Your inbox is yours. We only look for receipts.

• Account data — your email address, name (optional) and a salted password hash. We never store plain-text passwords.
• Gmail data (only if you connect Gmail) — with your explicit consent via Google OAuth, we read messages that match receipt, invoice, subscription and trial keywords (sender, subject, date, snippet and body). From those we extract merchant name, amount, currency, billing interval, trial status and next-charge date. We store the extracted charge records and the Gmail message ID used for de-duplication. We do not store full copies of your emails.
• Recovery data — the cancellations, refund requests, class-action claims and their status that you create in the app.
• Payment data — handled entirely by Stripe. We store your Stripe customer ID, subscription ID and plan; we never see or store card numbers.
• Technical data — IP address, browser type and basic usage logs needed to run and secure the Service.

Clawback's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We request the following Google scopes and use them solely to provide user-facing features you request:

• gmail.readonly — to find receipt and subscription emails and extract charge details, which we display to you as your "leaks".
• gmail.send — to send the nightly spending brief from your own Gmail address to yourself, only when you keep that option enabled. We never send email to anyone else on your behalf.
• openid / email — to confirm which Google account you connected.

We do not:

• Sell Google user data, or use it for advertising or building marketing profiles.
• Transfer Google user data to third parties, except as necessary to provide the feature (AI receipt parsing described below), to comply with law, or as part of a merger/acquisition with notice to you.
• Allow humans to read your Gmail data, except with your explicit permission for support, when required for security or legal reasons, or when aggregated and anonymized.
• Use Google user data to develop, improve or train generalized AI or machine-learning models.

To identify charges, the text of matching receipt emails is sent to a large-language-model provider (Anthropic Claude, via an API processor) strictly to extract structured fields (merchant, amount, interval, trial status). The provider processes the text transiently under contractual terms that prohibit using it for model training. We also use the same provider to generate refund letters, cancellation scripts and your spending brief from the extracted records.

• Stripe — payments and subscription management.
• Google — OAuth and Gmail API access you authorize.
• AI processor — transient parsing described above.
• Hosting and database providers — to store and serve the Service.
• Recovery Wall — if a refund you tracked lands, we may show an anonymized entry (first initial, merchant and amount) on our public wall. No email, name or account details are shown.

We do not sell personal information.

We keep your account and extracted charge data while your account is active. You can disconnect Gmail at any time from your dashboard or from your Google Account permissions; this immediately revokes our access and we delete your stored Gmail tokens. To delete your account and all associated data, email support@refundbot.org from your account address — we complete deletion within 30 days.

Data is encrypted in transit (TLS) and at rest. OAuth tokens are stored encrypted and scoped to the minimum permissions required. Sessions use HttpOnly, Secure cookies. Access to production systems is restricted to authorized personnel.

Depending on where you live (including the EU/UK under GDPR and California under CCPA/CPRA) you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. Contact us at the address below to exercise these rights.

The Service is not directed to anyone under 18 and we do not knowingly collect data from children.

We may update this policy. We will post the new version here with an updated date and, for material changes, notify you by email.

Clawback · support@refundbot.org · https://refundbot.org