Trust
Security
Pointless reads your Amazon orders so you can see your own habits and choose what brands see. This page lists what we do today to keep them safe, in plain words.
Your data
Encrypted for each person
Every account's orders are sealed with AES-256 under a key of its own. A copy of the database alone is unreadable.
The master key stays off the database
Each person's key is locked by a master key that lives only on our server, never next to the data.
Delete means delete
Start over removes your orders and settings from our database right away. Encrypted backups roll off within two weeks.
Encrypted in transit
Every page and API call goes over HTTPS.
Encrypted backups
One a night, in private storage. We keep the last 14.
Lookups without the email
We find your account by a keyed fingerprint of your email or Amazon login, not by the address itself.
Your Amazon sign-in
We never keep your password
It goes to Amazon over a secure session. It is not saved or logged.
The session closes
When the read is done, the Amazon session ends. To refresh, you sign in again.
Logs leave out the private parts
Error logs strip passwords, codes, cookies, emails, phone numbers and addresses.
What brands see
Counts, in groups of 3 or more
A brand never sees one shopper, and never a name, email, address or phone.
Private areas stay private
Pregnancy and fertility, sexual wellness, medication and conditions, mental health, and gender and identity are left out.
Hide anything
Hide an order, item or category and it leaves every count right away. See what a brand sees on your Privacy page.
Signing in and keys
One-time sign-in links
Each link works once and expires in 15 minutes.
Limits on guessing
Too many wrong sign-in tries and we pause that address for 15 minutes.
Keys we can't read back
We store only a fingerprint of each assistant or API key, never the key. Assistant keys are read-only and see only your own orders.
Our servers
Closed by default
Our servers only accept web traffic and our own team's access. Everything else is blocked.
Test and live are apart
The demo and test sites run on a separate server from the live one, with sample data.
Watched every minute
An uptime check runs every minute and alerts the team when something is down.
Who helps us run Pointless
Each provider gets only what its job needs. We don't sell your personal information.
| Provider | What for |
|---|---|
| Oracle Cloud, Supabase | Hosting and storage, encrypted |
| Resend, Twilio | Email, and texts you signed up for |
| PostHog, Logfire, Sentry | Usage counts and error logs, with emails and phone numbers removed |
| A residential network provider | Carries the Amazon sign-in so it comes from your state |
Found a problem?
Write to hello@joinpointless.com. A person reads every message. For what we collect and how to delete it, see the privacy policy.
We don't hold certifications such as SOC 2 yet. This page says what is true today and changes when that does. Last updated November 4, 2026.