Privacy by design: how Rewado earns trust without selling you
A walkthrough of every place data touches our system, and the engineering decisions that keep your personal information out of the equation.
When you build a rewards app powered by people’s inboxes, the only thing that matters is whether you can be trusted. Here’s exactly what happens when you connect Gmail to Rewado.
On-device first, server-side last
Every screenshot you upload is processed locally: Apple Vision on iOS, ML Kit on Android. The OCR and brand detection happen on your phone. Only the anonymized brand metadata is sent to our servers.
For email, we use Gmail’s read-only scope and apply a server-side filter so we only ever fetch messages from brand senders you’ve individually approved. We can’t read personal mail. The Google API enforces this at the protocol level. It’s not just our promise.
What we hash, what we keep
| Data | Where it lives | Retention |
|---|---|---|
| Message IDs | SHA-256 hashed on-device | Indefinite (hashed) |
| Brand sender domain | Server | Indefinite |
| Email subject line | Server (anonymized) | 90 days |
| Personal email address | Never stored | N/A |
| Screenshot image | Never uploaded | N/A |
The architecture
Phone (Gmail SDK)
↓ filter by opted-in senders
↓ hash message IDs (SHA-256)
↓ strip personal identifiers
EU edge function (Frankfurt)
↓ anonymize, aggregate
↓ append to brand-level analytics
Postgres (encrypted at rest)There is no path from a row in our database back to you. Even with full database access, an attacker would see brand-level aggregates, not user-level rows.
What we sell
Pattern data, at the brand level:
- “Brand X sent 4.2 emails per week to opted-in users in March”
- “Brand Y’s average subject-line length grew 18% YoY”
- “Push notifications from category Z peaked at 7pm local”
That’s the product. The companies running these brands pay us for that intelligence. You get a cut for letting your messages contribute to the dataset.
Auditability
Every data flow is documented in an internal GDPR data map, available on request. Email us and we’ll send it. You can disconnect your email integration any time from Settings → Privacy. Account deletion fully erases your row within 30 days, per Article 17.
If you spot something we should explain better, write us at support@rewado.io.