Privacy Policy

Receipta is designed to help users keep receipt, invoice, expense, warranty, and document evidence in a practical local record system.

Information stored on your device

Receipta stores your expense records, folders, attachments, analysis data, invoice details, and app settings locally on your device. If you enable automatic cloud upload, eligible saved records and their attachments are queued for upload to your account. You can also choose individual cloud, scan, export, and sharing actions.

Accounts and optional cloud storage

In versions with account and cloud features, Receipta uses your email address, account name, account identifier, sign-in provider information, ledger display name, selected regional preferences, and authentication session to sign you in and keep cloud records associated with the correct account. Customer sign-in uses Apple or Google. Email sign-in may be available for provisioned accounts. These providers process the information needed for their sign-in service.

When you choose a cloud action or enable automatic cloud upload, Receipta stores the selected receipt or invoice fields and originals in your account. These may include merchant, amount, currency, date, tax, notes, warranty information, and invoice customer or business details. Cloud account services and storage use Cloudflare. Cloud copies are linked to your account; signing out does not itself delete them.

Optional AI features and your choice

Smart Scan and Luna are optional AI features. In iOS Build 105 and later, Receipta asks for affirmative permission for each AI provider before sending the relevant content outside the app. If you decline, or withdraw consent before a new request is sent, Receipta does not send that content to Alibaba Cloud or OpenAI through the relevant AI feature. You can continue with local records and manual editing where the app provides those options. Camera, photo, and microphone permissions are separate device permissions; granting a device permission does not by itself authorise an AI transfer.

In iOS Build 105 and later, open Settings > AI data sharing to review the AI sharing choices and withdraw or reset them. Withdrawal stops new AI requests from this app until you consent again. It cannot recall content already transmitted to a provider or erase a provider's independently retained security record. You may also stop a voice request before releasing or sending the recording.

Smart Scan processing

When you choose Smart Scan and consent to the request, the selected receipt, invoice, image, or PDF file or rendered PDF page is sent to the Receipta scan service at api.receipta.com.au. The purpose is to extract fields such as merchant, total, GST, ABN, invoice number, and date and return a draft result to the app. Receipta obtains this content from the document that you select or capture; it does not scan your local document library in the background.

The Receipta scan service routes the selected document to Alibaba Cloud Model Studio (DashScope International Qwen service). The request can include the selected document bytes and the extraction instructions. Receipta also maintains processing jobs, extracted results and OCR output, engine and processing usage/timing information, coarse completion or failure details, and installation, account, membership, and request identifiers to complete requests, prevent duplicate processing, authorize access, and investigate service failures. The result is used to fill a record in the app; please review extracted values before saving.

Alibaba Cloud's Model Studio retention policy and privacy notice describe the provider's handling of inference data, stateful features, security, and regional processing. Alibaba Cloud's training-data disclosure says customer business data is not used to train, fine-tune, or improve foundation models without separate consent. Receipta does not describe its route as zero-retention or claim a provider setting that has not been verified for the active account.

Luna chat and OpenAI

Luna is optional. When you choose Luna and consent, a request may include your typed message, relevant conversation history, relevant saved expense details, editable proposals, and receipt images or PDFs that you select. Receipta supplies this conversation and expense context to help Luna understand your request; you do not have to attach those details separately. OpenAI processes the request to produce an assistant response. You should review every proposal before saving it as a record.

With company-funded access, selected content passes through the authenticated Receipta service on Cloudflare and then to OpenAI. Receipta may process account and session identifiers and funding-eligibility information to authorize that route. With a configured personal OpenAI API key, the request is sent directly from the app to OpenAI using that key; OpenAI charges separately for that usage. iOS Build 105 and later require the same affirmative AI-sharing consent for both routes. A personal key does not replace that consent.

Your personal API key is kept in the device's secure storage and used to authenticate requests directly to OpenAI. Receipta sends Luna chat requests with response storage disabled where that route supports the setting. OpenAI's API data controls and business-data commitments describe current training, abuse-monitoring, and retention controls. OpenAI's general consumer privacy policy does not by itself describe the API customer's processing configuration, so Receipta does not promise zero retention or a particular provider period from that link.

