Couch Cushions Privacy Policy

Couch Cushions ("Couch Cushions," "we," "us") is a consumer web app at couchcushions.app, operated by Estimate Lab of Orlando, Florida. It helps you find class action settlements, refunds, and unclaimed property you may qualify for by looking for evidence (settlement notices, receipts, order confirmations) in the email account you connect.

This policy explains what we access, what we keep, who we share it with, and how to delete it. It is written to be read. If anything is unclear, email support@couchcushions.app.

The short version

• We ask Google for read-only access to Gmail. We can't send, delete, label, or change your mail.
• We read messages in memory to look for matches, then discard them. We never store full email bodies.
• We keep only match metadata plus short (240 characters or fewer), redacted evidence snippets that prove why you qualify.
• No ads. No selling or renting your data. No using your data to train AI models. No people at Couch Cushions read your email.
• Delete everything at any time with one button. Deleting your account also revokes our Google access.
• We are not a law firm and we never file claims for you.

1. Google user data (Gmail)

1.1 What we request and why

When you choose to connect your Google account, we request these permissions:

We do not request any permission to send, delete, modify, or label your mail.

1.2 How we use Gmail data

We use Gmail data only to provide the features you see in the app:

1. Finding matches. We run targeted searches (for example, emails from a company with an open settlement during that settlement's class period, emails from known claims administrators, or emails containing phrases like "notice of settlement"). We read the matching messages to decide whether they are real evidence, and to pull out the claim deadline, the settlement name, the order number, the date, and the amount.
2. Showing proof. Each match shows why you may qualify (for example, "14 CVS receipts, March 2021 to August 2025"), with short redacted snippets you can review.
3. Claim help. Prefilling the official claim form with details you approve, and building a proof-packet PDF you can download and attach yourself.
4. Tracking money owed and paid. Detecting payout emails (PayPal, Venmo, check, ACH, prepaid card), refunds that never arrived, and duplicate charges.
5. Watching breach notices. If you received a data-breach letter and no settlement exists yet, we remember the company and sender domain so we can tell you when one opens.
6. Reminders. Emailing you (if you leave reminders on) before a matched settlement's deadline, plus an optional weekly summary.
7. Daily re-checks. While your account is active, we re-run the search once a day so new notices and receipts show up without you doing anything. You can stop this at any time by deleting your account (which revokes access) or by revoking access in your Google Account settings.

We do not use Gmail data for advertising, to build profiles for anyone else, to decide creditworthiness or lending, or for any purpose other than the features above.

1.3 What we store, and what we never store

We store (in our database, tied to your account):

• Match records: the settlement or item matched, the sender domain(s), how many matching emails we found, the date range, the claim deadline, our confidence level, an estimated payout, and a one-line summary we write (for example, "Settlement notice from epiqnotice.com on 2026-09-14").
• Evidence snippets: for each match, up to about 12 pieces of evidence per mailbox, each with the merchant, date, amount and order number when present, a Gmail message ID (a reference so the app can point you to the email; it is not the content), and a snippet of 240 characters or fewer built from the subject line and Gmail's short preview text, with identifiers removed (see 1.4).
• Payout, refund, and breach-watch records: payer or merchant, amount, method, date, whether a prepaid card email contained a redemption code (yes/no, never the code), and its expiry date.
• Whether a settlement notice contained a Unique ID or PIN (yes/no, never the ID or PIN itself).
• Your Google sign-in tokens (OAuth access and refresh tokens), so the daily re-check can run. They are encrypted at rest with AES-256-GCM (see section 6).

We never store:

• Full email bodies or attachments.
• Claim Unique IDs, PINs, passcodes, prepaid card redemption codes, or security codes.
• Full card numbers (we keep at most the last four digits if they appear in a snippet), Social Security numbers, or bank account and routing numbers.

1.4 Redaction

Before anything derived from an email is saved, or shown in a proof packet, it passes through our redaction step. It removes values labeled as Unique IDs, claim or class-member IDs, PINs, passcodes, access, redemption, security, and verification codes, and passwords. It also removes Social Security numbers, full card numbers (keeping the last four digits), account and routing numbers, long tokenized links, and long opaque codes.

1.5 No AI providers

All matching is done by deterministic rules on our own servers. We do not send your email data, or anything derived from it, to any AI provider. We do not use your data to train, fine-tune, or improve any AI or machine-learning model, ours or anyone else's. If we ever add AI classification, we will update this policy and ask for your consent before it applies to you.

1.6 Google API Services User Data Policy: Limited Use

Couch Cushions' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• We use Google user data only to provide or improve the user-facing features described in section 1.2, which are visible and prominent in the app.
• We transfer Google user data to others only as needed to provide those features (to the service providers listed in section 3, with your consent given by connecting your account), for security purposes such as investigating abuse, to comply with applicable law, or as part of a merger, acquisition, or sale of assets, and only after getting your explicit prior consent.
• We do not allow humans to read your Google user data unless you first give us affirmative agreement to view specific messages (for example, when you ask support to look at a specific match), it is necessary for security purposes such as investigating a bug or abuse, it is necessary to comply with applicable law, or the data is aggregated and anonymized and used for internal operations in line with applicable law.
• We do not transfer or sell Google user data to advertising platforms, data brokers, or information resellers. We do not use it for serving ads (including retargeting or personalized or interest-based advertising), or to determine creditworthiness or for lending purposes.
• We do not use Google user data to create, train, or improve any machine learning or artificial intelligence model.

