Privacy Policy

1. Connecting accounts is optional

You can use PointsFly without connecting any email, card or loyalty account. If you choose to connect one, PointsFly can automatically track your card spends, reward points, card statements, travel bookings and loyalty balances. You can disconnect at any time. By connecting an account, you agree to the processing described in this section.

2. What access we ask for

• Gmail: Read-only access (gmail.readonly), which allows us to read messages. We can never send, delete, move, label or change anything in your mailbox.
• Outlook / Hotmail: Read-only mail access and your basic profile, which allow us to read messages and identify which account you connected. We can never send, delete or change anything.
• Yahoo Mail: An app password you create in your Yahoo account, which gives read-only access. We never see or ask for your Yahoo account password.
• Email forwarding: No access to your mailbox. You forward emails to your personal PointsFly address, and we only receive what you choose to send. When you add that address in your email's forwarding settings, your provider sends a confirmation email to it; we use that email only to show you its confirmation link.

You grant Gmail and Outlook / Hotmail access on Google's or Microsoft's own sign-in page. We never ask for your email account password.

3. What we look for

We only look for emails related to the features you use:

• Card spend alerts from banks and card issuers (for example, "your card was used for INR …")
• Credit card statements, including their PDF attachments
• Travel confirmations for flights, trains and hotels, including PDF e-tickets
• Loyalty programme emails from airlines and hotels, such as balance and tier updates
• Emails from American Express, to identify the Amex cards you hold (see Section 6)

We find these emails by looking for known senders (banks, card issuers, airlines, hotels and travel sites) and specific wording used in these emails. Personal conversations, work email, newsletters and other unrelated messages are not used for any purpose.

For Gmail and Yahoo, the search runs inside your mailbox, so only matching emails are retrieved. For Outlook and Hotmail, recent messages are checked on our secure servers; anything unrelated is discarded immediately and never stored.

When you first connect, we review a limited period of recent email (up to six months, depending on the feature). After that, we only check for new emails, up to a few times a day, or when you tap sync in the app.

Documents you upload: You can also upload a credit card statement, or a flight or hotel e-ticket, as a PDF. We process it the same way as the matching email and do not keep a copy of the file. If an e-ticket is password-protected, the password you enter is used once to open it and is not stored.

4. How we use it

From each relevant email or document we extract only the details needed for the feature:

• Spends: merchant, amount, date, currency, bank name, last four digits of the card and transaction reference
• Statements: reward-point balances, statement period and statement transactions
• Travel: booking reference, dates, flight, train or hotel details and traveller names
• Loyalty: programme name, points balance, tier and membership number

We use these details to show your spends, estimate the reward points you earn, keep your balances up to date, show your upcoming trips, answer your questions in the app and send you related notifications. We do not use them for advertising, and we never sell them.

5. Password-protected statements

Many banks protect statement PDFs with a password built from your date of birth and name. To open these automatically, we use the date of birth and name saved in your PointsFly profile. Statements are opened securely on our servers and are not sent to any AI provider. If you enter a statement password yourself — for example, where your bank builds it from part of your card number — we store it encrypted, use it only to open your statements, and you can remove it at any time.

6. American Express card suggestions from email

PointsFly is not affiliated with, endorsed by or sponsored by American Express.

If you connect Gmail, we look for emails sent by, or mentioning, American Express from the last six months, to identify which Amex cards you may hold (the card name and the last digits of the card number). This happens on our own servers; these emails are not sent to any AI provider.

These appear only as suggestions. No card is added to your wallet until you confirm it, check the last four digits and enter your points balance. If you dismiss a suggestion, it will not be shown again. We store only the issuer, card name and last four digits — never full card numbers, CVV or expiry dates.

7. Connecting your American Express and loyalty accounts

You can choose to connect your American Express online account, and selected airline and hotel loyalty programmes (for example Emirates Skywards, Qatar Airways Privilege Club, Singapore Airlines KrisFlyer, Marriott Bonvoy, Hilton Honors, Accor ALL and IHG One Rewards), so your points balances and cards stay up to date without typing them in.

How it works

• You enter the sign-in details for that account (for example, your American Express user ID and password, or your membership number) in the PointsFly app.
• These are sent over an encrypted connection to PointsFly's secure account-connection service, which signs in on your behalf, reads your account summary and returns the result to your PointsFly account.
• If the programme asks for a one-time verification code, you enter it in the app and we pass it on to complete the sign-in.
• PointsFly only reads your account summary. It cannot make payments, transfer or redeem points, or change anything in your account.

What we store

• Your user ID or membership number, stored encrypted.
• Your password, stored encrypted only if you turn on "Remember my login", so we can refresh your balance in the background (about once a month). If you leave it off, we do not keep your password and you sign in again whenever you want to refresh.
• Session information, stored encrypted, so you are not asked for a verification code every time.

What we use

Your points balance, card names and last digits (American Express), name, membership number, tier and points expiry. We use these only to show your cards, points and loyalty accounts in PointsFly. We do not collect or use other information from these accounts, such as statements, spending or credit information.

