I went through their privacy agreement and personally speaking, I'm not too comfortable with them when Location and Device data is part of their data collection, as these doesn't seem to be necessary for them to provide the service.

There are also a couple of other clauses that I find concerning with their data sharing agreement:

• With third parties who may access data about you to provide you with the Services;
• In Connection with, or during the negotiation of, any merger, sale of company stock or assets, financing, acquisition, divestiture or dissolution of all or a portion of our business;

My problem with the first clause is that it's too vague. From my interpretation, they can potentially sell your data to any third part as long as they can make the argument such data is necessary to provide you with the "Services"

The problem with second one is in the case of this company getting bought out. Even if we trust that they are currently a privacy respecting and trustworthy entity, there is no guarantee that in the case of a future buyout the buyer is equally trustworthy (e.g. what if Intuit buys them?). With the amount of data that they know about you (e.g. spending behaviour, device / location info, government IDs etc.), this could be extremely detrimental to your data privacy in the long run.

Now whether this is the lesser evil vs giving your payment info to websites is a judgement everyone needs to make. I steered away from it because I think it consolidates too much of my online purchasing habit into one place, and it's a risk on top of all the info I already provide to my banks. I can definitely see merit if you're using one throwaway card with low credit limit on this service or using it to make purchases on websites that you don't frequent.