Privacy Policy

When you connect Gmail, we request a single Google permission: Gmail read-only (the gmail.readonly restricted scope), plus your name and email address to create your account. Read-only means exactly that: we can read messages, and we can do nothing else. We cannot send, delete, label, or change anything in your inbox.

You can also feed MileBack flights without Gmail at all — by forwarding airline emails to a MileBack address, or uploading an email export. Whichever path you use, the handling below is identical.

We only look at messages that appear to be airline itineraries, receipts, or boarding-pass confirmations. We are not interested in the rest of your inbox and do not build a profile of it.

We read the airline emails, pull out the facts about your flights, and store only that structured flight metadata. Concretely, the fields we keep for each flown leg are:

• Airline (marketing and operating carrier) and flight number
• Departure date, origin airport, and destination airport
• Fare class and cabin
• Flight distance (when we can determine it)
• The loyalty program the leg maps to, and whether a frequent-flyer number was present
• Our estimated miles and dollar-value range for the leg
• Our confidence rating and which extractor produced it
• A masked/hashed ticket number reference — never the raw ticket number
• A hashed booking reference (PNR) used only to group legs of the same trip — never the raw PNR

We also store a few things tied to your account: your MileBack account ID and email, your locale/currency preferences, per-scan counts (how many emails were considered and parsed — counts only, never content), your loyalty membership numbers (encrypted at the application layer, never in plaintext, and never a password), the claims you file, and your subscription/entitlement status.

These are architectural commitments, not just promises:

• Raw email bodies and subjects. The full text of your emails is processed in memory while we extract flight facts, then discarded. It is never written to disk, never queued, never logged, and never backed up. No column in our database can hold email body or subject text.
• Passwords. We never ask for, receive, or store any password — not your Google password, not your airline password.
• Airline account credentials. We never touch your frequent-flyer login. We help you file claims; we never log into airline accounts on your behalf.
• Raw OAuth tokens. The Google token that authorizes reading your mail is held in an encrypted vault and referenced indirectly; the raw token is never stored in our application database and never logged.

MileBack's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms, that commitment means: we use Gmail data only to provide the miles-recovery features you see in the app; we do not sell it; we do not transfer it except as needed to run those features; we do not use it for advertising; no human at MileBack reads your email; and we do not use your email content to train general or shared AI/ML models. Where an AI model helps extract flight details from an email, it runs on a zero-retention basis for inference only — your content is not retained by the model provider and is not used to improve their models.

We keep the list of companies who process your data short and purposeful. We do not sell data to anyone, and none of these are advertising networks or data brokers.

• We never sell your data.
• We never show you ads or use your data for advertising or retargeting.
• No human at MileBack reads your email.
• We never use your email content to train shared or general AI models.

Our business model is simple: we make money when you subscribe. That's the whole model.

You can delete your account at any time. In the app: go to Settings → Privacy → Delete account. From the web: use our account deletion page — it works even if you don't have the app installed.

Deletion removes everything that identifies you: your account, your connections, your flight metadata, your claims, your membership numbers, and your subscription record, in that order, and revokes our Gmail access. The only thing we keep is de-identified calibration statistics that carry no user ID and cannot be linked back to you — we use them to keep our estimates honest.

You can also disconnect your inbox without deleting your account. Disconnecting revokes our Gmail access and stops future scans; deletion removes your data entirely.

Wherever you live, you can see what we hold, correct it, export it, delete it, and revoke inbox access. If you're in the EU/UK (GDPR) or California (CCPA/CPRA), you additionally have the right to know what we collect and why, to request deletion, to data portability, and to not be discriminated against for exercising these rights. We do not sell or "share" personal information as those laws define it, so there is nothing to opt out of on that front. To exercise any right, email privacy@getmileback.com.

Questions about privacy? Email privacy@getmileback.com. Postal mail: [PLACEHOLDER — mailing address].