Privacy Policy

Overview

Receipt Rabbit is a receipt scanning app for iOS. We built it with privacy as a default: no account, no login, and we never ask for your name. The data we hold on our servers is keyed to a random anonymous identifier, not to your identity. No email address is ever required, and we never store your email address, including when you use email forwarding. Email forwarding is strictly opt-in.

What Data We Collect

Receipt Images

Receipt images are captured by your camera or imported from your photo library or files, and are stored on your device (and mirrored to your private iCloud account when iCloud is available). To categorize a receipt accurately, the app makes a compressed copy of the image and, on your device, blacks out personal details it finds on that copy: phone numbers, card numbers, email addresses, authorization codes, member IDs, and cardholder names. Your stored original is not changed. The masked copy is sent over an encrypted (TLS) connection through our Cloudflare Worker proxy to OpenRouter, which routes the request to one AI model (LLM) at a time from the providers listed under Third-Party Services: a DeepSeek model hosted by Together AI first; if it does not respond, an Anthropic Claude model hosted on Google Cloud Vertex AI; and if that does not respond either, an OpenAI model hosted on Microsoft Azure (EU data centers first, US as failover). Each request is pinned to that one hosting provider, with no other provider in the path. App version 1.0 uses only the OpenAI model on Microsoft Azure. This applies to camera photos and imported images, and also to imported PDF receipts: each PDF page is rendered on your device into a compressed image, and those page images are masked and may be sent for categorization the same way. If the app cannot confirm the black boxes cover those details, it still sends the image. The only exception is a very large image that cannot be resized to fit; then the app holds back the image and sends the receipt text instead, with the same details removed (see Receipt Text below). The images are used only to produce the categorization response and are not retained on our servers afterwards. Every request we send in that chain carries training-data use denied and zero data retention (ZDR) requested. Our server sets both on every request; they are not per-scan options that can be left off. Forwarded email receipts are the one exception to “not retained.” When a forwarded receipt arrives, our server encrypts its text and any attachments to keys that only your devices hold before storing it. It stays in that encrypted form in our Cloudflare KV queue until your device downloads it, or for up to 7 days, whichever comes first. We cannot read the queued copy, and nothing from a forwarded receipt is sent to an AI model when it arrives. Once your device downloads and decrypts it, the app turns the email body (up to 5 pages) and each attachment page into images, then blacks out the same personal details on each image. Unlike a scan, a forwarded page image is sent only if the app confirms the black boxes cover those details. Otherwise the image is held back, and that page's text is sent instead, with those details removed. App versions before 1.3 send the email text instead of body images. That queue exists so a receipt arriving while your device is offline is not lost. Any display artifact the app generates from an email (such as a rendered card or PDF preview) is never uploaded as the source of a categorization. If you delete a receipt in the app, its image is permanently deleted from your device.

Receipt Text (OCR)

When you scan or import a receipt, the app extracts text from the image using on-device OCR. The app uses that text on your device to find the personal details it masks and to make your receipts searchable. For a receipt with an image, the app sends the text only when a very large image cannot be resized to fit (see Receipt Images above) or when a request with the image fails and the app retries with text. Before any receipt text leaves your device, the app removes phone numbers, card numbers, email addresses, authorization codes, member IDs, and cardholder names. Text that is sent goes to our Cloudflare Worker proxy and through OpenRouter to the same providers, in the same order, for categorization. The text is used only to produce the categorization response and is not retained on our servers afterwards, with the same forwarded-email exception described above: the queued copy is encrypted to your devices and deleted once downloaded or after 7 days. For a forwarded email, text is sent only for a page whose image the app held back, or by app versions before 1.3. That text has the same details removed, and it can still include street addresses that appear in it. It is handled the same way and not retained. As with images, every request denies training-data use and requests zero data retention (ZDR).

Expense Reports

When you fill an expense report form, the app sends three things through our server to an AI model: an image of each form page with personal details blacked out on your device first, the form's field labels, and a list of the receipts you picked (merchant, date, category, and amount only). If a page's blackout cannot be confirmed, that page is not sent. The model's only job is to identify which box on the form is which. Receipt images and receipt text are not sent. The app writes the amounts, dates, and merchants into the boxes on your device; the model never supplies them. We do not store these requests, and we ask the model provider for zero data retention and no training use.

Anonymous Device Identifier

The app generates a random identifier (UUID) at first launch and stores it in your device's Keychain. This identifier:

• Is random, and is not derived from your name, Apple ID, or device
• Is the key our servers use for your usage limit (free tier: 30 categorizations/month, and blocking abusive usage if necessary), your subscription status (via RevenueCat), your forwarding registration and encrypted queued receipts if you use email forwarding, and any issue reports you send
• Persists across app reinstalls so your subscription state and usage count are preserved

Subscription Data

If you purchase a paid subscription, the transaction is handled by Apple's App Store and RevenueCat. We receive only an anonymous subscription status (active/inactive) tied to your anonymous device identifier. We never receive your name, Apple ID, or payment information.

Service Records

We keep a short record each time the app sends a request to our server, and each time a forwarded receipt arrives for you. We store these records with Cloudflare and use them to keep the service working, to find and fix failures, and to see how much the service is used. Each record holds which feature was used, whether the request worked, how long it took, the app version, whether you are on the free or a paid plan, which AI model answered, a count of how much the model read and wrote (without the content), and what the request cost us. Each record is tied to a keyed one-way hash of your anonymous device identifier, and the identifier itself is not written to the record. A record never contains receipt images, receipt text, merchant names, receipt amounts, email addresses, or IP addresses.

Requests to our server that do not come from the app (for example automated scanners) are recorded with the software name the caller reports and the name of its network provider, without its IP address.

