewards-provider member names, mailing addresses, or profile details.
- Card numbers, card details, or individual card balances.
- Transaction history or individual Flight Credit details.
- Saved copies of full account pages, HTML, or screenshots.
- A browsing-history log or saved page content unrelated to the supported ledger fields.
- Advertising identifiers, analytics, or telemetry.
The local PIN is entered to set up or unlock a new vault. The extension uses it on-device and does not save it. If you turn off Lock when Chrome closes, the usable key is saved locally; someone with both that key and the encrypted ledger can decrypt the ledger without the local PIN or an older vault's text passphrase. Existing vaults created with text passphrases remain unlockable with those passphrases. Neither credential is sent to a rewards provider.
04 / Connections
Network activity
Guide opens the public first-refresh instructions. Report opens your email composer with a fixed support address and subject; it attaches no rewards records, logs, or diagnostics. You write and send any message yourself.
Official rewards sites
The extension’s page reader runs only on supported rewards-site hosts. It processes the page URL and extracts selected fields from supported account pages. A few readers use specific embedded account fields as well as visible page elements. Sign in directly on the provider’s website. Points Tracker does not intercept network traffic or copy provider authentication material.
Extension updates
Chrome manages updates for Chrome Web Store installations. The extension does not poll GitHub or use a separate update service.
This website
Cloudflare Workers Static Assets serves this website at solewcl.com. Cloudflare may process ordinary connection information, such as your IP address and request metadata, to deliver and secure the site under its privacy policy. The website adds no rewards-data service. This website traffic is separate from the extension: your rewards ledger stays in this Chrome profile, and the extension does not send it to Cloudflare or the publisher. Links to rewards providers take you to those sites, which apply their own privacy practices.
Website advertising and privacy choices
This website loads Google AdSense to support website advertising and regional privacy messages. Google controls whether ads are served; ads may not appear while the site is under review. The Chrome extension contains no ads or advertising code and does not send its rewards ledger to Google or advertising partners.
For website advertising, third-party vendors, including Google, may use cookies and other identifiers to serve ads based on your visits to this website and other websites. Google and its advertising partners may process your IP address, browser and device information, page visits, and ad interactions to deliver, personalize, and measure ads and prevent fraud. These advertising services do not receive the extension’s local vault, PINs, rewards balances, or provider credentials from us.
Google’s regional privacy messages let eligible visitors consent, refuse, manage consent options, or opt out of advertising data uses. In the EEA, UK, and Switzerland, use the Privacy and cookie settings link at the bottom of the page to revisit your choice. In supported US states, use Do Not Sell or Share My Personal Information to open the advertising opt-out dialog. These links are provided by Google where applicable. If privacy controls do not load, check your browser’s content-blocking settings or contact support@solewcl.com. Choices for website ads do not change the extension’s local storage.
Read how Google uses information from sites that use its services. You can manage Google personalized advertising through My Ad Center and find choices for participating third-party advertising vendors at YourAdChoices. Browser cookie controls provide additional choices, but blocking cookies does not necessarily stop all advertising data processing.
06 / Control
Retention and deletion
Your current rewards ledger remains in this Chrome profile until you update or replace its values, import another valid backup, or remove the extension. You can change the local PIN under Setting → Other in 2.2.0 by confirming the previous credential. The ledger and locking preference stay intact, and existing backup PINs stay unchanged. Forgotten credentials cannot be recovered. Clearing ordinary browser cache or history does not remove chrome.storage.local data. Removing the extension removes its profile data; export a backup before uninstalling if you want to keep your ledger.
In version 2.2.0, removing a person requires confirmation and removes that person’s saved rewards records from the encrypted vault. P1 is protected. Older ledgers and ownership-free backups are assigned to P1 when upgraded or imported.
When an older plaintext ledger or encrypted local copy remains from an earlier release, Points Tracker verifies the current encrypted ledger before removing the obsolete copy. It does not restore older records into the current ledger. If the current ledger cannot be verified, older copies are left in place. If a plaintext copy is invalid or a removal cannot be confirmed, the popup reports that cleanup can be retried.
Hiding a program row in Manage does not delete its saved value for that person. Re-enabling the row restores it to that person’s ledger.
07 / Backups
Local export and import
Export creates an encrypted JSON file on your device. A backup passphrase of at least four characters protects the file; it may contain text, and every export uses fresh encryption data. It is separate from the local PIN, though you may choose the same value if it meets both requirements.
Import requires an already-unlocked destination vault and the encrypted file’s backup passphrase. Points Tracker validates the file and its ledger before replacing the current records, then encrypts them under the destination vault PIN. Existing vaults continue to use their original text passphrase. Older valid plaintext backups can be imported without a backup passphrase and are encrypted when saved. Import does not change the local PIN or modify the selected file. No backup file is uploaded by the extension.
The local PIN and backup passphrase have separate roles; you may choose the same value when it meets both requirements. Lost credentials cannot be recovered. A known encrypted backup can restore into a newly configured vault; a lost backup passphrase makes that file unusable. Historical plaintext backup files are left untouched.
08 / Data use
Limited Use
Points Tracker uses rewards data only to provide its single purpose: showing and maintaining your local rewards ledger. The extension does not sell the data, use it for personalized advertising, or transfer it to the publisher or another rewards-data service. It does not make the ledger available for human review. Any data you choose to share with support is outside the extension’s local storage; please do not send balances, member numbers, passwords, or private account-page screenshots.
Use and transfer of information handled by Points Tracker are limited to providing or improving that user-facing feature, complying with applicable law, protecting the extension and users from abuse or security issues, or other cases you explicitly authorize. The extension has no rewards-data transfer path to exercise these exceptions in ordinary use.
09 / Contact
Publisher, support, and policy changes
Material privacy changes will be reflected on this page. The effective date above identifies the current version of this notice.
Points Tracker is published by wclsole inc. For privacy questions or support, email support@solewcl.com. Do not send account numbers, credentials, balances, or screenshots of private account pages.
Points Tracker is an independent project and is not affiliated with or endorsed by any supported airline, hotel, card issuer, or loyalty program.