Your contacts stay yours.

What the referral experience uses

The local demonstration uses fictional contacts and a synthetic sender. No Google account is connected and no email is sent. If approved for live use, saved contacts support individual recipient selection and Gmail access supports only the emails you explicitly confirm.

What businesses can see

Businesses receive campaign-level counts, including sessions, connections, previews, and submission outcomes. They cannot view your address book, account credentials, selected recipients, or individual message content. Small aggregate counts can still reveal activity in context.

Session and message data

Unselected contacts stay in browser memory. Selected destinations and exact messages are stored as encrypted operational snapshots to support preview, sending, and your private results. Sessions are time limited; terminal batch snapshots are removed within 24 hours, and a session deletion request removes operational contact and message data while stopping pending sends.

Reward emails

Some campaigns can email you a reward code as well as showing it in the app. We only keep your verified email address for this after you explicitly opt in on the connect step, and we store it encrypted, use it only to send that reward email, and keep it only while the campaign is live plus 30 days afterwards. Deleting your session data removes it immediately, and opting out clears it as well.

Records that remain

Business-wide opt-out records do not expire automatically. Pseudonymous suppression, duplicate-prevention, security, and audit records are kept under separate retention rules. Deleting a session does not remove opt-outs, business aggregates, messages already submitted to a provider, or instantly erase time-limited backups.

Your choices

Use Session & privacy in the referral flow to disconnect or delete session data. Disconnecting stops local access and pending work; external Google grant revocation is reported separately. Emails already being submitted may still complete.

Recipients can use the control link in a referral to stop future referrals from that business or report a concern. Opening a control link never changes a preference.

Before live operation

A final notice must identify the operating entity, privacy contact, jurisdiction, processors, regions, exact retention schedules, and how to exercise applicable rights. The local draft is not a production privacy notice.