Stay

Gmail safety

How Stay handles email access when Gmail ingestion ships. Last updated September 2026.

Status

Gmail travel ingestion is not live yet. The connect endpoint returns 501 until Google OAuth credentials and Cloud Application Security Assessment (CASA) are complete. You can still build your travel profile from Stay bookings and manual wallet setup.

What we will request

Stay requests only gmail.readonly. This permission technically allows an app to view Gmail messages and settings. Stay limits its API calls to searches for recent booking, reservation, confirmation, and itinerary messages. It requests message metadata and snippets only; it does not request attachments, send email, modify messages, or access contacts or calendars.

How Google data is used

Message snippets are processed transiently on Stay's servers to infer travel signals, such as hotel-chain preferences. Raw messages and snippets are not retained. The saved result is limited to derived travel preferences and a last-sync timestamp. Gmail data and its derivatives are not sent to advertising systems, Customer.io, or language-model providers, and are not used to train generalized AI models.

Stay's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

How tokens are stored

OAuth access and refresh tokens must be sealed with AES-256-GCM before they can be written to oauth_connections.tokens_enc. Gmail connection fails closed if encryption is unavailable. Tokens never appear in client-side code or language-model prompts.

Revocation and purge

Use Disconnect Gmail in Stay, or revoke Stay from your Google Account settings, at any time.
In-app disconnect attempts to revoke the token at Google, immediately deletes Stay's local token record, and removes Gmail-derived travel preferences.
Account deletion from Stay wipes OAuth tokens and vault data immediately.

Compliance path

Reading travel confirmation emails requires Google's restricted scopes. Before production activation we will complete Google's OAuth verification and any independent Cloud Application Security Assessment (CASA) Google assigns. Stay does not claim CASA verification until that process is finished.