We measure the traffic, not you.

If you sign up for the weekly digest, we store your email address and nothing else — no name, no card list, no reading history, and never anything you typed into the calculator or the portfolio tracker. It lives in our own database on Cloudflare (the same infrastructure that serves this site), alongside the date you signed up, whether you asked for instant devaluation alerts, and the confirmation status below. We do not run a customer-data platform, and there is no profile attached to the address.

Double opt-in, always. Entering an address only creates an unconfirmed row and sends exactly one email asking you to confirm it. Nothing else is ever sent until you click that link — which is what stops anyone typing a stranger's address into the box and signing them up. Don't confirm, and the address simply never receives another word.

One-click unsubscribe, in every single email. No login, no "are you sure", no survey. When you leave we keep the address on a suppression list rather than deleting it, so a later signup form or an imported file can't quietly put you back — that record exists to keep mail away from you, not to send it. Want it erased outright? Ask the desk and it goes.

We never sell, share, rent or syndicate the list — not to issuers, not to advertisers, not to anyone. The only third party that ever touches your address is the email provider that delivers the mail on our behalf, because someone has to hand it to your inbox. The emails carry no tracking pixel and no click-wrapped links: we do not measure who opened what, which is also why we will never email you to ask why you didn't.

A few pages — the wallet winner, the lounge map, the transfer optimizer, the portfolio score and the transfer desk — remember which cards you hold so they can answer for your wallet instead of the whole catalogue. That list normally lives in this browser and dies with a cleared cache. Signing in with Google is how you make it follow you to a second device, and that is the only thing it does. Nothing on this site is behind it: skip it and every page works exactly as it did.

What we store, in full: your Google account's email address, the name on that account (as Google states it, trimmed and clamped — it greets you on your desk and appears nowhere else), the identifier Google gives us for that account, and your list of card slugs (literally strings like axis-atlas) with the time it last changed. If you opt into instant alerts, one more ledger row per alert we actually mail you (your address and which event it was — that is how "at most one a day" is enforced). That is the entire record. No profile photo, no reading history, no spend, no balances, and nothing typed into any calculator. We ask Google for the email and profile scopes and nothing further — no access to your Gmail, Drive, contacts or anything else, and we never post anywhere on your behalf.

If you file a data point. Two forms take facts we cannot compute — when a transfer landed, what a bank offered to keep you. Filing one needs an account, because every count we publish prints its contributors beside its reports and that sentence needs distinguishable people. What is stored is the report itself — a route or a card slug, the dates, the numbers, a fixed category — and, instead of your account, a one-way hash of it. That hash is why a published count can say "4 contributors" without the table holding anything that points back at you. The one free-text box on each form is read by the desk and by nobody else: it is never returned by any endpoint and never rendered anywhere. Delete your account and your reports go with it, in the same batch as everything else — which also means they leave the published counts.

Two cookies, both ours, and neither is a tracker. Signing in sets __Host-tw_session — an HttpOnly, Secure, SameSite=Lax cookie that carries only your account identifier, a session id and an expiry, signed so it cannot be forged, and valid for at most 30 days. It is never read by analytics, carries nothing about what you browse, and is sent only to this domain. Signing out revokes the session on our server — not just in your browser — so a copied cookie dies with it. During sign-in, which has to leave the page and come back, we also set tw_return for ten minutes: it holds the path of the page you came from, so your desk can offer the way back. That is its entire contents, and it expires the moment you return.

Where Google's script loads. There is a "Sign in" control in the header of every page — that is how you find this feature at all. It is inert HTML until you click it: Google's sign-in library is fetched when you open it, and never on page load. The exception is the handful of pages listed above, where a saved deck is what the page is for and Google's One Tap may appear on arrival. On an article, a news post or a card page, nothing of Google's runs unless you ask for it. Once it does run it may set cookies on google.com under Google's terms — that part is between you and Google.

Leaving. Sign out and the browser stops syncing; your cards stay on the device, because losing your deck for clicking "sign out" would be an absurd punishment — and signing out also revokes the session on our server, so a copied cookie dies with it. Deleting the account outright is self-serve, at the foot of your desk: it asks you to type the phrase and to confirm with Google once more (an irreversible action deserves a fresh proof it is you), then one batch removes everything — cards, profile, session rows (not a "revoked" flag, which would keep the identifier), the newsletter row, the alert ledger, and any data points you filed. If you were subscribed we keep a one-way hash of the address so nothing can ever quietly re-add it to a mailing list; it cannot be turned back into who you were. Signing in again afterwards starts a fresh, empty account. Signing in also does not subscribe you to anything — identity and consent to be emailed are separate facts, and we keep them that way.

The calculator, deck planner, portfolio score, points tracker and the lounge map's "my cards" mode all run entirely in your browser. Your spend profile, the cards you hold and your points balances are computed in the open tab and, where a tool remembers anything at all, saved to this browser's localStorage on this device — never uploaded, never logged, never seen by us. The one exception is the card list itself, and only if you deliberately sign in to sync it; the spend numbers and the balances never leave, signed in or not.

The score and portfolio pages offer share links. Those work by encoding your inputs into the URL itself — your data travels only if you copy that link and hand it to someone. Clearing your browser data erases everything these tools know.

Everything on this site — every ranking, verdict, valuation and ₹ figure — is editorial opinion built on published card terms, not financial, legal or tax advice, and not a recommendation to apply for, keep or cancel any product. Our math assumes a standard spend profile; yours is different, and a card that is a Keep for the model can be a Cancel for you.

Verify with the issuer before acting. Fees, earn rates, transfer ratios and lounge access change without notice — issuers nerf cards for a living, which is why the devaluation tracker exists. The issuer's current MITC and T&C are the only documents that bind them; if this site and the issuer's paperwork ever disagree, the paperwork wins, and we want to hear about it.

We hold no position in any issuer, take no affiliate commissions and carry no advertising — see the desk for the full stance.

You are welcome to quote this site's numbers, verdicts and charts — with attribution to travelwith.cc and a link to the page you're citing. Our own facts are built on issuers' published documents and community sources, each cited where used; the curated data and code behind the site are version-controlled, and every correction is a dated commit. Please don't republish wholesale or strip the sourcing — the citations are the product.