Operator and contact
Card Track is operated by Harish Gnanasekar, India. For privacy questions or requests, contact shriah@gmail.com.
Information used by the app
The app processes account and authentication information, configured card details, and transaction information parsed from eligible emails, such as merchant, amount, currency, date, and masked card digits. It also uses a session cookie to keep you signed in.
Google user data and Gmail access
When you choose to connect Gmail, Card Track requests only the Gmail read-only scope (https://www.googleapis.com/auth/gmail.readonly). This lets the app list and read Gmail messages and message metadata so it can find credit-card transaction notifications, extract transaction details, show your transactions and spending summaries, and keep those results up to date. It does not permit Card Track to send, delete, or modify Gmail messages. Card Track does not use Google user data for advertising, does not sell it, and does not use it to determine creditworthiness or for any purpose unrelated to the transaction-tracking features you request.
Sharing and disclosures
We share or disclose Google user data only as needed to provide the service, with your direction, to comply with law, or to protect the service and its users. Google processes the Gmail connection. Neon hosts the PostgreSQL database that stores account, card, parsed-transaction, and encrypted OAuth-token records. Resend processes a recipient email address and password-reset email content when we send a password-reset message. If optional AI parser-drafting, merchant-categorization, or assistant features are enabled, the relevant limited input is sent to the configured provider (for example, Google Gemini or a LangGraph service) to perform that feature; parser drafting can include the sender, subject, date, and up to the necessary email-body content from a transaction notification. OAuth tokens are not sent to these AI providers. We do not share Google user data with advertisers or data brokers. We require service providers to process data only to provide their services to us.
Data protection
We use HTTPS for production web and API traffic. OAuth access and refresh tokens are encrypted at rest with AES-256-GCM before storage. Passwords are salted and hashed with scrypt; session tokens are stored as hashes and delivered in HttpOnly, SameSite cookies, with the Secure attribute in production. The Gmail OAuth flow uses state, short-lived authorization records, and PKCE to help prevent request forgery and authorization-code interception. Access to application data is limited through authenticated, per-user access controls, and operational logs are designed to avoid email content and tokens.
Your choices
You can disconnect Gmail from the app at any time. Disconnecting removes the local OAuth-token record and attempts to revoke the connected Google token. Disconnecting Gmail is not an account or data-deletion request.
Operational data
The app may record limited error and request telemetry to operate and troubleshoot the service. Password-reset requests and account authentication are handled as part of the service’s security workflow.
Retention and deletion requests
Account, card, and parsed transaction data are retained while your account is active. To request deletion of account or app data, contact shriah@gmail.com. Following a verified request, the target deletion timeframe is 30 days, unless a longer period is required by law.
Processing details
The app is operated from India. Providers may process information in locations where they operate. This policy does not limit disclosures that are required by applicable law, legal process, or a valid governmental request.