1. Overview
Sancho helps users organize personal expense information from financial transaction notifications they already receive by email. This Privacy Policy and Terms page explains what data Sancho accesses, why it is accessed, how it is stored, how it is used, and how users can disconnect access or request deletion.
Sancho is not a bank, financial institution, credit bureau, accounting firm, tax advisor, legal advisor, or investment advisor. Sancho does not initiate payments, move money, approve transactions, provide credit decisions, or provide financial, legal, tax, or investment advice.
2. Email and Google Data Sancho Accesses
When a user chooses to connect Gmail, Sancho requests Google OAuth permissions for sign-in identity information and read-only Gmail access. This may include the user's Google email address, basic profile information returned by Google, OAuth access and refresh tokens, token expiration information, the scopes granted by the user, Gmail message identifiers, thread identifiers, selected message headers such as subject, sender, and date, message snippets, and the body text of messages that match transaction-search rules.
Sancho uses the Gmail read-only permission only to search for and read email messages that appear to be financial transaction notifications, such as card purchase alerts or bank transaction notices. Sancho does not request permission to send email, delete email, modify email, create drafts, manage labels, or access unrelated Google services.
Sancho may also connect to Outlook, Yahoo, or IMAP mailboxes when the user chooses those options. Those providers are handled separately from Google data, but Sancho applies the same core principle: email access is used only to identify and organize user-facing expense information requested by the user.
3. Why Sancho Accesses Email Data
Sancho accesses selected email data to provide the expense dashboard and related features shown in the application. The app reads supported transaction notifications, extracts expense information such as date, merchant, amount, currency, card name, card last four digits when available, category or expense type, and confidence score, and displays that information to the user.
Sancho uses this data to help users search transactions, review spending, categorize expenses, export reports, refresh recent transactions, create budgets or monthly objectives, and receive expense summaries or scheduled reports when enabled. Email reports are disabled by default. Users must enable reports, select a frequency, confirm the recipient, and save their choice; they can turn reports off through the same controls.
Sancho does not use Gmail data for advertising, retargeting, credit scoring, selling user profiles, building unrelated datasets, or training generalized artificial intelligence models.
4. What Sancho Stores
Sancho stores hashed browser session tokens and their expiration dates, the user's account record, email address, name when provided by the email provider, timezone, connected provider records, encrypted OAuth access and refresh tokens, token expiration dates, granted scopes, import settings, last import timestamps, and user preferences required to operate the service.
For imported messages, Sancho stores source metadata such as provider name, provider message ID, thread ID, subject, sender, received date, a short snippet, a one-way hash of the raw message text, and parse status. Sancho does not store the full raw Gmail message body after parsing; it stores only the metadata and parsed expense information needed to operate the dashboard.
For transactions, Sancho stores parsed fields such as date, merchant, amount, currency, card name, card last four digits when available, category or expense type, comments, confidence score, and whether the item needs review. Sancho also stores optional report preferences, monthly objectives, and other settings the user configures.
5. How Sancho Protects Data
Sancho stores OAuth tokens and mailbox passwords, where applicable, in encrypted form. The app uses database access controls and application-level authorization so each user can access only their own imported data.
Sancho does not allow humans to read Google user data, including email-derived transaction data, unless the user has given documented, explicit consent to view specific data; access is necessary for security purposes, such as investigating a security bug or abuse; access is necessary to comply with applicable law; or the data is aggregated and anonymized for internal operations in accordance with applicable law. A general support request does not authorize access to messages or transaction records. These restrictions apply to employees, contractors, service providers, and successors.
No internet-connected service can guarantee perfect security. Users should connect only email accounts they are authorized to use and should revoke access if they no longer want Sancho to process their email notifications.
6. Sharing and Transfers
Sancho does not sell Google user data or email-derived transaction data. Sancho does not share Google user data with advertisers or data brokers.
Sancho uses service providers for hosting, databases, authentication, email delivery, monitoring, and infrastructure. Transfers of Google user data to these providers are limited to what is necessary to provide or improve the visible, user-facing features described in this policy and require the user's consent, except for the security and legal exceptions described below. Providers must follow the same Limited Use restrictions and may not use the data for their own unrelated purposes. Expense reports sent by email are processed by the email delivery provider and delivered to the recipient configured in Sancho.
When you contact Sancho, we use your name, email address, request type, and message to respond to your request. Contact messages are delivered to our support team. Our public contact form uses Cloudflare Turnstile to prevent automated abuse; Cloudflare processes verification information such as browser and network signals for this purpose.
