Privacy policy

Account & authentication

Signing up creates an account in Firebase Authentication, a global Google service that holds your email address, a hashed password (we never see the password itself) and, if you sign in with Google, the email of that Google account. Everything else we keep about you lives in our own database and server code, which run in Google Cloud's EU (Belgium) region. Our server issues your account an opaque billing identifier; it is not derived from your email or your Google account.

Receipt processing

When you tap Process on a scan, the receipt images you selected are sent to our server, which forwards them to our AI provider, Anthropic, with a fixed extraction prompt. The images are sent only for that processing: our server does not store them, and they are discarded after the extraction. The parsed result (store name, items, prices) is returned to your phone and saved in the local database on your device.

Scan records

Each scan is recorded on our server as a summary: which account and device asked for it, the model used, token counts (no text), timing, outcome and cost. We use these summaries to enforce the Free and Pro allowances and to detect abuse. The receipt content itself is not part of the record.

Data retention

Scan requests and completed background jobs are deleted after 30 days. Scan and billing summaries are deleted after 13 months. Server logs are kept for 30 days. Our database is backed up daily and each backup is kept for 7 days. Receipt images are never written to our storage, so there is nothing of them to retain.

App and device integrity

Every request to our server must come from an unmodified SlipSave build installed through Google Play. We check this with Firebase App Check and, for scans, the Play Integrity API; Google returns a verdict about the app and device, not your identity. A keyed one-way hash of your Android device identifier (never the identifier itself) counts free scans per device so a new account cannot reset the free allowance. That device record is deleted 13 months after the device was last active.

Subscription billing

Pro is a Google Play subscription. Google handles the payment and card details never reach us. When you subscribe, the app sends Google Play your opaque billing identifier; our server then verifies the purchase with Google, stores the purchase token, its plan, state and expiry, and receives renewal, cancellation and refund events from Google Play so it can keep your Pro status current.

Card numbers in receipts

Anything that looks like a 16- to 19-digit card number in the AI's parsed text is replaced with [redacted] before it lands in the database — same on the local side.

Sign-out vs. delete account

Sign-out keeps your account and its local receipts. Signing back into the same account on this installation can reopen those receipts. Other accounts use separate local databases and image folders. There is no cloud receipt sync or backup.

Delete account, after a recent sign-in, asks Google Play to cancel an active Pro subscription, deletes your account data from our database, signs out every session, deletes your Firebase Authentication user and then wipes the receipts and images on this device. A record of your purchase tokens stays behind, without your account, so a late Google Play notification cannot attach that purchase to anyone else; scan summaries and the device record expire on their normal 13-month schedules. Cancellation can fail while deletion succeeds: check your subscription in Google Play, where your billing history is unaffected.