Privacy Policy

Last updated 22 July 2026

RefundTrip helps you find refunds and compensation US airlines owe you, and track the credit card travel benefits that cover what federal law does not. Doing that requires reading your travel confirmations. This page explains exactly what we access, why, how long we keep it, and how to make us delete it.

The short version. We read only the travel confirmation emails needed to build your trip history. We never sell your data, never use it for advertising, and never use it to train AI models. You can disconnect and delete everything at any time, and we delete it permanently.

1. Who we are

RefundTrip is operated from the United States. For any privacy question, contact privacy@refundtrip.com. We respond to all requests within 30 days.

2. Google user data: what we access and why

If you connect a Google account, RefundTrip requests read-only access to your Gmail messages. We request this scope because there is no narrower Gmail scope that permits searching for and reading travel confirmations.

Scope	Why we need it
`gmail.readonly`	To locate airline, hotel, and travel agency confirmation emails and extract flight details: carrier, flight number, route, dates, confirmation number, fare paid, and the last four digits of the payment card. The last four digits are required because credit card travel protections only apply to the card that paid for the trip.
`userinfo.email`	To identify your account and send you claim notifications.

What we do not do

We do not read emails unrelated to travel. Our systems filter to messages matching travel confirmation patterns, and non-matching message bodies are discarded without being stored.
We never send, delete, or modify email. Our access is read-only.
We do not store full message bodies. We store only the extracted structured fields listed above.
We never store full payment card numbers. Only the last four digits, which appear in the confirmation itself.

3. Limited Use disclosure

RefundTrip's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we affirm that Google user data is:

Used only to provide and improve the user-facing features described on this page;
Never transferred or sold to third parties for advertising, market research, credit assessment, or any similar purpose;
Never used to develop, improve, or train generalized artificial intelligence or machine learning models. We do not send your email content to any third-party AI service;
Read by humans only in the narrow cases permitted by the policy: where you have given explicit consent for a specific support issue, where required for security investigation or to comply with law, or where the data has been aggregated and de-identified.

4. Other information we collect

Account information. Your email address and any card products you tell us you hold. We do not ask for full card numbers, and you should never send them to us.
Claim records. Details of claims we identify, and their status if you tell us the outcome.
Usage data. Standard server logs including IP address, browser type, and pages visited, retained for 90 days for security and debugging.

5. How we share information

We do not sell your personal information. We share it only in these circumstances:

Service providers who host our infrastructure and send our email, bound by contract to protect your data and use it only to provide those services.
At your direction. If you choose to submit a claim through a partner, we share only the specific trip details needed for that claim, and only after you approve it.
Legal requirements. Where required by valid legal process, or to protect rights and safety.
Business transfer. If RefundTrip is acquired, your data may transfer with the business. We will notify you before your data becomes subject to a different privacy policy.

6. Retention and deletion

We keep your extracted trip data while your account is open, because claim windows run for years and a trip from three years ago may still be actionable.

Disconnecting Google stops all further access immediately and revokes our token.
Deleting your account permanently removes your trip history, claim records, and extracted data from our production systems within 30 days, and from encrypted backups within 90 days.
You can delete your account from your settings page, or by emailing privacy@refundtrip.com.
You can also revoke access at any time from your Google account permissions page, independently of us.

7. Security

Data is encrypted in transit using TLS and at rest. OAuth tokens are stored encrypted and are never exposed to the browser. Access to production systems is restricted to personnel who require it, and is logged.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to certain processing. California residents have specific rights under the CCPA, including the right to know what personal information we collect and the right to delete it. We do not sell personal information as defined by the CCPA. Exercise any of these rights by emailing privacy@refundtrip.com. We will not discriminate against you for doing so.

9. Children

RefundTrip is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

10. Changes

If we make material changes to how we handle your data, we will notify you by email before those changes take effect, and update the date at the top of this page.