Our employees, agents, contractors, and successors are bound by these same requirements.

2. Other information we collect

• Account information: name, email address, and profile picture from Google; your plan (Free or Pro); your settings (reminders, weekly digest).
• Information you type in: your claim-form profile (name, address, phone, email, states you've lived in) and the same for any household members you add. We use it only to prefill claim forms and unclaimed-property searches. Only add a household member with their permission.
• Claim activity: which claims you've queued, filed, been approved for, or been paid on; the confirmation numbers you paste back; and the per-claim attestation you give (the attestation text and when you agreed).
• Other mailboxes and imports (only if you connect them): Outlook (Microsoft, read-only Mail.Read) or other IMAP mailboxes via an app password, and Amazon order-history files you upload. We handle these the same way as Gmail: read in memory, store only match metadata and redacted snippets. Their credentials are encrypted at rest. [These features are off at launch; remove this bullet if they ship later, and update the policy when they do.]
• Payment information (Pro): handled by our payment processor [Stripe]. We receive your subscription status and the last four digits and expiry of your card. We never see or store your full card number.
• Waitlist: if you join our waitlist, your email address and where you heard about us.
• Technical data: a session cookie to keep you signed in, and standard server logs (IP address, browser type, timestamps, errors) kept by our host for security and debugging. We do not use advertising or cross-site tracking cookies. [Update if analytics are added.]
• Calendar feed: if you subscribe to your deadline calendar, a secret link token. Anyone with the link can see your deadlines, so treat it like a password. You can reset it [feature TBD] or delete your account to invalidate it.

3. Who we share information with

We do not sell, rent, or trade personal information, and we do not share it for cross-context behavioral advertising. We share it only with service providers who process it on our behalf to run the app, under contracts that limit their use to that purpose:

We may also disclose information if required by law, subpoena, or court order; to protect the rights, safety, or security of our users, the public, or Couch Cushions; or in connection with a merger, acquisition, or sale of assets. For Google user data, we do this only after obtaining your explicit prior consent.

We never share your information with settlement administrators, law firms, or the companies being sued. When you file a claim, you submit it on the administrator's official website.

4. How long we keep it

• While your account is active, we keep your matches, evidence snippets, claims, and settings so the app works.
• Email content is held in memory only while it is being checked (seconds) and is never written to our database.
• When you delete your account, we revoke our Google access and permanently delete your account and everything linked to it (matches, evidence, claims, payouts, watchlist, household profiles, connected sources, sessions, and tokens) from our production database right away. Copies in our database provider's encrypted backups age out within [7 / 30] days.
• Inactive accounts: [Decision: e.g., if you haven't signed in for 24 months we will email you and then delete the account 30 days later.]
• Waitlist emails are deleted when you ask or [12 months] after launch if you never sign up.

5. Your choices and rights

• Delete everything: Dashboard, then Settings, then Delete my account & data. It is immediate and cannot be undone.
• Revoke Google access at any time at https://myaccount.google.com/permissions. The app will stop reading your mail. Your saved matches remain until you delete your account.
• Dismiss any match you don't want to keep.
• Turn off reminder emails and the weekly digest in Settings.
• Access, correct, or get a copy of your information: email support@couchcushions.app. Depending on where you live (for example California, Colorado, Connecticut, Virginia, or other states with consumer privacy laws), you may have rights to know, access, correct, delete, and port your personal information, and to opt out of sale, targeted advertising, or profiling. We don't sell or use your data for targeted advertising or profiling. We will respond within the time the law requires and won't discriminate against you for exercising your rights. You may use an authorized agent; we may need to verify your identity.

6. Security

• All traffic uses HTTPS (TLS). Our database is encrypted at rest by our provider.
• Credentials for other mailboxes (Outlook tokens, IMAP app passwords) are encrypted with AES-256-GCM before storage. Google OAuth tokens (access, refresh, and ID tokens) are encrypted at rest with the same scheme.
• Access to production systems is limited to the account owner, protected with multi-factor authentication [confirm], and logged.
• We complete an annual independent security assessment (Google's Cloud Application Security Assessment, CASA) as required for apps with restricted Gmail access. [Once completed.]
• No method is 100% secure. If we learn of a breach affecting your information, we will notify you and the authorities as the law requires.

7. Children

Couch Cushions is for adults. You must be 18 or older to use it. We do not knowingly collect information from children under 13 (or under 18). If you believe a child has signed up, contact us and we'll delete the account.

8. Not legal advice

Couch Cushions is not a law firm and does not give legal advice. We do not file claims for you. You are responsible for confirming your eligibility on the official settlement website and for submitting truthful claims, which are often signed under penalty of perjury.

9. Changes to this policy

If we change how we use Google user data, or make any other material change, we will tell you in the app and by email before the change takes effect. Where the law or Google's policy requires it, we will ask for your consent before using your data in a new way. The "last updated" date above shows the latest version.

10. Contact

Couch Cushions, operated by Estimate Lab, 9914 Mountain Lake Dr, Orlando, FL 32832
Email: support@couchcushions.app