Pointmaxx

The right card at every checkout, picked on your device. pointmaxx.ing

Pointmaxx is a personal agent for credit card rewards. It looks at the store you're about to pay, checks the cards you carry, and tells you which one earns the most. It works in three places: a Chrome extension at checkout, a text agent you can message from a store, and a web wallet. It never asks for a card number, never reads your purchase history, and sends nothing off your device without asking first.

Inspiration

Most of us carry more than one card. Experian puts the average at 3.7 active credit cards per person, out of 7.1 open (Bankrate, citing Experian). Americans put $3.6 trillion on consumer credit cards in 2024 (CFPB, Dec 2025). Cash-back cards are now the most common kind of general-purpose account. So the rewards are real money. The trouble i track of which card earnswhat, where.
The part that surprised us is that **a card's bonus depends on how the store codes the charge, not on what you're bu earns the warehouse-club rate, not an electronics rate. Amex and Chase both leave Target, Walmart, and warehouse clubs out of their grocery bonuses.pify, Stripe, or PayPal, thecharge can carry the platform's code instead of the store's. "Use the grocery card for groceries" is the wrong menta

The tools that automate this urn: a bank login through anaggregator, card numbers, or your transaction history. Meanwhile 73% of Americans say they have little or no contro their data, and 67% say theyunderstand little to nothing about it (Pew Research Center, 2023). We wanted to see how far we could get by doing the opposite: keep the reasoning on the device, ask for the least dattbound request visible beforeit happens.
Online shopping is where this decision happens most often. US e-commerce reached $1.23trillion in 2025, 16.4% of al, Q4 2025report](https://www.census.gov/retail/ecommerce.html)). Every one of those checkouts is chance to pick the right card ## What it does **For a specific user. Somecards who shops online and instores, and doesn't want to link a bank account to get help choosing.

1. At checkout, in Chrome. Open the popup on any store page. Pointmaxx reads the domain, price, and product fr's category, shows howconfident it is, and ranks your cards with the reason: "2% back on everything", "4x points on dining". You can ovick, and the fix is rememberedfor that store on your device. 2. **Automatic suggestions, p on this site" and Chrome asksyou to grant that one site. On cart and checkout pages there, the toolbar badge shows thbest rate, for example 2%. s page and sends nothing.
2. Compare prices, with consent. Click Compare and the popup shows the exact object it's about to send, such as `ress Send and our server asksthe Best Buy Products API for the same item. Results are ranked by net price: the price minus the reward your btore.
3. Text it from a store. Link your phone with a 6-digit code from the web app. Then text a store name ("which caro of the shopfront. It replieswith the card from your synced wallet and the reason, over SMS through Twilio, so it works on any phone.
4. A web wallet you control. Pick your cards once by issuer and product name. Wallet sync is off until you opt in exactly what the server holds.

How we built it

Architecture

The recommendation math

Each card $c$ has a base multrn rules. A rule $r$ has amultiplier $k_r$, a category or merchant list it applies to, store exclusions, and sometimes an annual cap. For mount $A$, the card'smultiplier is the best rule that applies, never below the base rate:

$$ k_c(m) = \max\Big(b_c,\ \max_ to } m} k_r\Big) $$

Points are converted to dollars with a value per point $v_c$. Cash back is exactly 1 cent per percent. For points, we dnt and label that assumptionin the UI, because transferable points are often worth more and the user should decide:

$$ \text{reward}c(m, A) = \frac0}, \qquad c^{*} = \arg\max{c\in \text{wallet}} \text{reward}_c(m, A) $$

On the $1,199.99 TV in our deween the right card and thesecond-best one:

$$ \underbrace{1199.99 \times 0. = \$24.00 \qquad \text{vs.}\qquad \underbrace{1199.99 \times 0.015}_{\text{Chase Freedom Unlimited}} = \$18.00 $$

Compare ranks other stores' lso a cheaper sticker price at a store where your cards earn less doesn't automatically win:

$$ \text{net}(\ell) = p_\ell - \l, p_\ell) $$

Guessing the merchant

There's no public dataset that maps a website to the merchant category code a card network will see. So `guessMed every guess carries aconfidence level the user can see and override:

