What Glass Money does

Glass Money reads the transaction-alert emails Indian banks and card issuers already send you, extracts the transactions in them, and shows you a spends dashboard. That's the whole product; everything below follows from it.

Glass Money is operated by ONIMA TECH (OPC) PRIVATE LIMITED, Panchkula, Haryana, India. ONIMA TECH (OPC) PRIVATE LIMITED is the data controller for personal data processed through Glass Money.

Gmail access

Sign-in vs Connect: Signing in with Google uses Glass Money's own OAuth client. On the live Connect path that same client also requests gmail.readonly, so one consent can grant identity and mailbox access. Adding another inbox (when that feature is on) is a separate Google consent for the same scope.
How Connect works today (Google): Production Connect uses Glass Money's own Google OAuth client. Google will show Glass Money on the consent screen. That path requests Google's gmail.readonly scope. Mail goes Google → our server (no third party in the mail path for new connections).
What we do with that access: Glass Money only uses email content to power product features — fetching known Indian bank and card-issuer transaction alerts (and related statement mail where applicable) so we can extract transactions into your dashboard. We do not send, delete, modify, or label anything in your mailbox on your behalf. We do not use Gmail data for ads, sale, or training generalized AI/ML models.
Only emails from known Indian bank and card-issuer senders and domains are fetched (known alert addresses, plus occasional domain-level sweeps for new bank alert addresses). Your personal mail is never downloaded for product use.
You can disconnect Gmail at any time from the Account page. Disconnecting deletes our access token / connected-account link immediately; syncing stops on the spot.

How your emails are processed

Extraction is primarily deterministic: transactions are parsed with hand-written and pre-validated templates. When the server has an LLM configured, unrecognised emails may be sent to an AI model for extraction — including during automatic background syncs.

Google Limited Use disclosure

Glass Money's use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

Google user data obtained via Google APIs — including Gmail content obtained through Connect via gmail.readonly for bank and card transaction-alert emails — is used only to provide and improve the user-facing features that are prominent in the app: extracting those alerts into your spending dashboard. Glass Money's use of the data we receive follows Limited Use.

We do not transfer Google user data to others except as necessary to provide or improve those features, for security purposes, or as required to comply with applicable law. We do not sell Google user data.
We do not use Google user data for serving advertisements.
We do not use Google user data for determining creditworthiness or for lending purposes.
Human reading of Google user data does not occur except: (a) with your consent (for example, when you ask us to investigate a support issue), (b) for security or compliance reasons, or (c) when the data is aggregated and anonymized for internal operations.

Google user data (including Gmail content obtained via Connect) is not used to train, improve, or develop generalized AI/ML models. When an LLM is configured on the server, unrecognised bank-alert emails may be sent to Google Gemini only to extract transactions for that user's dashboard. Glass Money uses Google Gemini to categorise your transactions. If statement import is turned on for your account, Gemini also reads the statement PDFs we fetch from your inbox to extract transactions. Under our configuration and contracts, Gemini is not permitted to use that content to train generalized models, and we do not use it for model training ourselves.

What we store, and where

Fetched bank-alert emails and the transactions extracted from them are stored in a database that belongs to your account alone — every account has its own isolated database.
Your Gmail access token is stored encrypted at rest when the server secret key is configured.
Account data (emails, transactions, tokens) is hosted on Fly.io servers in Mumbai, India.
We use a single session cookie to keep you signed in. There are no ads in the app.

Analytics

We use PostHog (hosted in the US) for analytics. On the public marketing site, we collect anonymous pageviews, referral information, and CTA clicks so we can understand which pages help people decide to try Glass Money. In the signed-in product, when analytics is enabled on the server, we send product events such as sign-ins, Gmail connect, sync success/failure, and similar product usage. Product events may include your account email and name for identification. We do not send email bodies, message content, or extracted transaction details to PostHog. Analytics is optional and disabled when no PostHog API key is configured.

Mobile transaction alerts

If you opt in to mobile transaction alerts, one new transaction's amount and merchant may be sent through Expo and the applicable push provider (FCM on Android or APNs on iOS), and may appear on your device lock screen. You can disable alerts at any time in the app's Settings.

What we never do

Sell, share or monetise your data in any form.
Send your emails to an AI except to extract unrecognised bank-alert formats when an LLM is configured on the server.
Touch anything in your mailbox beyond reading bank-alert emails for product features.

Deleting your data

Disconnecting Gmail deletes our access to your mailbox but keeps the transactions already imported (so you can still browse them). To delete everything — your database, account, encrypted token and statement files — use Delete account on the Account page (typed confirmation required). We revoke Google access immediately, wipe your tenant data from the live server, and remove your user row. Database replicas age out with our backup retention (Litestream snapshots: 72 hours). As a fallback, email us from the Google account you signed in with and we'll remove it all.

The demo

The demo mode runs entirely in your browser on generated sample data. Nothing is sent to or stored on our servers when you use it.

Contact

Questions or deletion requests: support@glassmoney.app. See also our Terms of service.