Privacy Policy
Last updated November 7, 2026
What PandaPurge is
PandaPurge ("we", "us") is a web app at pandapurge.com that finds money you're owed, charges you may not want, and risks to your identity, and tells you what to do about them. This policy explains what we collect, why, and what we never do with it.
What we collect
- Account details you give us: name, email, phone number, home address and past states, family members' names and states, vehicles, medications, products, employers, providers, loyalty programs and discount statuses (such as "student"). You choose what to add; every check uses only what you've added.
- Gmail, if you connect it: with your permission we read emails that look like receipts, renewals, free trials, flight changes and loyalty statements. We keep a short summary of each item we find (the service, the amount, the date, a one-line quote and a link back to the email). We do not keep copies of your emails, and we do not read anything unrelated to money.
- Bank or card accounts, if you connect them: through Plaid we receive transactions and balances to find recurring charges and rewards. We never see or store your bank login.
- Public and partner records: we query recall databases (NHTSA, FDA, CPSC), breach records (Have I Been Pwned), settlement and refund programs, and similar sources using the details you gave us.
- Usage: standard server logs (IP address, browser, pages visited) and the actions you take in the app, so it works and so we can fix problems.
How we use it
- To run the checks you asked for and show you the results.
- To write the step-by-step guidance, letters and answers in the app. Some of this is produced with an AI model (Anthropic's Claude). The model is given only the facts about your findings; it is not trained on your data.
- To email you a digest when something new or time-sensitive comes up. You can turn this off.
- To keep your account secure.
Google user data
If you connect Gmail, PandaPurge's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: we use your Gmail data only to find money-related items and show them to you; we do not sell it, use it for advertising, or let humans read it except to fix a problem you reported or as required by law. You can disconnect Gmail at any time under Connections, which deletes our access token; you can also revoke access from your Google Account settings.
What we never do
- We never sell your data or share it with data brokers or advertisers.
- We never store your bank password, your Social Security number, or full card numbers.
- We never take money on your behalf. Claims, refunds and cancellations go to you, in your name; we show you where and how.
Who we share with
Only the services that run the app, each under its own privacy terms: Vercel (hosting), Supabase (database), Clerk (sign-in), Resend (email), Plaid (bank connections), Google (Gmail API), Anthropic (AI text), and the public record sources named above, which receive only the details needed for the lookup (for example a VIN for a recall check). We disclose data if the law requires it.
Security
Data is encrypted in transit and at rest. Access tokens for Gmail and bank connections are encrypted with a key held separately from the database. Sign-in uses a one-time code sent to your email, or a password if you set one.
Your choices
- Edit or delete anything under Your info and Connections at any time.
- Disconnect Gmail or a bank at any time; the connection and its token are deleted immediately.
- Delete your account by emailing us; we delete your data within 30 days, except what we must keep by law.
Children
PandaPurge is for adults. We do not knowingly collect data from anyone under 18.
Changes
If this policy changes in a way that matters, we'll email you and update the date at the top.
Contact
Questions or deletion requests: privacy@pandapurge.com.