Privacy

Depending on how you use Reforra, we may collect:

• Account details from sign-in (for example Google), such as name and email.
• The public nickname you choose to show with referrals you publish.
• Referral links, notes, and related content you choose to publish.
• Brand requests you submit when a brand isn’t in the catalog yet.
• If you connect Gmail: your Gmail address and encrypted Google access tokens (see “Gmail and Google user data” below).
• Basic technical data needed to keep the site working (such as cookies for your session).

We use this information to:

• Operate Discover, Publish, and My Referrals.
• Search your Gmail for referral links, only after you connect Gmail and run a search.
• Display your published referrals using your chosen public nickname.
• Review brand requests and keep the catalog trustworthy.
• Moderate content and fix problems during Soft Launch.
• Respond when you contact us.

Referral links appear on Reforra only when you choose to publish them. We never publish referral links on your behalf. You can edit or remove your referrals at any time from My Referrals.

Connecting Gmail in Referral Finder is optional. If you connect it, Reforra requests Google’s read-only Gmail permission (gmail.readonly). Reforra can’t send, change, or delete your email.

What we access. When you connect, we read your Gmail address. When you run a search, we ask Gmail for up to 25 emails from the last 365 days that match referral-related keywords (Gmail’s Social and Forums categories are excluded). For those emails we access message headers, such as sender, subject, and date, and the message text needed to identify referral links and rewards. We don’t download attachments.

Why. To detect referral links and reward details and show them to you in Referral Finder. Detection uses Reforra’s own rules. If you find a referral you want to share, you can choose to publish it on Reforra. Nothing is published automatically — a referral is published only if you select it and confirm it on Publish.

What we store. Your Gmail address; your Google access tokens, encrypted (AES-256-GCM) before they’re saved; and connection details (status, when you connected, when you last searched, and the last error type). We don’t store email content — message text, subjects, senders, and headers aren’t saved in our database. Search results are sent to your browser for you to review in Referral Finder. They may include the referral link and the original link found in the email, brand and brand domain, reward details, the sender’s display name (not their email address), sender domain, subject, received date, the Gmail message ID, and labels from Reforra’s rules describing the email. Full message text isn’t sent to your browser. If you select a referral to publish, the selected referral link and brand details are carried to Publish in your browser (in the page address and your browser’s session storage) so you can review them there. Email text isn’t included. If you confirm on Publish, it becomes one of your published referrals: the link and the details you confirm are saved and shown to other Reforra visitors like any other referral you publish, and you can edit or remove it in My Referrals. The email itself is never published.

How long we keep it. An active Gmail connection stays stored until you disconnect it, or until Reforra removes it because Google access is no longer valid. If access stops working, the connection may be marked as needing reauthorization, and you may need to reconnect Gmail. You can still disconnect it in Referral Finder. When you disconnect, we ask Google to revoke our access and delete the stored connection, including the encrypted tokens. If you remove Reforra’s access from your Google Account, Reforra finds out the next time it tries to use the connection, such as when you search your email. You can also email us to request deletion. See Gmail connection help for step-by-step instructions.

Service providers. Reforra uses service providers such as Vercel and Neon to host and operate the application. Gmail search runs on Vercel, and the database that holds the stored Gmail connection is hosted by Neon.

What we don’t do with Gmail data. We don’t sell it, use it for advertising, or send email content to AI or large language model providers. We don’t use it to train AI models.

Reforra’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We do not sell your personal information.
• We do not show your email or sign-in identity on public pages.
• We do not create Reforra-hosted short links that track you across the web.
• We do not ask for your phone number to publish a referral.

Referral programs are operated by the brands themselves. If someone follows one of your referral links, that brand’s own privacy policy and terms apply.

If you have questions about this Privacy Policy, we’d be happy to help.

hello@reforra.co