Your data, your control

What we collect

InCardible collects only the financial data necessary to provide credit card reward tracking and optimization. This includes:

• Credit card statement and transaction alert emails — we extract the subject line, date, and financial amounts only
• Card information — issuer name, card network, and last 4 digits of your card number
• Transaction data — amount, merchant name, date, and spending category
• Google account profile — name, email address, and profile picture (via Google OAuth)

What we do NOT store

We are deliberate about minimizing stored data. InCardible does not store:

• Full email bodies — only parsed financial fields are retained
• Banking passwords or credentials of any kind
• Full credit card numbers — only the last 4 digits
• CVV, PIN, or any card security codes

How your data is protected

• OAuth tokens are encrypted with AES-256 at rest
• All data in transit is protected via HTTPS/TLS
• We request the minimum Gmail scope required — gmail.readonly
• Database access is restricted to application-level service accounts with least-privilege permissions

Gmail access

InCardible requests read-only access to your Gmail account to identify and parse credit card statement and transaction alert emails. We never send, delete, or modify any emails in your inbox. The Gmail readonly scope is the only permission we request, and you can revoke it at any time from your Google account settings.

AI processing

Transaction data may be processed by AI/LLM models for categorization, reward calculation, and personalized recommendations. This processing is performed solely to deliver our service to you. Your data is not used for model training or shared with AI providers for their own purposes.

Third-party sharing

We do not sell, rent, or share your personal financial data with third parties. We may use third-party infrastructure providers (hosting, database) to operate the service, subject to their own privacy policies and our data processing agreements.

Data deletion

You may request deletion of all your data at any time by contacting us at support@maxify.app. Upon receiving a verified request, we will permanently delete all data associated with your account within 30 days.

Contact

If you have questions or concerns about this privacy policy, please contact us at support@maxify.app.