Legal

Privacy Policy

Last updated: 11 July 2026

1. Data Controller

Raydar ("we", "our") is responsible for your personal data. Raydar is operated independently and is not currently incorporated as a company. If you have questions about this policy or how we handle your data, contact us at support@raydarhq.com.

2. Information We Collect

We collect only what is necessary to provide the service:

Account data — your name and email address when you register.
Gmail OAuth token — an access token issued by Google, encrypted at rest. We store this to query your inbox on an ongoing basis. We never see or store your Google password.
Email metadata — the sender address, subject line, and date of emails from senders you configure. Retained for audit purposes for 7 days, then automatically deleted.
Extracted transaction data — the amount, merchant name, date, and category parsed from those emails. This is the core dataset powering your dashboard.
Usage data — app activity and crash/error events, collected via Firebase Analytics and Crashlytics and linked to your account, used to improve the service and fix bugs.
Subscription status — your entitlement and subscription state, synced with RevenueCat, used to determine which features you can access.

What we never collect: raw email body content, bank account numbers, bank credentials, or any data from senders you have not configured.

3. Gmail Access

This section is required by Google's API Services User Data Policy and explains exactly how Raydar uses your Gmail access.

Scope: Raydar requests the gmail.readonly OAuth scope. This is a restricted scope that gives read access to your mailbox. Google displays a warning about this on the consent screen — this warning reflects Google's policy for all apps using this scope, not Raydar's specific behaviour.

What we actually query: We use Gmail's search API with a sender filter, e.g. from:(alerts@chase.com). Only emails matching senders you explicitly configure are ever fetched. Emails from all other senders are never accessed — not even their metadata.

Raw email content: Email bodies are parsed in memory to extract transaction fields. The raw content is never written to disk or stored in our database.

Processing audit log: You can view exactly which emails Raydar accessed and what was extracted, directly in the app.

Revoking access: You can disconnect Gmail at any time from within Raydar, or by visiting myaccount.google.com/permissions and removing Raydar from the list of connected apps.

Sharing of Google user data: We do not transfer or disclose your Google user data to third parties. Transaction extraction and categorisation are performed by Raydar's own extraction service — email content is never sent to any external AI provider. Raw email content is never transmitted to any third party. Google user data is not sold to or shared with any other party for any purpose.

Data obtained via the Gmail API is used solely to provide the Raydar service to you. It is not used for advertising, sold to third parties, or used to train machine learning models.

4. How We Use Your Data

Service delivery — to build and display your spending dashboard.
AI categorisation — to classify transactions into spending categories, performed in-house by Raydar's own extraction service.
Security — to detect suspicious activity and protect your account.
Legal obligations — to comply with applicable law, including responding to lawful requests from regulators.

5. Third-Party Processing

Google Firebase — we use Firebase Analytics and Crashlytics to understand app usage and diagnose crashes. This data is linked to your account and is not used for advertising or sold to third parties. Firebase Privacy Policy ↗

RevenueCat — we use RevenueCat to manage and verify subscription entitlements. Your account identifier and subscription status are shared with RevenueCat for this purpose only.

Resend — we use Resend to deliver transactional emails (account verification, password reset). Your email address is passed to Resend for this purpose only.

We do not sell your personal data to any third party.

In the event of a merger, acquisition, or sale of assets, Google user data will only be transferred to the acquiring entity after obtaining your explicit prior consent.

6. Data Storage & Security

All data is stored on secure cloud infrastructure. We apply the following technical measures:

AES-256-GCM encryption at rest for all sensitive fields.
TLS 1.3 for all data in transit.
Passwords hashed with Argon2id (OWASP recommended).
OAuth tokens encrypted and stored server-side — never exposed to the client.
Row-level database access controls ensuring you can only access your own data.

7. Data Retention

Email metadata (subject, sender, date) — 7 days, then automatically deleted.
Extracted transaction data — retained until you delete your account.
Account data — retained until you delete your account, plus a 30-day grace period to allow for account recovery.
Usage data — linked to your account, retained for up to 12 months.

8. Cross-Border Data Transfers

Your data is stored on infrastructure within a secure cloud region. Transaction extraction and categorisation are performed in-house and never leave Raydar's own infrastructure. Some third-party processors we use (Google Firebase, RevenueCat) operate on infrastructure in the United States, which constitutes a cross-border transfer for the limited data described in Section 5.

For users in Rwanda, cross-border transfers are conducted in accordance with Rwanda Law No. 058/2021 and any applicable authorisations from the National Cyber Security Authority (NCSA).

9. Your Rights

Regardless of where you live, you can exercise any of the following by emailing support@raydarhq.com. We target a response time of 48 hours.

Right of access — obtain a copy of your personal data.
Right to rectification — correct inaccurate data.
Right to erasure — delete your account and all associated data.
Right to data portability — export your data as JSON or CSV.
Right to restrict processing — limit how we use your data.
Right to object — object to how we use your data.
Right to withdraw consent — at any time, without affecting prior processing.

Raydar does not sell personal information, to anyone, for any reason.

Rwanda residents additionally have the right to lodge a complaint with the National Cyber Security Authority (NCSA) under Law No. 058/2021.

10. Cookies

Our website uses session cookies only — these are strictly necessary to keep you logged in and expire when you close your browser. We do not use tracking cookies or advertising cookies on the website.

The Raydar app uses Firebase Analytics and Crashlytics to understand usage and diagnose crashes, as described in Section 5. This is not used for advertising or cross-site tracking.

Because we do not track your activity across third-party sites, browser "Do Not Track" signals have no effect on our website — there is nothing for them to opt you out of.

11. Children's Privacy

Raydar is not directed at anyone under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to This Policy

We will notify you of material changes to this policy at least 30 days before they take effect, via email or an in-app notification. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact

For any privacy-related questions or to exercise your rights, contact us at support@raydarhq.com.

If you are unsatisfied with our response and you are a Rwandan resident, you have the right to lodge a complaint with the National Cyber Security Authority (NCSA).