Privacy Policy

Last updated September 19, 2026

Bob's Debit Card publishes the operator's own card purchases. Running it collects nothing about you by default: there are no accounts, no forms, and nothing to sign up for. This page explains the little that can be collected, and when.

Analytics, only if you accept

Below the list of purchases, a banner asks whether you allow Google Analytics. Nothing from Google loads until you choose Accept.

If you accept, Google Analytics 4 collects the pages you visit and how long you stay, your device and browser type, the country or region you connect from, and how you arrived. It uses first-party cookies to tell visits apart. There is no advertising, no data is sold, no name or email address is collected, and there is no tracking across other sites. Google LLC processes this data under its own privacy policy, and keeps event-level data for 2 months (Google's default, which the operator has not changed).

Your choices

Accept loads analytics and a cookie remembers that for 12 months. Decline loads nothing and a cookie remembers that for 12 months. After 12 months the banner appears again. To change your mind sooner, clear this site's cookies in your browser and reload. Browsers that send a Global Privacy Control signal (Brave, Firefox with the setting enabled, DuckDuckGo and others) are treated as Decline: no banner, no analytics. Visitors who opted out under the site's earlier opt-out setting are carried over as Decline without being asked again.

Merchant logos

The logo next to each purchase is served by Plaid from plaid-merchant-logos.plaid.com or plaid-category-icons.plaid.com. When your browser fetches a logo, Plaid sees your IP address and browser identification, as any image host does. Plaid's handling of that request is described in its privacy policy.

Server logs

Viewing the page is not logged: the site is served from a content delivery network with access logging turned off. Only "Load more" requests, which fetch older purchases from the site's API, pass through Amazon API Gateway and AWS Lambda, whose logs record the IP address, browser identification and path of each request. Those logs live in the operator's private AWS account and are deleted after 7 days.

Stored on your device

Your Accept or Decline choice is a cookie. Whether you left the spending panel open and which period you picked are kept in your browser's local storage. None of this leaves your device.

Cookies this site sets

Contact

Questions about this policy can be sent to raparks@icloud.com.