How your data is handled

Security & privacy, explained plainly.

PerkMind is built device‑first: your account and wallet stay on your iPhone unless you explicitly connect a bank through the sync feature. Here's exactly what that means.

1

App‑lock by default

PerkMind starts locked on every launch. You unlock with your email and password, Face ID / Touch ID / Optic ID, or a registered passkey.

2

Salted, hashed passwords

Registration generates 32 random bytes as a salt; your password is stored only as SHA‑256(salt + password). The plain password is never saved.

3

Keychain‑backed storage

Your account and wallet cards are stored as Keychain items with kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly accessibility — device‑local, not exportable, and unreadable before first unlock.

Wallet cards

What PerkMind will — and won't — ever ask for

PerkMind's wallet is built around display‑safe metadata, not payment credentials. It's designed so a data export or device compromise can't expose a usable card number.

✓
Card name, issuer, network, and reward type

Used to power recommendations and the card art display.

✓
Optional last four digits

Validated as exactly four numeric digits — used to match synced transactions to the right card.

✕
Full card number

Never requested. If you use card scan to fill the form, the full number is processed only in memory and never persisted.

✕
CVV or PIN

Never requested, never stored, never transmitted.

Biometrics & passkeys

Sign in without typing a password

Biometric unlock and passkeys are opt‑in per account, and both are backed by Apple's system frameworks rather than a PerkMind‑built credential store.

  • Face ID / Touch ID / Optic ID unlock uses Apple's LocalAuthentication framework.
  • A failed or canceled biometric attempt always falls back to email and password — it never locks you out.
  • Passkeys use Apple's AuthenticationServices platform credential APIs.

Current passkey sign‑in matches a locally stored credential identifier. Full production‑grade passkey verification additionally requires a server‑issued challenge and a registered relying‑party domain — noted here for transparency about where the implementation stands today.

Financial sync

Your bank credentials never touch this app

When you connect an account, PerkMind talks to a configured backend service — never directly to your bank or card‑network credentials on your device.

  • The app sends only a user identifier and, if configured, a bearer token to the backend.
  • The backend, not the phone, holds any bank‑linking access credentials.
  • Transactions are matched to your wallet by comparing the account's masked digits to your card's last four — unmatched transactions are excluded from reward calculations.
  • Synced transaction data is cached locally with the same Keychain accessibility as your wallet.
In plain terms

What we want you to know

PerkMind's reward, benefit, and credit figures are estimates generated from catalog data and your synced transaction history — not a live feed from your card issuer. Always confirm reward terms, statement credit balances, and benefit eligibility directly with your issuer before relying on a number PerkMind shows you.

There is currently no multi‑device cloud account — PerkMind is designed around a single local device user. If you'd like more detail on any part of this page, or you're evaluating PerkMind for an organization and need a written security summary, reach out from the Support & Contact page.