Your money and your mailbox stay yours.
UPINOW is a payment confirmation tool. It never holds or moves money. It reads your bank's payment alert email and tells you which order it pays.
UPINOW never touches your money
- Your customer's UPI app
- Your bank account
- Your bank's alert email
- UPINOW stamps the order PAID
The money never passes through UPINOW. It goes straight from your customer's UPI app to your own bank account. UPINOW only reads the alert email your bank sends about it.
Why a Gmail App Password
An App Password is a 16-letter code that lets UPINOW read this one mailbox, without your real Gmail password. It only works once your Google Account has 2-Step Verification turned on.
Today UPINOW connects to Gmail only, over IMAP. Setting one up takes five short steps:
- Open your Google Account (myaccount.google.com), then Security.
- Turn on 2-Step Verification, if it isn't already.
- Type "App passwords" in the search box and open it.
- Name the app "UPINOW", then create it.
- Copy the 16-letter password and paste it into UPINOW.
You can remove it at any time from your Google Account (Security, App passwords), independently of UPINOW.
What UPINOW reads, and what it never reads
UPINOW reads only the messages already in your inbox from the sender addresses you approve, up to 5. Of those, it reads only the headers and the first 64 KB of the message text, the part that carries the amount and the payment reference.
- It never reads the rest of your mail, your contacts or your drafts, and it never opens or keeps attachments.
- It never marks a message as read, and never moves, deletes or sends email.
Fakes cannot pass
- Every alert is checked with a DKIM signature test against the sender's own domain, so an email that only looks like it came from your bank or UPI app is rejected.
- A genuine alert only counts when it is addressed to your connected Gmail or one of the extra alert emails you added: an alert forwarded or replayed to any other address is ignored.
- Mail brought in with Gmail's "Check mail from other accounts" feature is not counted; only mail UPINOW can verify the sender of is trusted.
- Each order also has its own payable amount, down to the paisa, so alerts cannot be matched by guesswork.
What we store, and how
| What | How |
|---|---|
| Gmail address | Stored to connect to your mailbox. |
| App Password | Encrypted with AES-256-GCM before it is stored, and deleted the moment you disconnect. |
| Each payment alert UPINOW processes | Amount, UTR, the payer name as your bank writes it, the alert sender's address, the time, and the email's message ID, whether the alert is matched or held in Needs review. The email itself is never kept. |
| API keys | Only a hash is stored; the key itself is shown once, when you create it. |
| Webhooks | Signed with HMAC-SHA256 using your own webhook secret. |
| History | Kept for 30 days on Free, 12 months on Dukaan and Business, 24 months on Pro and Custom. |
How to disconnect
From Settings, Payment account, select Disconnect. UPINOW's own saved copy of the App Password is deleted right away, not just marked inactive. The App Password itself still works at Google until you remove it there: open your Google Account (myaccount.google.com), then Security, then App passwords, and delete the UPINOW one.
Deleting your account from Danger zone stops scanning your mailbox at once.
What we will never ask for
UPINOW will never ask for your UPI PIN, OTP or bank password.
UPINOW never asks for your Gmail password either.
Report a security problem
Found a security issue? Write to us on WhatsApp.
More detail: connecting your mailbox, security and privacy.