Introduction
CredPo (credpo.app) helps you track credit card spending, reward points, milestones and loyalty balances across your cards. This policy explains what information CredPo collects, how it is used, stored and shared, and the choices you have. It applies to the website and to the CredPo app installed from the website on your phone.
Information we collect
- Account details: your name, email address and, if you add it, your phone number. Your password is stored only as a one way scrypt hash; we cannot see it.
- Card details: the bank, card variant, the last four digits, an optional nickname and your reward point balances. We never ask for or store your full card number, CVV, PIN or online banking credentials.
- Transactions: the amount, currency, merchant, date and category of spends that you add manually or that CredPo reads from bank alert emails (see below).
- Card statements: if you forward statement emails and save a statement password for a card, we store the text extracted from the statement PDF and the figures read from it (such as credit limit, amount due and due date). Statement passwords are encrypted.
- Loyalty programs: airline and hotel program balances you choose to add.
- Subscription details: your plan and subscription status. Payments are processed by Dodo Payments; we do not receive or store your card, UPI or bank details.
Google user data (Gmail)
Connecting Gmail is optional. If you connect it, CredPo asks Google for two permissions:
- Your email address (userinfo.email), to show which Gmail account is connected.
- Read only access to Gmail (gmail.readonly), to find the transaction alert emails your banks send you.
What we access. CredPo searches your mailbox only for bank transaction alerts, using a fixed search (for example, subjects containing "spent", "debited" or "transaction alert") limited to recent dates. It reads only the emails returned by that search. Other emails are not opened.
How we use it. From each matching alert, CredPo extracts the amount, currency, merchant, date and the last four digits of the card, and records that as a transaction on your matching card so it can calculate your reward points and milestones. Emails that are not completed card spends (for example OTPs, declined payments or refunds) are ignored. Google user data is used only to provide this feature to you, and to answer questions you ask Ask CredPo about your own spending.
What we store. We store only the extracted transaction details and the Gmail message ID (so the same email is never imported twice). We do not store the content of your emails. Gmail access tokens are stored encrypted.
What we never do. CredPo never sends, deletes, labels or changes your email. We do not sell Google user data, use it for advertising, use it to build user profiles for others, or use it to train artificial intelligence or machine learning models. No person at CredPo reads your Gmail data, except with your explicit permission (for example, when you ask us for help with a specific transaction), when necessary for security purposes such as investigating abuse, or to comply with the law.
Sharing. Google user data is not shared with or transferred to anyone else, except: our hosting provider, which stores it on our behalf to run CredPo; our AI provider (Google's paid Gemini API), only when you ask Ask CredPo a question about your own spending, and only the figures needed to answer it; or where required by law. Google user data is never shared with Dodo Payments, flight search providers or any other third party, and is never used to train AI models.
Disconnecting and deletion. You can disconnect Gmail at any time on the Gmail sync page in CredPo, which immediately deletes your Gmail access tokens from our systems. You can also revoke access from your Google Account permissions. Transactions already imported stay in your account until you delete them or delete your account.
Limited Use. CredPo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Forwarded emails
Instead of connecting Gmail, you can forward bank alert and statement emails to a private CredPo address. Those emails are received by our email provider, Resend, and processed by CredPo in the same way: we extract the transaction details, and for statements the statement text and figures. We do not keep the forwarded email itself. Only emails you choose to forward are ever received.
How we use your information
- To show your cards, transactions, reward points, milestone and promotion progress, and loyalty balances.
- To convert spends made in foreign currencies into rupees using public exchange rates. Only the currency and date are sent to the exchange rate service, never your personal data.
- To search flights and hotels when you use those features, and to show which of your cards and points can be used.
- To send account emails, such as email verification and responses to card requests you submit.
- To manage your subscription, keep the service secure and fix problems.
We do not use your information for advertising, and we do not sell it.
Service providers
We use a small number of providers to run CredPo. Each receives only what it needs:
- Fly.io hosts the app and its database.
- Resend sends account emails and receives emails you forward to CredPo.
- Dodo Payments processes subscription payments as our merchant of record. They receive your name, email address and payment details when you check out.
- Google provides Gmail access if you connect it.
- Flight search providers (Duffel, Amadeus, Seats.aero and SerpApi) receive only the route, dates and cabin you search for.
- Exchange rate services (Frankfurter and Currency API) receive only a currency and a date.
- Google (Gemini API) powers Ask CredPo, our AI assistant. When you chat with it, it receives your messages in that conversation and the published reward rules of the cards in your wallet (bank, card name, earn rates and offers). It never receives your emails or card numbers. Your conversation is kept in your browser; we don't store it on our servers. When you ask about your own spending, rewards or milestones, it also receives the figures needed to answer that question, such as your spend by card or category for a period, or a short list of matching transactions (date, merchant, amount, card). These may come from emails you imported from Gmail. They are used only to answer you, and under Google's paid Gemini API terms they are not used to train its models.
Your data may be processed on servers outside India.
How we protect your data
All traffic to CredPo is encrypted with HTTPS. Passwords are hashed, and Gmail access tokens and statement passwords are encrypted at rest. Access to production systems is limited to what is needed to run and support the service. No system is perfectly secure, but we take reasonable steps to protect your information.
Data retention and deletion
We keep your data while your account is active. You can delete individual transactions at any time, and disconnect Gmail at any time, which deletes your Gmail access tokens immediately. To delete your account and all associated data, email us at the address below; we will delete it within 30 days, except for records we must keep by law (such as payment records).
Cookies and local storage
CredPo uses one session cookie to keep you signed in, valid for 30 days. The app also stores a small setting in your browser to remember if you dismissed the "install the app" banner. We do not use advertising or third party tracking cookies.
Your rights
You can view and update your account details in Account settings, correct or delete transactions, disconnect Gmail, and ask us for a copy of your data or for its deletion by emailing us.
Children
CredPo is not meant for anyone under 18, and we do not knowingly collect information from them.
Changes to this policy
If we change this policy, we will update the date at the top of this page. If a change materially affects how we use your data, including Google user data, we will notify you before it takes effect.
Contact us
Questions about this policy or your data: dhiren@bookmycrypto.com.