Sancho's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. Google API Limited Use Disclosure
Sancho uses information received from Google APIs only to provide or improve user-facing features that are prominent in Sancho, including connecting Gmail, importing transaction notifications, extracting expense details, displaying the expense dashboard, refreshing recent transactions, and producing user-requested reports.
These restrictions apply to raw Google user data and data derived from it, including transaction records, summaries, and anonymized or aggregated information. Sancho transfers this data only as necessary to provide or improve the visible, user-facing features with the user's consent, for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets after obtaining the user's explicit prior consent. Notice alone does not authorize a transfer in a merger, acquisition, or sale.
Sancho does not sell Google user data, use it for advertising or retargeting, transfer it to data brokers, or use it to determine creditworthiness or for lending. Human access is subject to the restrictions in section 5. Sancho uses local parsing rules and calculations for expense extraction, categorization, and insights; it does not send Google user data or email-derived transaction data to third-party AI or machine learning services, or use that data to create, train, or improve AI or machine learning models.
8. User Control, Disconnecting Access, and Deletion
Users can stop future Gmail access at any time by revoking Sancho's access in their Google Account permissions page at https://myaccount.google.com/permissions. Revoking access stops Sancho from using Google OAuth tokens to read future Gmail data, but it does not automatically delete transaction records already imported into Sancho.
Signing out revokes the current browser session on the server. Browser sessions expire 30 days after sign-in; signing in again is required after expiration. It does not disconnect a mailbox, stop scheduled imports or reports, or delete stored account data. To stop future Gmail access, revoke access in your Google Account. To request removal of a connected mailbox record and its stored credentials, contact Sancho support.
To delete your Sancho account, submit a Data deletion request through the Contact Us page at /contact-us, or email gvinueza@gmail.com. Include the email address associated with your Sancho account and specify that you want the account and its data deleted. The request is handled manually; submitting the form does not immediately delete data. Sancho will verify account ownership using the account email and will never ask for your Google password, OAuth tokens, or full payment card number.
Within 30 days after verifying account ownership, Sancho will stop account imports and scheduled reports and delete the account record, browser sessions, connected mailbox records and stored credentials, OAuth tokens, source message metadata, imported and manually entered transactions, report preferences, and monthly objectives from active application systems. Sancho will confirm completion by email and explain any limited records that must be retained, the reason, and the applicable retention period. This deletes Sancho's copies; it does not delete messages in your mailbox or reports and exports already delivered outside Sancho. Backup copies are handled as described in section 9.
9. Data Retention
Sancho keeps user data while the user's account remains active or while needed to provide the requested service. Imported transaction records and source message metadata are retained so the user can view historical spending and avoid duplicate imports.
When a user disconnects Gmail, Sancho stops future Gmail access after the provider revocation takes effect. Existing imported records remain available in the user's Sancho account unless the user requests deletion.
After an account deletion request, any exception to deletion is limited to records necessary for applicable legal obligations, security, fraud prevention, or resolving a specific dispute, and only for as long as that reason applies. This does not authorize continued expense analysis, imports, or reports. Minimal records of the deletion request and its completion may be retained to document that the request was honored.
The 30-day deletion commitment covers active application systems. Residual copies in backups are removed as those backups expire under the infrastructure provider's retention schedule. Backup copies are retained for no more than 180 days after deletion from active application systems. Backups are not used for ongoing product features. If a backup is restored, completed deletion requests must be reapplied before the restored data is returned to normal use.
10. Accuracy and User Responsibility
Sancho uses automated parsing rules and heuristics to identify transaction information. Extracted data may be incomplete, duplicated, incorrect, delayed, or require manual review.
Users are responsible for reviewing, correcting, and validating information before relying on it for budgeting, accounting, tax, reimbursement, or business purposes.
11. Third-Party Services
Sancho depends on third-party providers such as Google, Microsoft, Yahoo, email hosting providers, cloud hosting platforms, databases, and email delivery providers. Availability, permissions, account access, API limits, provider policies, and outages may affect the service.
Sancho is not responsible for interruptions, restrictions, permission changes, or data issues caused by third-party services.
12. Changes and Contact
Sancho may update this Privacy Policy and Terms page from time to time. If Sancho materially changes how it accesses, uses, stores, or shares Google user data, Sancho will update this page and request any consent required before using Google user data in a new way.
Questions, privacy requests, and deletion requests can be submitted through the Contact Us page. Users should include the email address associated with their Sancho account so the request can be verified.