Card Spend privacy policy

Last updated 4 October 2026

Card Spend shows your credit card spending in one place. It works from the bank alert emails you choose to forward to it. This page explains what that means for your data.

What we receive

• Your email address and password, to sign you in. Passwords are stored hashed by our authentication provider; we never see them.
• Bank alert emails you forward to your private Card Spend address. You decide which emails are forwarded using a Gmail filter; the app shows the exact list of sender domains it uses.

What we keep

• From each alert: amount, merchant, date and time, the card's last four digits, the available credit limit, and the UPI reference when present.
• From statement emails: the statement period, total due, minimum due and due date.
• From bank-account and FASTag emails you forward: amount, date, the payee or payer as the bank names them, the account's last four digits, and whether money went out or came in. Payments to your own accounts, card bills and investments are recorded as transfers and never counted as spending. Bank spends count in the app only if you turn on "Include bank account spends" in Settings. Money coming in (for example interest or salary) is stored but not shown in the app.
• The categories you assign to payees.

The email itself is kept for 12 hours after it has been read, so that a failed or incomplete read can be retried, and is then deleted. Emails that could not be processed at all are deleted after 3 days. If a bank email can't be read, a short excerpt (with long numbers masked) is kept for up to 14 days so support for it can be added, then deleted.

What we never do

• We never access your mailbox. There is no Gmail sign-in and no token to your email account; only the emails you forward reach us.
• We never receive full card numbers, CVVs, OTPs or passwords. Emails with OTP or verification codes in the subject are excluded by the filter.
• We don't sell or share your data, and we don't show ads.

Where it's stored

Data is stored with Supabase in the Mumbai (ap-south-1) region. Each account can only read its own data.

Deleting your data

In the app, go to Settings → Delete account. This permanently erases your account and all of its data immediately. You can also stop forwarding at any time by removing the Gmail filter.

Contact

Questions: harnoor992@gmail.com