Your responsibilities

By connecting an account, you confirm that it is your own account, that you are allowed to access it, and that you authorise PointsFly to access it on your behalf for this purpose. The card issuer or programme may ask for extra verification, or temporarily restrict access, in line with its own policies.

Disconnecting

You can disconnect any of these accounts at any time in the app. We then delete your stored sign-in details and session information and stop refreshing. Cards and balances already in your wallet stay there, with the last known balance, until you remove them. Deleting your PointsFly account removes all stored connection details.

Your sign-in details are used only to fetch your account summary. Our account-connection service is run with a contracted service provider that acts only on our instructions and may process these details outside India.

8. What we keep

• We keep: the extracted details listed above, plus minimal reference information (such as a message ID, date and subject line) so the same email is not processed twice.
• We do not keep: copies of emails read from your connected Gmail, Outlook, Hotmail or Yahoo account, or copies of documents you upload.
• Forwarded emails: emails you forward to your PointsFly address are stored securely for a limited period (up to 90 days), so we can process them and correct any transaction you report as wrong.

9. Who else processes your data

We never sell your data or share it for advertising. We use a small number of trusted service providers who act only on our instructions:

• OpenAI — receives the relevant text of matched spend alerts and travel confirmations (including e-tickets, whether from email or uploaded) so the details can be read accurately, and may receive a merchant name to categorise a spend. If you use the PointsFly AI assistant, your question (or voice note) and the relevant details from your account (such as your cards, spends and trips) are sent to OpenAI to generate the answer. Statements, loyalty emails and American Express emails are not sent to OpenAI. OpenAI processes this data only to return the result to us; it does not use it to train its models, and may retain it for up to 30 days solely for abuse and security monitoring before deleting it. OpenAI may process data outside India.
• Account-connection service — a contracted provider that runs PointsFly's account connections. It receives the sign-in details for accounts you choose to connect (Section 7) and fetches your balances on our behalf. It may process data outside India.
• Amazon Web Services (AWS) — hosts our servers and databases in India, and receives emails you forward to PointsFly.

Google, Microsoft, Yahoo and the card and loyalty programmes you connect are the sources of this data; we do not send your data back to them. We may also disclose information where required by law, or to protect the rights, safety and security of our users and PointsFly.

10. Who at PointsFly can see it

Our team does not read your emails. Authorised staff may access limited email-derived information only when you ask us for help or report a transaction as incorrect, when needed for security or to investigate abuse, or when required by law. Access is restricted, logged and limited to what the task needs.

11. How we protect it

• Connection credentials (access tokens, app passwords, and card and loyalty sign-in details) and statement passwords are encrypted using AES-256.
• All data is encrypted in transit.
• Access to production systems is restricted to authorised personnel.
• We never ask for your email account password.

12. How long we keep it

• Extracted records (spends, statements, trips, balances) are kept while your account is active, until you delete them or your account.
• Forwarded emails are kept for up to 90 days.
• Stored sign-in details are deleted when you disconnect the account.
• When you delete your account, your account and data are deleted immediately from our systems.

13. Disconnecting and deleting

• Disconnect any mailbox from Settings at any time. We stop reading it immediately and delete the stored access. For Gmail and Outlook/Hotmail, we also revoke PointsFly's access with Google or Microsoft, so PointsFly no longer appears in your account's connected apps. For Yahoo, we delete the app password; you can also remove it from Yahoo Account Security > App passwords.
• Email forwarding stops when you remove the forwarding rule or filter in your email settings.
• American Express and loyalty accounts can be disconnected in the app (Section 7).
• Past records (spends, trips, balances) created before you disconnect stay in your account until you delete them or your account.
• Delete my data (Settings) disconnects every connected account, revokes access, and deletes your account and associated data immediately from our systems.

14. Google API Services — Limited Use

PointsFly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:

• use Google user data only to provide or improve user-facing features that are prominent in the PointsFly app;
• do not use Google user data for advertising, including retargeting, personalised or interest-based ads;
• do not allow humans to read Google user data, except with your consent, for security purposes, to comply with applicable law, or when the data is aggregated and anonymised;
• do not transfer or sell Google user data, except as needed to provide or improve the service, for security purposes, to comply with applicable law, or as part of a merger or acquisition with notice to you; and
• do not use Google user data to train generalised AI or machine-learning models.

We apply the same commitments to data from Microsoft and Yahoo accounts.

15. Accuracy and third-party services

Balances, points and estimates shown in PointsFly are based on information in your emails and connected accounts and may not always be complete or up to date. Always rely on your bank, card issuer or loyalty programme for official figures.

Google, Microsoft, Yahoo, American Express and the loyalty programmes you connect are independent third parties. Their handling of your data within their own services is governed by their own terms and privacy policies. PointsFly is not affiliated with or endorsed by them, and all trademarks belong to their respective owners.