1. A curated map of 115 store domains, limited to merchants whose category is unambiguous.
2. Page signals such as schema.org data and checkout platforms. Third-party checkouts drop to low confidence and salow confidence, check thecategory." 3. The user's own override, w ### The agent The text agent is a small pipace, so the messaging provideris one file:
   ts export interface Channel { parse(request: Request): Promise<Inbound | null>; // verify the Twilio signature, thenormalize reply(to: string, text: string): Promise<void>; deleteMedia?(inbound: Inboumove the photo after replying } A text goes through parse, atching, then recommend()over the synced wallet, then reply. Typed store names are matched by code against thecurated map. A photo takes onps EXIF metadata, includingGPS, then sends the image alone to Claude Haiku 5.5 with a fixed system prompt and structured output: ts const storeGuess = z.object({ name: z.string().nullable() domain: z.string().nullable(), confidence: z.enum(["high", }); The prompt asks only for the e model to ignore people,faces, plates, and other text. If no store is clear, it returns null and the bot asksfor the name instead of guess phone number, the wallet,other messages, or the card we end up picking.
   ### Testing that nothing leaks
   Privacy claims are easy to make and hard to keep, so we test them. The extension has Playwright browser tests thnd fail if any request leavesthe device without a matching user action. One test enforces the exact shape of the Compare request. The engine, tests*, including EXIFstripping, Twilio signature checks, and the link-code flow. CI runs both on every pull request. ## Why the agent model and th A personal agent is only wortwork while seeing as little aspossible. We built Pointmaxx around four rules.
   **1. Deterministic tools, one narrow model call.* The decisions that touch money, which card and how much it earns, aame way every time and can betested. The language model is used for perception only: turning a photo into a store name. That keeps answers explng") and keeps the model awayfrom anything personal.
   2. Least data, by construction. The wallet stores issuer and product names, never card numbers or last four digds to the device, and matchinghappens locally, so data flows down, not up. Amounts, merchants, pages, and overrides never sync. **3. Consent at every outboun leave the device has its ownvisible gate:
   | What could leave | The consent control | | --- | --- | | A product lookup | The payload panel shows the exact ListingQuery; nothing sends until you press Send | | Automatic suggestions on a site | Chrome's own permission prompt, one origin at a time, from your click | | Your wallet | Off until you opt in at sign-up (walletSyncConsent defaults to false) | | Your phone number | Only linked when you text a 6-digit code you got from the web app; UNLINK disconnects | | A storefront photo | Only sent if you choose to text one; EXIF and GPS are stripped first | **4. Honest about what isn't end encrypted. Twilio and thecarriers can read texts, and the bot's first reply says so. The photo goes to Anthropic's API for one request, under APning on it. The server keepsno message log beyond the current request. We'd rather show users the real tradeoff than claim a guarantee we can't ke

This is why the agent fits thivacy** track: it acts for youin two contexts, online and in a store, and each piece of personal data has one stated purpose and a control in fron ## Public data, and its limit | Source | What it powers | L | --- | --- | --- | | Issuer benefit pages | Earn sourceUrl and checkedOn |No open dataset of category multipliers exists. The CFPB card survey covers fees and but not category rates, so we| | schema.org Product data on the page | Title, price, and UPC from the tab | Some stores publish no GTIN; Compa | | Best Buy Products API | Live price for the same UPC | Results may only be cached temporarily | | Walmart Affiliate API | A second price source | Needs affiliate approval, which is still pending | | Merchant category codes | The categories our store map predicts | No public domain-to-MCC data; Visa and nt codes; marketplaces code asthe platform |
Amazon's product API now requires 10 qualifying affiliate sales in 30 days, so Amazonisn't in Compare. Each limit onfidence label, a fallback, or a missing store, not hidden behind a confident-looking answer.

Challenges we ran into

• The category is a guess, and the issuer has the last word. Card networks, not stores, decide the code at cheir own exclusions on top. Westopped trying to be certain and started showing confidence and making overrides one click.
• No data to start from. We expected a public dataset of category rates and found none, so we built a small, sorule has a URL and a date so it can be checked and updated.
• **Automatic detection withoveTab` only works after aclick, so it can't notice a checkout page byinstall was not acceptable. Wons, requested one origin at atime from a user gesture. - **Proving "nothing leaves tr tests that watch everyrequest against real store fixtures, so a prshipping.
• SMS is plaintext. Twilio gives us reacread messages. We made the boanything sensitive out of theconversation. - **Texting real users takes istration or toll-freeverification is required even for a small bo ## What we learned
  
• The merchant, not the product, decides theengine.
• A personal agent earns trust by narrowing context.
• Consent works best as a moment in the inteparagraph in a policy.
• Tests can enforce privacy promises the sam ## What's next
  
• Smarter picks: model issuer exclusionscategories and their activatiwn point values.
• Beyond the card: factor in card-level history in the browser, and ss paying for itself.
• More private reach: a local MCP serverno messaging provider in betwding once Chrome's built-inmodel runs on typical laptops, and an open, ## Built with
  TypeScript · WXT · React · Chrome MV3 · TanSshadcn/ui · Drizzle · PostgreHaiku 5.5 · Bun · Turborepo ·Biome · Playwright · Vercel
  ## Sources
  
• CFPB, The Consumer Credit Card Market (Dankingjournal.aba.com/2026/01-card-market/): $3.6 trillionpurchase volume in 2024; cash back cards areaccounts.
• [Bankrate, credit card ownership statistic/credit-card-ownership-usage-: 3.7 active cards, 7.1 open.
• [US Census Bureau, quarterly e-commerce report](https://www.census.go233.7 billion in 2025, 16.4% of retail (Q4 2025 release, March 2026). - [Pew Research Center, *How (https://www.pewresearch.org/internet/2023/10/18/how-americans-view-data-prover company data use; 67% un
• American Express, retail and supermarket definitions: superstores,convenience stores, and warehouse clubs are not supermarkets.
• [CFPB, Terms of Credit Cardnsumerfinance.gov/data-research/credit-card-data/terms-credit-card-plans-survey/): fees and APRs, no structured category rates.

Built With

• tanstack