Email Forwarding (Optional)

When you turn on email forwarding, the app shows you a personal forwarding address made from your anonymous device identifier. You can forward a receipt to it by hand, or set up an automatic forwarding rule in your mail client. We never store your email address. Mail sent to your personal address is routed by that address alone, which comes from the random identifier. Each device has its own forwarding address.

You can also forward from your own mailbox to receipts@receiptrabbit.io by entering your sender address in Settings → Email Forwarding. That address is saved on your device. Our servers keep only a keyed one-way hash of it, which is used to match incoming mail to your device; the address itself is never written to our storage or logs. Removing the address or turning off forwarding deletes the hash.

Turning forwarding on also creates an encryption key pair on your device. The private key stays on your device, in its Keychain, and is never sent to us or synced to iCloud Keychain. Our servers keep only the public key and a one-way hash of a device credential. A forwarded receipt is encrypted to your device's key before it is stored, so the queued copy is unreadable to us. It is sent for categorization only after your device downloads and decrypts it (see Receipt Images and Receipt Text above). It is deleted when your device downloads it, or after 7 days, whichever comes first. If your mail provider sends a confirmation link to approve a forwarding rule (Proton Mail does), that link is encrypted the same way and shown to you in the app, not emailed to you.

Our mail provider, Cloudflare Email Routing, keeps a routing log of each forwarded message's sender, recipient, and subject for up to 30 days. That log is kept by Cloudflare, not in our queue, and we do not use it. When you forward a receipt by hand, the sender in that log is your own email address.

Turning off forwarding in Settings → Email Forwarding deletes your forwarding registration, its keys, and any receipts still queued for you from our servers.

Financial Sync Connections (Optional)

If you choose to connect Lunch Money, QuickBooks Online, or Xero, you authorize the connection directly with that service (via API key or OAuth). The resulting access token, refresh token, and any related account identifiers are stored only in your device's Keychain. We do not store them on our servers. Depending on the service, the app reads existing transactions/accounts to match against your receipts, and writes new transactions, vendors, or category splits derived from your receipt data back to that service. Categorization mapping (which of our 42 categories corresponds to which of your accounts or categories in that service) is computed once, at connect time: the names and IDs of your accounts or categories in that service are sent through our Cloudflare Worker proxy to the same OpenRouter → Microsoft Azure → OpenAI chain, which matches them against our category list. Nothing else from that service is sent: no transactions, no balances, no company or customer details. The resulting map is stored only on your device and is not retained on our servers; as described above, that request also denies training-data use and requests zero data retention (ZDR). Each connection is user-initiated and can be disconnected at any time from Sync → [service] → Disconnect, which removes the stored token from your device.

Issue Reports (Optional)

If you choose Report an Issue, the report includes the receipt text used for processing, the Worker's response, your description of the problem, and technical diagnostics. Unless you turn off Include receipt image in the report, it also includes the receipt image with personal details blacked out on your device, as described under Receipt Images. Pages where the app cannot confirm the mask are left out. We store the report in Cloudflare KV for up to 24 hours, without the image, and a copy with the image is emailed to our support address so we can investigate. That copy is kept for up to 30 days, then deleted. Original PDF files are never included.

Third-Party Services

Data We Do Not Collect

• Name or any account credentials (no login is ever required)
• Email address. We never store it, including for email forwarding. If you enter a sender address for receipts@, we keep only a keyed one-way hash of it (see Email Forwarding above, which also covers our mail provider's routing log)
• Location data
• Contact list or any other device data
• Advertising identifiers (IDFA)
• Third-party analytics or advertising trackers

GDPR / CCPA

We do not ask for your name, an account, or a login. The data we hold is keyed to a random anonymous device identifier, not to your identity. We never store your email address. If you use email forwarding, your queued receipts are encrypted to your devices, and you can delete them at any time by turning off forwarding in Settings → Email Forwarding. To request access to or deletion of any data we hold for your identifier, email support@receiptrabbit.io. We do not sell personal data. We do not engage in targeted advertising.

Data Retention

• Receipt images and line items: Stored on your device until you delete them in the app.
• Receipt text sent for categorization (when sent): Not retained after processing.
• Anonymous identifier and usage count: Retained in Cloudflare KV for rate limiting; reset monthly.
• Forwarded receipts (if you use email forwarding): Encrypted before they're stored, to keys only your devices hold, and held in Cloudflare KV until your device downloads them or for up to 7 days, whichever comes first. If we cannot process a forwarded email, we keep only a record of the failure reason and sizes, with no message content or addresses, for up to 7 days.
• Email routing log (if you use email forwarding): Cloudflare Email Routing keeps each forwarded message's sender, recipient, and subject for up to 30 days. We do not use it.
• Issue reports (if submitted): Retained in Cloudflare KV for up to 24 hours. The copy emailed to our support address is kept for up to 30 days, then deleted.
• Service records: Kept with Cloudflare for up to 3 months, then deleted automatically.

Children

The app is not directed at children under 13 and does not knowingly collect any information from children.

Data Deletion

• Receipt images and line items: Delete them in-app at any time.
• Email forwarding: Turn it off in Settings → Email Forwarding. This deletes your forwarding registration and any receipts still queued for you from our servers.
• Anonymous device identifier: Stored in your iOS Keychain and persists across app reinstalls (by design, to preserve your subscription state). To request removal from our servers, email support@receiptrabbit.io. Note: this will reset your usage count and may affect subscription recognition.
• Service records: Cannot be deleted one at a time because the storage they are kept in has no way to remove a single record. Each record is deleted automatically 3 months after it was written.

Changes to This Policy

We may update this policy as the app evolves. Significant changes will be noted in the App Store release notes. The "Last updated" date above always reflects the current version.

Contact

Questions about this policy: support@receiptrabbit.io