Privacy Policy

Overview

Receipt Rabbit is a receipt scanning app for iOS. We built it with privacy as a default: no account creation, no personal data tied to you as an individual. No email address is ever required — the email forwarding feature is strictly opt-in.

What Data We Collect

Receipt Images

Receipt images are captured by your camera or imported from your photo library or files, and are stored on your device (and mirrored to your private iCloud account when iCloud is available). To categorize a receipt accurately, the downsampled image is sent over an encrypted (TLS) connection through our Cloudflare Worker proxy to OpenRouter, which routes the request to an OpenAI model hosted on Microsoft Azure — EU data centers first, with US used only as a failover, and no other provider in the path. This applies to camera photos and imported images, and also to imported PDF receipts: each PDF page is rendered on your device into a compressed image, and those page images may be sent for categorization the same way. The images are used only to produce the categorization response and are not retained on our servers afterwards. Every request we send in that chain carries training-data use denied and zero data retention (ZDR) requested — our server sets both on every request; they are not per-scan options that can be left off. Forwarded email receipts are the one exception to “not retained.” If a receipt you forward carries a PDF or image attachment, that attachment is sent for categorization the same way as a scan, and the forwarded receipt — its text and any attachment — is held in our Cloudflare KV queue for up to 7 days, or until your device collects it, whichever comes first. That queue exists so a receipt arriving while your device is offline is not lost. Any display artifact the app generates from an email (such as a rendered card or PDF preview) is never uploaded as the source of a categorization. If you delete a receipt in the app, its image is permanently deleted from your device.

Receipt Text (OCR)

When you scan a receipt, the app extracts text from the image using on-device OCR. That text is sent to our Cloudflare Worker proxy and forwarded through the same OpenRouter → Microsoft Azure → OpenAI chain for categorization. The text is used only to produce the categorization response and is not retained on our servers afterwards — with the same forwarded-email exception described above. As with images, every request denies training-data use and requests zero data retention (ZDR).

Anonymous Device Identifier

The app generates a random identifier (UUID) at first launch and stores it in your device's Keychain. This identifier:

• Is not tied to your name, email, or any personal information
• Is used solely for rate limiting (free tier: 30 categorizations/month) and, if necessary, blocking abusive usage
• Persists across app reinstalls so your subscription state and usage count are preserved

Subscription Data

If you purchase a paid subscription, the transaction is handled by Apple's App Store and RevenueCat. We receive only an anonymous subscription status (active/inactive) tied to your anonymous device identifier. We never receive your name, Apple ID, or payment information.

Forwarding Email Address (Optional)

Email forwarding works one of two ways. If you set up an automatic forwarding rule in your mail client, receipts sent to your registered personal address are auto-forwarded to a unique address tied to your anonymous device identifier. Alternatively, you can manually forward an individual receipt email to receipts@receiptrabbit.io, using the address you registered to identify which account it belongs to. In either case, your registered email address is stored in Cloudflare KV storage, tied to your anonymous device identifier, and used solely to receive and process forwarded receipt emails. The forwarded receipt itself — its parsed text and any PDF or image attachment — is held in the same KV store for up to 7 days, or until your device collects it, whichever comes first. You can remove it at any time from Settings → Email Forwarding, which permanently deletes it from our servers.

Financial Sync Connections (Optional)

If you choose to connect Lunch Money or QuickBooks Online, you authorize the connection directly with that service (via API key or OAuth). The resulting access token, refresh token, and any related account identifiers are stored only in your device's Keychain — we do not store them on our servers. Depending on the service, the app reads existing transactions/accounts to match against your receipts, and writes new transactions, vendors, or category splits derived from your receipt data back to that service. Categorization mapping (which of our 40 categories corresponds to which of your accounts or categories in that service) is computed once, at connect time: the names and IDs of your accounts or categories in that service are sent through our Cloudflare Worker proxy to the same OpenRouter → Microsoft Azure → OpenAI chain, which matches them against our category list. Nothing else from that service is sent — no transactions, no balances, no company or customer details. The resulting map is stored only on your device and is not retained on our servers; as described above, that request also denies training-data use and requests zero data retention (ZDR). Each connection is user-initiated and can be disconnected at any time from Sync → [service] → Disconnect, which removes the stored token from your device.

Issue Reports (Optional)

If you choose Report an Issue, the report includes the receipt text used for processing, the Worker's response, your description of the problem, and technical diagnostics. We store the report in Cloudflare KV for up to 90 days and may email a copy to our support address so we can investigate. Issue reports do not include receipt images or PDF files.

Third-Party Services

Data We Do Not Collect

• Name or any account credentials (no login is ever required)
• Email address — unless you opt in to email forwarding (see above)
• Location data
• Contact list or any other device data
• Advertising identifiers (IDFA)
• Analytics or usage telemetry

GDPR / CCPA

The anonymous device identifier is a pseudonymous technical identifier, not personal data under GDPR Article 4 (it cannot on its own identify a natural person). If you provide a forwarding email address, that constitutes personal data under GDPR — you may request deletion at any time by removing it in Settings → Email Forwarding. We do not sell personal data. We do not engage in targeted advertising.

Data Retention

• Receipt images and line items: Stored on your device until you delete them in the app.
• OCR text sent for categorization: Not retained after processing.
• Anonymous identifier and usage count: Retained in Cloudflare KV for rate limiting; reset monthly.
• Forwarding email address (if provided): Retained in Cloudflare KV until you remove it in Settings.
• Issue reports (if submitted): Retained in Cloudflare KV for up to 90 days.

Children

The app is not directed at children under 13 and does not knowingly collect any information from children.

Data Deletion

• Receipt images and line items: Delete them in-app at any time.
• Forwarding email address: Remove it in Settings → Email Forwarding. This permanently deletes it from our servers.
• Anonymous device identifier: Stored in your iOS Keychain and persists across app reinstalls (by design, to preserve your subscription state). To request removal from our servers, email support@receiptrabbit.io. Note: this will reset your usage count and may affect subscription recognition.

Changes to This Policy

We may update this policy as the app evolves. Significant changes will be noted in the App Store release notes. The "Last updated" date above always reflects the current version.

Contact

Questions about this policy: support@receiptrabbit.io