What the Gmail connection can and cannot do.
Zenidhi asks for one thing: permission to read the card-statement mail your bank already sends you. That is a real ask and it deserves a plain answer rather than a badge, so this page states the scope, what is stored, how long it lives, and how to end it.
What connecting Gmail gives us —
and what it doesn't.
Read-only, at the scope level
We ask Google for read access and nothing else. Sending, replying, deleting and editing aren't permissions we hold — not ones we choose not to use.
Your password never reaches us
You sign in on Google's own servers. We receive a token scoped to reading mail, and never see the credentials you typed.
We fetch statement mail, not your inbox
The sync queries for the issuers' statement senders and subjects. Correspondence that isn't a card statement isn't what we ask Google for.
Revoke in one click, on Google's side
myaccount.google.com/permissions removes our access without asking us, whether or not you tell us first.
Revoking deletes what we parsed
The transaction ledger built from your statements goes when the connection does. There's no archived copy that outlives your consent.
No affiliate money, anywhere
We aren't paid when you take a card. Nothing in the model has a stake in which card wins, which is the only way the answer can be worth reading.
The scope, named exactly
We request Google's gmail.readonly scope. It permits reading mail and metadata. It does not permit sending, replying, forwarding, drafting, labelling, archiving or deleting — those are capabilities we do not hold, rather than ones we hold and decline to use. There is no scope in our request that touches Drive, Contacts, Calendar or your Google account profile beyond the address you sign in with.
Google API Services limited-use disclosure
Zenidhi's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: data obtained from Gmail is used only to provide and improve the rewards audit you asked for; it is not transferred to third parties except as required to run the service or by law; it is not used for advertising, retargeting or ad personalisation; and no human reads your mail except where you have explicitly asked us to investigate a problem with your own account, or where required for security or to comply with applicable law.
Revoking, and what happens next
Visit myaccount.google.com/permissions and remove Zenidhi. That takes effect on Google's side immediately and does not depend on us acting. The transaction ledger built from your statements is deleted with the connection; if you want confirmation in writing, or deletion of an account entirely, write to support@zenidhi.com or use account deletion.
During the beta
The app is in Google's testing mode, so the consent screen shows an “unverified app” notice. Every app in testing shows it; it means verification is not yet complete, not that anything is wrong. We can't remove it until verification finishes. If you would rather wait for that, join the queueand we'll tell you when it clears.