What the Gmail connection can and cannot do.
Zenidhi asks for one thing: permission to read the card-statement mail your bank already sends you. That is a real ask and it deserves a plain answer rather than a badge, so this page states the scope, what is stored, how long it lives, and how to end it.
What we can see,
and what we can't.
- Read-onlyWe cannot send, delete or edit anything.
- Your password never reaches usYou sign in on Google's own page.
- Bank mail, not your inboxWe ask only for mail from your bank.
- Your statement stays lockedYou type the PDF password. We never store it.
- Cut us off in one clickRevoke at Google any time, without asking us.
- No affiliate moneyNobody is paying us to pick a card for you.
What we do with your data, in full: the exact permission we ask for, and what we store.
The scope, named exactly
We request Google's gmail.readonly scope. It permits reading mail and metadata. It does not permit sending, replying, forwarding, drafting, labelling, archiving or deleting. Those are capabilities we do not hold, rather than ones we hold and decline to use. There is no scope in our request that touches Drive, Contacts, Calendar or your Google account profile beyond the address you sign in with.
Google API Services limited-use disclosure
Zenidhi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: data obtained from Gmail is used only to provide and improve the rewards audit you asked for; it is not transferred to third parties except as required to run the service or by law; it is not used for advertising, retargeting or ad personalisation; and no human reads your mail except where you have explicitly asked us to investigate a problem with your own account, or where required for security or to comply with applicable law.
Revoking, and what happens next
Visit myaccount.google.com/permissions and remove Zenidhi, or tap Disconnect Gmail under Settings in the app, which also revokes the grant at Google. Either way it takes effect on Google's side immediately and does not depend on us acting, and we read no new mail. The transaction ledger and any statement files already built from your mail stay in your account, because they are your own spending record; deleting your account erases them. If you want confirmation in writing, or deletion of an account entirely, write to support@zenidhi.com or use account deletion.
The “unverified app” notice
The app is in Google's testing mode, so the consent screen shows an “unverified app” notice. Every app in testing shows it; it means verification is not yet complete, not that anything is wrong. We can't remove it until verification finishes. If you would rather wait for that, join the queueand we'll tell you when it clears.