PRIVACY · OCTOBER 21, 2026

Your inbox is personal.

Display Tips is operated by Rand Richter. This policy covers displaytips.com and the cloud app at app.displaytips.com. Contact support@displaytips.com for support, privacy requests, or deletion help.

Your account

Google sign-in gives us your verified email address and a stable Google account identifier. We store account settings, service selections, your terms acceptance date, and a secure session. Creating an account does not grant Gmail access. We do not collect a Google password. Account information stays until you delete your cloud account.

Connecting Gmail is optional and separate

If you explicitly connect it, Google grants read-only mailbox access, not access limited to payment senders. We inspect message metadata and fetch bodies only for enabled payment services to recognize incoming USD receipts. We do not send, modify, forward, or delete your email. Pub/Sub notifications tell us to check for changes; message content is retrieved through Gmail API.

What we retain

Supported receipts are normalized to payer display name, amount, currency, optional message, timestamps, provider, and identifiers used to prevent duplicates. Diagnostic records contain hashed message identifiers, timestamps, and outcomes. These receipt and diagnostic records are removed after seven days by maintenance tasks. For account reporting and owner-operated service analytics, we also retain daily tip counts and total amounts by payment service and currency for as long as your account exists, with no automatic time limit. These summaries contain no payer names, payer messages, email identifiers, or transaction identifiers. They are associated with your account and are removed when you delete the account. Detailed receipt and diagnostic records still expire after seven days. Raw email bodies and attachments are not stored. Encrypted connection tokens remain until disconnect; an encrypted token may be retained temporarily for retrying revocation if Google is unavailable.

Security records and recovery copies

Operational monitoring uses an internal account reference, connection timestamps, fixed error codes and aggregate security counts to detect service failures or abuse. These records are access-controlled and retained for up to seven days, with current health refreshed while a connection is active. Operator alerts contain no inbox contents, payer details, credentials or private overlay URLs.

We record the version, time, and selected services of new email/broadcast consents while the connection remains active. We retain minimal security-event counts for up to seven days and short-lived pseudonymous sign-in rate-limit counters. These records do not contain email bodies, payer messages, raw IP addresses, passwords, or access tokens. Disabling a service stops fetching its receipt bodies; disabling all services pauses message inspection.

Cloudflare storage recovery history can retain earlier copies for up to 30 days, including after deletion from the live database. Those copies are not used for ordinary application access. Recovery must occur under a maintenance lock with restored personal data and credentials removed before service resumes; it may require signing in and connecting again. We do not silently restore deleted accounts or reuse recovered Gmail grants.

What viewers can see

With your explicit connection consent, your private overlay displays payer first name and last initial (or a payer handle), amount, and payer message. Abbreviated names are still personal data. Anyone holding the private overlay link can see its alerts; displaying it in your streaming app broadcasts these fields. Keep the link private, select only the services you want, and only connect an inbox you own or are authorized to use.

Service providers and limits

Google provides identity, Gmail APIs, and notification delivery. Cloudflare hosts the app and its storage and processes technical request data to operate and secure it. See Cloudflare’s privacy policy. We do not sell Google data, use it for advertising, or send mailbox data to AI models. Display Tips’ use of Google data follows the Google API Services User Data Policy, including Limited Use requirements. We do not use advertising scripts. With your permission, Google Analytics measures public website visits and selected signup and checkout steps. It uses first-party analytics cookies shared between displaytips.com and app.displaytips.com, with a six-month cookie lifetime. Google receives browser/device and event information, clean page paths and referring website origins—not Gmail data, payer information, account identifiers, form contents, or private overlay links. Google’s script runs in an isolated public-site frame, not in your account dashboard. Advertising personalization and Google Signals are disabled. Your analytics choice lasts six months; choose “Analytics privacy” to change it or withdraw consent and clear analytics cookies at any time. Declining has no effect on the service. See Google’s privacy policy.

Subscription billing

Stripe collects and stores payment-card and billing-address information in its hosted checkout and customer portal. Display Tips does not receive or store your full card number or security code. We keep an opaque account reference, Stripe customer and subscription identifiers, plan, subscription status, billing dates and trial-use history to manage access and prevent duplicate trials. We do not send Gmail tokens, email bodies, payer messages or tip records to Stripe. Stripe processes billing information under its privacy policy.

Deleting Gmail and tip data does not erase financial records held by Stripe. Minimal billing identifiers, subscription and trial history, and deletion safeguards remain separately after account deletion to resolve billing and prevent duplicate charges or trials. Contact support for a billing-data deletion request; records required for accounting, disputes or legal obligations may need to be retained.

Affiliate program

If you join our affiliate program, we store your profile, public channel URL, chosen promo code, consent, attributed subscription references, commissions and payout history separately from Gmail and tip data. A first-party referral cookie can remember an affiliate code for up to 30 days so a shared link can apply it at checkout. The affiliate sees their earnings, not subscriber identities or mailbox data. Minimal financial records can remain after app account deletion for accounting, refunds and disputes. Contact support to close an affiliate account.

Your controls

Choose services independently, disconnect Gmail to stop processing, replace a private overlay link, or delete your cloud account and stored tip records from the dashboard. Source emails are never deleted by these actions. Sign out ends your dashboard session but does not stop the listener. You can also revoke Display Tips in your Google Account. The old local app is separate and is not disconnected or deleted by cloud controls.

Service availability

Provider emails and network delivery may be delayed or missing. The service is not a financial ledger or an instant-delivery guarantee. For questions or data requests, contact the operator above.