What the Gmail connection uses.

Access and purpose

The app requests https://www.googleapis.com/auth/gmail.readonly. This permission can read messages and attachments across the connected mailbox. The app uses it to find supported financial notices, extract statement facts and show their source for review.

With collection enabled, checks can run daily while the app is closed or when you choose Refresh. Limits, connection errors or expired authorization can defer a check.

Data accessed and retained

• Your connected email address, Gmail message identifiers, sender information and message dates.
• Message bodies and supported text attachments needed to extract facts. Raw message content may be read to verify its digital signature.
• Extracted account references, statement dates, claimed amounts and short supporting excerpts, together with verification results, review choices and processing receipts.
• OAuth access and refresh tokens, which are encrypted before server storage. The app does not receive your Google password.

Collected evidence is stored separately from financial records until you approve its use. Approved facts and their references may then be included in your private app records, synchronized copies, browser storage and backups.

Processing and sharing

Google provides authorization and Gmail access. Cloudflare hosts the app’s processing and stored records. Public DNS requests used for signature checks contain signing-domain names, not message contents or OAuth tokens.

Gmail data is used for the app’s visible financial organization and source-review features. It is not sold, used for advertising or credit decisions, or used to train general-purpose AI models. If you choose to export records or use an authenticated app integration, approved financial facts may be included. Any access by another person to specific Gmail data requires your agreement, except where necessary for security or legal obligations.

Hoard & Hustle Sources’ use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Storage and retention

The app retains extracted evidence, message-processing records, account mappings and review history so that sources remain traceable and repeated checks can avoid duplicates. These records have no automatic deletion deadline.

Complete raw message bodies and downloaded attachments are processed in memory rather than saved as a mailbox archive. Temporary verification material contains extracted evidence and signature inputs. It is encrypted, becomes unusable after its 15-minute deadline, and is removed on completion, applicable failure, disconnect, or a later check. Expiry does not promise deletion at that exact moment.

Disconnect, revoke and request removal

Disconnect Gmail in the app’s Email connection settings to remove its saved access and refresh tokens and stop new access through that connection. Disconnecting preserves previously retained evidence and financial history; requests already in flight cannot be recalled.

To revoke Google’s authorization, remove the app’s access in your Google Account connections. Revoking access does not erase records already stored by Hoard & Hustle.

For removal of retained Gmail-derived records, contact davidsteinbroner@gmail.com and identify the connection or records involved. There is no self-service control that deletes all retained email history. Browser copies, exports and backups require separate attention.

About these information pages

These pages contain no signup form, analytics script, tracking pixel or Gmail connection. Connecting Gmail takes place only inside the private app.