Privacy Policy

Last updated: 7 June 2026

Cashew ("Cashew", "we", "us") helps you find gift cards, store credit, refunds and rewards sitting unused in your email. This policy explains what we access, why, and how we protect it. Questions? Email kris.engelhardt4@gmail.com.

What we access

Your email address, if you join our waitlist or create an account.
Gmail messages, read-only, if and only if you choose to connect Gmail. We request the gmail.readonly scope, which lets Cashew read messages. Cashew never sends, deletes, or modifies your email.

When you connect Gmail, Cashew searches only for money-bearing messages (e.g. those mentioning gift cards, store credit, or rewards) and reads those messages to detect the value sitting in your inbox.

How we use it

We scan matching messages in memory to detect gift cards, credits and rewards, then discard the message content.
To improve accuracy, the text of candidate messages may be sent to our AI processing provider (currently OpenAI) to confirm whether a message really represents money you hold. Gift-card codes, PINs and card numbers are redacted before this step, so your actual codes are never transmitted. The provider processes the text transiently to return a result and does not use it to train its models.
We store only the results of a scan — the brand and amount of each stash — so we can show them to you. We do not store the body of your emails.
We do not store your actual gift-card codes.
We never sell or rent your personal data or email content, and we never share it for advertising.

Google API Limited Use disclosure. Cashew's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail data for advertising, we do not sell it, and we do not allow humans to read it except where required for security, to comply with law, or with your explicit consent.

Storage & security

Connection tokens are held only for your active session and dropped when you disconnect. Scan results are stored in our database to power your account. We use industry-standard measures to protect data in transit (HTTPS) and at rest.

Your choices

Disconnect Gmail at any time from the app — this removes Cashew's access immediately.
Revoke access directly via your Google Account permissions.
Delete your data — email kris.engelhardt4@gmail.com and we will erase your account and stored results.

Children

Cashew is not directed to anyone under 16, and we do not knowingly collect their data.

Changes

We may update this policy; we'll revise the date above and, for material changes, notify you by email.