Inspiration

Loyalty points are one of the largest unregulated currencies in the world — three US airlines alone carry over $25 billion of points liabilities on their balance sheets. The issuers manage that liability the way you'd expect: award charts reprice, transfer ratios get cut, redemption rates retire — disclosed in terms updates and blog posts, never in a push notification. The market has optimized one side of the trade: dozens of apps tell you how to earn points. Almost nothing watches the other side, where the value actually leaks. Mapping the space on two axes — earn vs. redeem, reactive vs. proactive — exposed an empty quadrant: proactive advice on using points. That quadrant is currently served by newsletters and hobbyist vigilance. A monitoring problem being solved by hand is an engineering opportunity.

What it does

Rory tracks your card points and loyalty balances and tells you when to act. It answers the daily question — which of your cards to use for this purchase — from the cards you actually hold, with no affiliate incentive shaping the answer. And it does the thing nothing else does: it watches the published record for value-destroying events — transfer-ratio cuts, award chart changes, expiring rates, deferred-interest deadlines — and turns them into dated, personal math: "your points buy 25% less after Sep 30; here's the one move." An AI concierge explains any program's fine print and will tell you when a deal isn't one.

How we built it

React Native/Expo on iOS, Supabase backend, on-device OCR for balance capture. The interesting architecture is the data plant: a weekly automated scan across ~20 programs and the points press drafts a structured opportunities database; a monthly refresh re-verifies a corpus of program dossiers; every claim carries a source and a verification status. Nothing reaches the app, the AI concierge, or our marketing without a citation in that corpus. The code itself is written by AI coding agents under direction — one brief per commit, eval fixtures for every bug class, on-device testing as the release gate. AI writes the code; the engineering discipline is the product of experience.

Challenges we ran into

There is no API for points balances, and the industry workaround — holding users' banking credentials — is a liability and a trust failure. We inverted the constraint: no login, no bank link, balances on-device. Balances and offers are captured by screenshotting a banking app; any card number in the capture is redacted before any parser sees it. Making that scanner reliable across issuers' wildly inconsistent screens — logo-only headers, percent yields adjacent to balances, cash-vs-points ambiguity — took a layered validator, program fingerprinting, and a rule we now consider doctrine: when attribution is uncertain, the system asks the user rather than guessing.

Accomplishments we're proud of

A privacy architecture that turns the missing API into the selling point. A release gate that scans every build — JavaScript bundle, Hermes bytecode, and the native binary — against a live control set to prove no real account data ever ships. And a correction loop that works: a published claim was downgraded by our own monthly fact-check, re-verified against issuer-attributed sourcing, and reinstated within a day. The database that powers the app also polices our marketing.

What we learned

AI-directed development holds up under production discipline, not instead of it. The failure mode isn't the model writing bad code — it's the model being starved of context. Our worst bugs were projection layers silently dropping data the system already had. The fix is the same as it's been since the mainframe era: trace the data path end to end, then fix it at the source.

What's next for Rory

Rory and Rory Premium are live on the App Store now. Next is listening: our first subscribers' feedback decides what gets built, and the weekly scan keeps every opportunity current.

Built With

Share this project:

Updates

Submission history