What the Gmail connection can and cannot do.
Zenidhi asks for one thing: permission to read the alert and card-statement mail your bank already sends you. We search only for that mail, never the rest of your inbox. That is a real ask and it deserves a plain answer rather than a badge, so this page states the scope, what is stored, how long it lives, and how to end it.
What we can see,
and what we can't.
- Read-onlyWe cannot send, delete or edit anything.
- Your password never reaches usYou sign in on Google's own page.
- Bank mail, not your inboxWe ask only for mail from your bank.
- Your statement stays lockedYou type the PDF password. We never store it.
- Cut us off in one clickRevoke at Google any time, without asking us.
- No affiliate moneyNobody is paying us to pick a card for you.
What we do with your data, in full: the exact permission we ask for, and what we store.
The scope, named exactly
We request Google's gmail.readonly scope. It permits reading mail and metadata. It does not permit sending, replying, forwarding, drafting, labelling, archiving or deleting. Those are capabilities we do not hold, rather than ones we hold and decline to use. There is no scope in our request that touches Drive, Contacts, Calendar or your Google account profile beyond the address you sign in with.
Google API Services limited-use disclosure
Zenidhi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: data obtained from Gmail is used only to provide and improve the rewards audit you asked for; it is not transferred to third parties except as required to run the service or by law; it is not used for advertising, retargeting or ad personalisation; and no human reads your mail except where you have explicitly asked us to investigate a problem with your own account, or where required for security or to comply with applicable law.
Revoking, and what happens next
Visit myaccount.google.com/permissions and remove Zenidhi, or tap Disconnect Gmail under Settings in the app, which also revokes the grant at Google. Either way it takes effect on Google's side immediately and does not depend on us acting, and we read no new mail. The transaction ledger and any statement files already built from your mail stay in your account, because they are your own spending record; deleting your account erases them. If you want confirmation in writing, or deletion of an account entirely, write to support@zenidhi.com or use account deletion.
Verified by Google, assessed independently
gmail.readonlyis one of Google's restricted scopes, so an app can't use it for the public until Google has reviewed what it does with the data and an independent lab has tested the server that handles it. Ours cleared both: a CASA security assessment of api.zenidhi.comby TAC Security, an App Defense Alliance lab, and then Google's verification, approved on 10 October 2026. Both repeat every year. The consent screen names Zenidhi and the one permission, with no “unverified app” warning. If you ever see that warning on a screen asking for Gmail access in Zenidhi's name, stop there and write to support@zenidhi.com.