Privacy Policy

Effective date: June 25, 2026 · Last updated: June 25, 2026

Plain-language summary: When you sign in and turn on email forwarding, Roundtrip Returns receives the receipt emails you forward to us (either one-by-one or via a filter rule you set up in your inbox). We use them to figure out the merchant, item, price, and return deadline — then sync that to your devices and delete the raw email after 7 days. We never connect to or read your inbox directly. Manual entry still works with no account at all.

This Privacy Policy explains how the Roundtrip Returns app and service (“Roundtrip,” “we,” “us”) handle information. It applies to the Roundtrip iOS app and the Roundtrip backend service (collectively, the “Service”), operated by Galeworks (the “Publisher”).

1. The short version

• We never access your inbox. Roundtrip does not connect to Gmail, Outlook, iCloud, or any other email account. We don’t ask for inbox permissions; we never have. We only ever see what you (or a filter rule you control) forward to us.
• Manual entry still works with no account. You can use Roundtrip entirely on-device, with no sign-in, by typing in returns yourself. Sign-in only unlocks email forwarding and multi-device sync.
• Sign-in uses Apple. When you sign in, we use Sign in with Apple. We never see your password, and you can use Apple’s private email relay.
• We delete raw forwarded emails after 7 days. Once parsed, we keep only the structured return data (merchant, item, price, dates). The original email is removed automatically.
• No ads, no behavioral tracking. We don’t use advertising identifiers, third-party trackers, or build profiles for advertising.
• You can delete everything. “Delete account & data” in the app wipes your account, server-side records, raw emails, and device tokens permanently.

2. What information we handle

2a. On your device (whether or not you’re signed in)

• Returns you add yourself, their deadlines, and your recovery history.
• App preferences (intro completion, notification choices, last sync timestamp).
• A session token in the iOS Keychain after sign-in.

2b. On our servers (only if you’re signed in)

We do not collect: your email password or inbox credentials, your card or bank information, your shipping address, your other purchases or browsing activity, location, contacts, photos, or advertising/tracking identifiers.

3. How email forwarding works

Forwarding is opt-in. When you set it up, you choose one of two paths:

1. One-off forward. You forward an order email manually, when you feel like it, to your private alias. Each forward is an explicit, individual act by you.
2. Auto-forwarding filter. You set up a rule inside your own email client (Gmail, Outlook, iCloud, etc.) that auto-forwards messages matching certain retailer domains to your alias. The filter lives in your inbox, not ours. You can edit or delete it at any time, in your inbox. We never touch your inbox.

When a forwarded email arrives at your alias, our server:

1. Looks up which user the alias belongs to.
2. Extracts the email subject and body, in plain text.
3. Sends it to the Claude API (operated by Anthropic, our parsing sub-processor) to extract structured fields (merchant, item, price, dates). The API request is subject to Anthropic’s enterprise data-handling terms; data is not used to train Anthropic models.
4. Validates and stores the parsed fields as a return record on your account.
5. Notifies your signed-in devices, which sync the new return.
6. Schedules the raw email body for deletion no later than 7 days from receipt.

If parsing fails or confidence is low, the return is marked for your manual confirmation — we never silently create wrong records.

4. Sign in with Apple

We use Sign in with Apple as our only sign-in method. We receive:

• A stable Apple user identifier (sub).
• The email address you choose to share (which can be Apple’s private relay, masking your real address).
• Your name on first sign-in, if you choose to share it.

We don’t receive your Apple password and can’t see your other Apple data.

5. Sub-processors

We use the following providers to operate the Service:

Each sub-processor is bound by its own data-processing terms. The Publisher is the data controller; sub-processors are data processors acting on our behalf.

6. Retailer return policies and hand-off

Roundtrip shows publicly available return-window information for retailers (for example, “30 days from delivery”). This is general reference data — the same information published on a retailer’s own website — and is not tied to you.

When you start a return, Roundtrip opens the retailer’s own returns website in an in-app browser so you can complete the transaction there. Once you’re on the retailer’s site, that retailer’s own privacy policy and terms apply to your activity there. Roundtrip does not transmit your Roundtrip data to retailers.

7. Notifications

Roundtrip sends two kinds of notifications:

• Local deadline reminders and the weekly digest — scheduled by your device from the returns you have. These don’t require us to receive your data.
• Push notifications (APNs) — sent from our server when a forwarded receipt has been parsed into a new return. These contain a brief title/body (e.g. “Best Buy return added — 8 days”) and a record identifier so the app can open to that return.

You can turn either category off in iOS Settings → Notifications → Roundtrip.

8. Subscriptions and billing

Email forwarding may be offered as a paid feature in a future version; manual entry will always remain free. When paid tiers exist, we use Apple’s StoreKit to process payments through your App Store account, and we receive only the subscription status (active, trial, expired, refunded) needed to gate the feature. We never see your card number or App Store payment details.

See the Terms of Service for trial terms, pricing, and renewal details when applicable.

9. Data retention and deletion

• Manual entry only (no account): your data persists on your device until you delete returns or the app.
• Signed in:
  • Raw forwarded emails: deleted after 7 days.
  • Parsed return records: kept until you delete the return or the account.
  • Push tokens: kept until the device unregisters.
  • Service logs: up to 30 days.

You can permanently delete your account and all server-side data from Settings → Delete account & data. This triggers DELETE /account on our server, which removes your user record, parsed returns, raw emails (if any remain in-window), device tokens, and subscription association. We retain only what’s required by law (e.g. tax records for any payments processed) and fully-anonymized aggregate analytics.

10. Security

We use:

• TLS for all client-server traffic.
• Row-Level Security in the database — users can only ever read or write their own rows.
• Verified Sign in with Apple identity tokens.
• Webhook authentication on inbound email — only our email provider can call the parse endpoint.
• Secrets stored in our hosting provider’s secret store, never in the app binary or source.
• Rate limiting per user and per alias to mitigate spam/abuse.

No system is perfectly secure. We will notify affected users without undue delay in the event of a personal-data breach as required by applicable law.

11. Children’s privacy

Roundtrip is intended for a general adult audience and is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect information from children. If you believe a child has provided information, contact us and we will delete it.

12. Your rights (GDPR / CCPA / similar)

You have the right to:

• Access the data we hold about you (sign in and view your returns; or request a complete export by emailing us).
• Correct inaccurate data (edit returns in-app; contact us for account data).
• Delete your data (in-app: Settings → Delete account & data).
• Port your data (Export everything → JSON file).
• Object to processing for specific purposes, where applicable.
• Withdraw consent at any time by deleting your account.

To exercise any of these rights, contact us at the address below. We respond within 30 days.

For users in California: we do not sell or share personal information for cross-context behavioral advertising as defined by the CCPA/CPRA.

13. International transfers

We operate the Service primarily from the United States. If you use the Service from outside the United States, your data may be transferred to, processed, and stored in the United States. By using the Service, you consent to this transfer.

14. Changes to this policy

If we change how the Service handles information, we will update this policy and revise the “Last updated” date. Material changes — for example, a new sub-processor or a change to how forwarded emails are handled — will be announced in-app with at least 30 days’ notice before they take effect.

15. Contact

Questions, complaints, or rights requests:

• Email: hello@roundtripreturns.app
• Website: roundtripreturns.app
• Publisher: Galeworks