Privacy policy

Last updated October 5, 2026.

What Magnet collects

• Your account: your email address, and your name if Sign in with Apple shares it.
• Gmail, if you connect it: Magnet reads your mail from the last 12 months, and new mail as it arrives, to find messages about orders, returns and refunds. For each refund it keeps the details (merchant, amount, dates, what the merchant said), links to the messages, and copies of attachments such as receipts. It stores an encrypted token so it can keep checking for replies and new refunds.
• Your bank or card, if you connect one: through Plaid, Magnet reads your account names and transactions to see whether a refund has arrived. It stores an encrypted Plaid token, never your bank login.
• What you add: follow-up drafts and the emails you approve, notes, searches you ask for, and any gift card or store credit you save.
• Usage: which screens you open and what you tap, and counts such as how many refunds Magnet found and how they ended, linked to your Magnet account. Screen recordings, if any, hide all text.

How Magnet uses it

Only to run Magnet for you: finding your refunds, checking they arrived, drafting follow-ups and sending the ones you approve. Magnet never sends an email you haven't approved, never sells your data, and never uses it for advertising.

Google user data

Magnet's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Magnet asks for permission to read your Gmail (to find refund emails) and to send email (only the follow-ups you approve). Your Gmail data is used only to provide Magnet's features to you. Magnet does not use it to train AI models, and no one at Magnet reads it unless you ask us to for support, it is needed for security, or the law requires it.

AI models

Magnet uses AI models to decide which of your emails are about refunds and to understand them. To do that it sends the text of emails (including ones that turn out to be unrelated), attachments and the relevant transactions to model providers: TypeSafe, and OpenAI through OpenRouter. They process it to answer Magnet's requests, under their own terms.

Who else handles your data

Service providers that run Magnet for us: Plaid (bank connections; the Plaid End User Privacy Policy covers what you share with Plaid), TypeSafe, OpenRouter and OpenAI (AI models), Railway (servers and database), Temporal (background jobs), Apple (sign-in), Resend (sign-in code emails) and PostHog (app analytics). We share data otherwise only if the law requires it.

Keeping and deleting your data

Magnet keeps your data while your account exists. Deleting your account in the app (Account) revokes Magnet's access to your Gmail and bank, deletes your refunds and everything else Magnet stores about you, and then erases your analytics data; the last steps can take a little while to finish. Server logs, which can contain your email address, are kept by our hosting provider for a limited time. You can also revoke Gmail access any time at myaccount.google.com/permissions.

Security

Gmail and Plaid tokens are encrypted at rest, and the app talks to Magnet's server over HTTPS.

Children

Magnet is not meant for children under 13.

Changes and contact

If this policy changes we will update the date above.

Questions or requests: hello@rushcutterlabs.com.