Legal

Privacy Policy

Last updated: May 2025

The short version: receipt images are processed and immediately discarded — we never store them. We collect only what's needed to run the service.

1. What We Collect

When you use ReceiptScan, we collect the following:

Email address — used to create your account and send magic link sign-ins
API usage data — call counts, timestamps, and success/error status per request
API key metadata — key prefix, tier, creation date (the full key is stored as a one-way hash)

2. Receipt Images

Receipt images submitted via the /extract endpoint are sent to our vision model for processing and are not stored on our servers. Images are held in memory only for the duration of the API call and discarded immediately after the response is returned.

We do not use receipt content to train models or for any purpose other than returning the structured response to you.

3. How We Use Your Data

To authenticate you and manage your account
To track API usage for billing and rate limiting
To display usage history in your dashboard
To send transactional emails (magic link sign-ins only — no marketing)

4. Data Storage

Account and usage data is stored in Supabase (PostgreSQL), hosted in the EU. Data is protected by row-level security — you can only access your own records.

5. Third-Party Services

We use the following sub-processors:

Supabase — authentication and database
Anthropic — vision model for receipt extraction (images are not retained by Anthropic per their API terms)
Railway — API server hosting
Vercel — frontend hosting

6. Your Rights

You can request deletion of your account and all associated data at any time by emailing support@receiptscan.dev. We will process deletion requests within 7 days.

7. Cookies

We use only essential session cookies set by Supabase Auth to keep you signed in. No advertising or tracking cookies are used.

8. Contact

Questions about this policy? Email support@receiptscan.dev.