Capital One Mobile

"Affiliates. We may share information with companies in the Capital One family, including companies with the Capital One, Discover, DFS, Capital One Shopping, Velocity Black, Diners Club International, PULSE Network, and The Student Loan Corporation names. Business partners. We may share information with companies that we have partnered with to offer or enhance products and services for Capital One customers or prospective customers."

Capital One shares user data across a wide network of affiliates and business partners, giving users limited control over how broadly their information is disseminated within and beyond the Capital One corporate family.

"SDKs and mobile advertising IDs. Our mobile applications may include third-party software development kits ("SDKs") that allow us and our service providers to collect information about your mobile app activity. In addition, some mobile devices come with a resettable advertising ID (such as Apple's IDFA and Google's Advertising ID) that, like cookies and pixel tags, allow us and our service providers to identify your mobile device over time for advertising purposes."

Capital One uses advertising IDs, SDKs, cookies, and device fingerprinting to track users across websites, apps, and devices over time, building unified profiles for advertising purposes.

"Device data, such as your device type... general location (e.g., city, state, or country), precise location (e.g., latitude/longitude to find a nearby Capital One branch, café, or ATM)... advertising IDs (e.g., Apple's IDFA or Google's Advertising ID), and likely connections among different browsers and devices that you use."

Capital One collects both general and precise GPS-level location data from users' devices, and while it mentions ATM/branch finding as a use case, the broad collection of precise location alongside advertising IDs raises tracking concerns.

"Device data, such as your device type, web browser type and version, operating system type and version, display/screen settings, language preferences, device contacts (e.g., to facilitate Zelle payments), photos (e.g., to deposit checks), internet protocol address, mobile network information... cookie IDs, device IDs, advertising IDs... and likely connections among different browsers and devices that you use."

Capital One accesses contacts, photos, and extensive device metadata including advertising IDs and cross-device connection data, going beyond what basic banking functionality requires.

"The personal information we collect will be retained for as long as reasonably necessary for the purposes set out in this Privacy Policy and consistent with our retention policies, in accordance with applicable laws. When determining these retention policies, we take into account the length of time personal information is required to be retained to provide the services; satisfy legal and compliance obligations and for audit purposes; address any complaints or troubleshoot issues related to the services; and defend or bring potential legal claims to enforce our policies."

Capital One provides no specific retention timelines and uses broad justifications like potential legal claims and troubleshooting that could effectively allow indefinite data retention.

"We may change this Privacy Policy in the future. When we do, we will post the revised Privacy Policy on our website. This Privacy Policy was last updated and became effective on the date posted in the header of this page."

Capital One reserves the right to change its privacy policy at any time with no obligation beyond posting the update on its website — no direct notice to users or requirement for consent.