Privacy Policy
Last updated September 4, 2026
This policy explains what Downtick collects, why, and what we do with it. We collect only what we need to find price drops on your purchases and recover the difference for you.
Google user data
This section describes exactly how Downtick handles data from your Google Account. It applies whenever you connect Gmail.
What we access. One scope only: gmail.readonly. We search your mailbox for retailer order, shipping, delivery and refund messages, and open only those messages. We do not send, modify, delete, or label mail, and Downtick has no ability to do so.
Why we need message content. The information that makes monitoring possible lives in the message body and HTML, not the headers: the item, the price you paid, the order number, and product identifiers embedded in links and image URLs. Google's narrower Gmail scope, gmail.metadata, returns headers only and cannot support the feature.
What we keep. Only the extracted purchase fields: retailer, order number, order date, item name, product identifier or link, price paid, and the Gmail message id we found it in. We do not store raw message bodies or HTML. Message text is processed in memory and discarded once the purchase fields are extracted.
Automated processing. To read a receipt accurately, the subject line and up to roughly 8,000 characters of message text are sent to our AI processing provider, Anthropic, over an encrypted connection, solely to extract those purchase fields and return them to us. Under Anthropic's commercial terms, data submitted through its API is not used to train its models. Anthropic also receives derived purchase fields (retailer, item name, price) when Downtick researches a retailer's published price-adjustment policy or checks a current price. No other third party receives your Gmail content or message text.
How it is used. Google user data is used only to deliver the user-facing feature you connected it for: finding your purchases, monitoring their prices, and identifying recovery opportunities. We do not use it for advertising, we do not sell or transfer it, we do not use it to train generalized AI or machine learning models, and no human at Downtick reads your mail except where you explicitly ask us to investigate a specific purchase, where it is needed for security or to comply with law, or where the data has been aggregated and anonymized.
Limited Use. Downtick's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Storage and security. Data is held in a managed Postgres database (Neon) and served from Vercel, both encrypted in transit and at rest. Your Google refresh token is stored server-side, is never exposed to the browser, and is used only to fetch order-related mail.
Retention. Extracted purchase records are kept while your account is active, so we can keep monitoring those purchases. Message bodies are never retained.
Disconnecting and deletion. Three separate controls live in your settings. Disconnect revokes the token with Google and deletes it from our systems, and ingestion stops immediately; purchases already found stay until you delete them. Delete my email-derived data removes every purchase, price check, recovery record and stored Gmail message id we derived from your mail. Delete my account removes the account entirely. If a fee has already been charged, the associated billing record is retained as a financial record showing the retailer, amounts and dates, with the Gmail message references stripped out, and the account is anonymised so it can no longer identify you or be signed in to. You can also revoke Downtick's access directly at myaccount.google.com/permissions. To request deletion, email hello@downtick.ai.
What we collect
Account. Your name, email, and a hashed version of your password (we never store your password in plain text).
Purchase details. To find a price drop we need to know what you bought: the item, price paid, date, retailer, and order number. We get these from receipts you connect or forward, or that you enter yourself.
Payment. Your card is handled by our payment processor, Stripe. We store a payment token plus your card's brand and last four digits, never the full card number.
Usage. Basic device and usage information to keep the service working and secure.
Connecting your email
If you connect Gmail, see the Google user data section above, which governs. Where you instead use a forwarding address, we only ever see the messages you forward. You can disconnect at any time.
How we use your information
To detect price drops, prepare and track recovery requests, charge our 15% success fee once a merchant confirms a recovery, provide support, keep the service secure, and meet legal obligations. We do not use your data for anything unrelated to recovering your refunds.
How we share it
With retailers, only as needed to make a request about your order, which discloses your name, the order and the price difference. With the service providers that run Downtick, under contracts that protect your data: Vercel (hosting), Neon (database), Anthropic (AI extraction and policy research), Stripe (payments; it receives the retailer name and amounts, never your item names or mail), and Resend (email delivery). And if required by law. We do not sell your personal information, and we never use Gmail data for advertising.
Security and retention
We serve the site over TLS, hash passwords, tokenize cards with Stripe, and encrypt your Google refresh token with AES-256-GCM before storing it, under a key held outside the database. Our database and hosting providers, Neon and Vercel, encrypt data at rest. We keep your information while your account is active and as long as needed for legal, tax, and dispute purposes, then delete it. You can delete your Gmail-derived data or your whole account at any time in settings.
Your rights
You can disconnect Gmail, delete everything derived from it, or delete your account at any time in settings. Residents of California and other regions may have additional rights, including the right to know what we hold and to request deletion. To exercise any of these, email hello@downtick.ai.
Children
Downtick is not for anyone under 18, and we don't knowingly collect their information.
Changes and contact
We may update this policy and will note the date above. Questions or requests? Email hello@downtick.ai.