Privacy Policy

Effective date: April 27, 2026  ·  Last updated: August 9, 2026

GetPayout ("we," "us," or "our") operates the GetPayout mobile application (the "App"). This Privacy Policy explains how we collect, use, and protect information when you use our App. By using GetPayout, you agree to the practices described here.

1. Gmail Access

GetPayout requests read-only access to your Gmail account via Google OAuth 2.0. This means:

• We can read email metadata (sender, subject, date) and limited email content to identify signals that match active class action settlements.
• We cannot send emails, modify emails, delete emails, or take any action in your Gmail account.
• We do not store your emails. Emails are scanned in memory during a session and discarded immediately after matching is complete.
• We do not read personal or private email content beyond what is necessary to identify settlement eligibility signals (e.g., order confirmations, financial institution emails, data breach notifications).
• As part of Google sign-in (separate from the Gmail scan itself), we also retain your Google account's profile photo URL, shown in the App as an account indicator — see "Profile photo" in Section 2.

Your Gmail OAuth token is stored securely on your device using Apple Keychain. It is never transmitted to our servers except to perform the scan on your behalf.

AI-assisted match confirmation: most settlement matching is done entirely on your device using fixed detection rules. For a small number of matches where the on-device rules can't determine eligibility with confidence, a short snippet of the relevant email — the subject line and a brief preview, never the full email body or attachments — is sent to our servers and passed to our AI processing partner (Anthropic) to confirm whether you qualify. This snippet is processed in memory for the duration of that single request only. It is never written to a database, log file, or any persistent storage, and it is never used to train AI models. If you'd prefer this feature be disabled entirely, contact us at [email protected].

2. Data We Collect

We collect and store the following data:

• Email address — collected when you sign in with Google and stored on our servers to identify your account. We do not store your Gmail password or any email content.
• Profile photo — if you sign in with Google, we retain the profile photo URL from your Google account to display as an account indicator within the App. Sign in with Apple does not provide a profile photo, so Apple users instead see a plain initial. Stored locally on your device only; not stored on our servers.
• State of residence — used to filter state-restricted settlements. Stored on your device and synced to our servers when set.
• Filed claims — a record of which settlements you chose to file claims for, including the settlement name, estimated payout, deadline, and the date you initiated the claim. Stored on our servers so your history is preserved if you reinstall the App.
• Scan results — the list of settlements matched during a scan and estimated payout amounts. Stored locally on your device only; not sent to our servers. (The one exception is the brief email snippets described under "AI-assisted match confirmation" above, which are transmitted for processing but never stored.)
• Subscription status — whether you have an active paid subscription, managed through Apple's in-app purchase system.

We do not collect your name, mailing address, phone number, or financial account information.

3. Data We Do Not Collect

• Email content beyond what is necessary for settlement matching
• Contact lists or address books
• Location data
• Device identifiers beyond what Apple provides to all App Store apps
• Browsing history

4. How We Use Your Data

We use the data we collect solely to:

• Identify class action settlements you may qualify for based on your Gmail history
• Display your matched settlements and estimated payouts within the App
• Maintain a record of claims you have filed for your reference
• Filter settlements based on your state of residence

We do not use your data for advertising, profiling, or any purpose other than providing the App's core functionality.

5. Third-Party Services

• Google LLC — Gmail API, governed by Google's Privacy Policy. Our use of Gmail data complies with the Google API Services User Data Policy, including the Limited Use requirements.
• Apple Inc. — In-app purchases and App Store distribution, governed by Apple's Privacy Policy.
• Supabase — Hosts our database, including both the settlements listings (public court records) and your account data (email address, state, filed claims). Data is stored in the United States. Supabase's privacy practices are described at supabase.com/privacy. Your data is accessible only through our API and is not shared with Supabase for any other purpose.
• Anthropic — Processes short email snippets (see "AI-assisted match confirmation" above) and settlement text to power matching and eligibility explanations within the App. Anthropic does not use this data to train its models. Anthropic's privacy practices are described at anthropic.com/legal/privacy.

6. Data Security

We apply the following safeguards to protect your data:

• Encryption in transit — all communication between the App and our servers, and between our servers and Google, Supabase, and Anthropic, is encrypted via TLS (HTTPS).
• Encryption at rest — account data (email address, state, filed claims) stored in our Supabase database is encrypted at rest.
• On-device token storage — your Gmail OAuth token is stored in Apple's Keychain, the operating system's dedicated secure storage for sensitive credentials, not in application files or plaintext.
• Least-privilege processing — email snippets sent for AI-assisted match confirmation (see Section 1) are processed in memory for the duration of a single request only and are never written to disk, a database, or a log.
• Access controls — server-side account data is reachable only through our authenticated API; no third-party service we use has standing access to it beyond what's described in Section 5.

7. Data Retention and Deletion

We retain your account data (email address, state, filed claims) on our servers for as long as you use the App. You can permanently delete your account and all associated server-side data at any time from within the App, under Account settings → Delete Account — this takes effect immediately, no waiting period. You can also request deletion by contacting us at [email protected].

Uninstalling the App removes all locally stored data (scan results, subscription status, cached claims). It does not automatically delete your server-side account data; use the in-app Delete Account option or contact us if you also want that removed.

To revoke Gmail access, go to your Google Account settings at myaccount.google.com/permissions, find GetPayout, and remove access. You can also disconnect from within the App under Account settings.

8. Children's Privacy

GetPayout is not directed at children under 13. We do not knowingly collect information from children under 13. If you believe a child has provided us with information, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date above and, where appropriate, through the App. Your continued use of GetPayout after changes constitutes acceptance of the updated policy.

10. Contact

If you have questions about this Privacy Policy or your data, contact us at:

[email protected]
Costa Technologies
Atlanta, GA