All new and existing users, including existing paid members, receive one independent 72-hour Pro welcome experience for their linked Receipta account after successful registration or sign-in under this welcome campaign. The backend records the original start and expiry. Previous installations or earlier trials do not exclude it; reopening, reinstalling, signing in again or subscribing cannot reset the recorded deadline. There is no 3,000-user limit. Existing verified paid rights remain independent. This experience is separate from store introductory offers and does not start a subscription or charge automatically.

During an active, backend-authorized welcome experience, company-funded Luna sends selected content through the authenticated Receipta service to OpenAI without requiring a personal API key. The former US$1 per-user spending cap no longer applies. Company-funded access still depends on account eligibility and the original experience expiry; request-size and rate safeguards also apply. After the experience, including during paid membership, Luna requires your own OpenAI API key.

AI request retention and provider protection

Receipta stores scan jobs, returned results and operational identifiers to complete requests, prevent duplicate processing, apply access and security controls, and provide support. These records are separate from the original receipts kept on your device. To request deletion of processing records, contact developer@tandlhealthservice.com.au so we can verify ownership and identify the relevant records. Minimal security, purchase-ownership and legally required records may need to be retained.

Provider retention, deletion, security, and international-transfer rules also apply after a request is sent. We require our service providers to process personal data for the described service, security, and legal purposes and to provide protection at least equivalent to this policy under the applicable data-processing terms. Cloudflare publishes its Customer Data Processing Addendum and privacy policy. The Alibaba Cloud and OpenAI links above explain their API processing and retention safeguards. Turning off optional response storage does not remove all provider security or abuse-monitoring retention.

Optional ChatGPT and Claude connections

You can choose to connect your Receipta cloud account to ChatGPT, provided by OpenAI, or Claude, provided by Anthropic. These external connections are separate from Smart Scan and Luna. Receipta explains the sharing before opening setup. The authorization website then asks you to confirm the Receipta account and permissions before granting access.

Within the permissions you approve, the connected service can request account and ledger details, receipts and original image or PDF attachments, folders, warranties, customer invoices and reports. These records may contain names, addresses, purchases, tax, amounts and other personal or financial information. The purpose is to answer your ledger questions and carry out the record operations you request, including creating, updating or deleting cloud records where authorized. Data is transferred through Receipta's cloud connection service to the selected provider.

Access may continue without signing in for every request until you disconnect, credentials expire, or eligible cloud membership or trial access ends. To stop future connector access, disconnect Receipta in ChatGPT or Claude's connection settings. Withdrawing the app's separate OpenAI or Alibaba Cloud permission does not by itself disconnect these external accounts. Disconnecting does not delete your Receipta ledger or cancel a subscription, and cannot recall information already shared.

Information you share within ChatGPT or Claude is handled under that service's applicable privacy policy, account or workspace settings and terms, which may differ from API processing used by Smart Scan or Luna. Review OpenAI's privacy policy and Anthropic's privacy policy. Choosing not to connect does not authorize sharing with either external service.

App Store and Google Play membership

Apple handles subscription payments. Receipta receives and verifies transaction identifiers, product and subscription status, renewal or expiry information, and introductory-trial information. Receipta links verified membership to your account using an account token. Receipta does not receive your payment card number from Apple.

On Android, Google Play handles subscription payments. Receipta verifies purchase tokens, product identifiers, purchase and renewal status, expiry and ownership binding with its backend and Google Play. These records support purchase restoration and prevent a purchase being assigned to another account. Receipta does not receive your payment card number from Google Play.

Purchase ownership and trial-use records are retained to support restoration, avoid assigning a purchase to another account, and prevent repeated introductory access. Technical request counters also help protect the service from abuse.

Secure Pro and Private Vault

Secure Pro and Private Vault files and vault passwords are not uploaded to the Receipta scan service. Receipta cannot recover a lost vault password.

Backups and exports

If you create an export or backup, you control where that file is saved or shared. Anyone with access to an exported file may be able to view its contents unless the export is encrypted.

Permissions and account controls

Camera and photo permissions let you capture or choose documents. Microphone access is used only when you choose voice input. Face ID can unlock local protected records. Selected photos may contain location metadata used to organize records; Receipta does not track your location in the background. You can manage device permissions in system settings.

Luna voice input and audio transcription

When you choose Luna voice input and grant microphone permission, Receipta records the audio you provide and sends it for online transcription after the relevant consent. With company-funded access, the recording passes through the authenticated Receipta service on Cloudflare to OpenAI. With a configured personal OpenAI API key, the recording is sent directly from the app to OpenAI using that key. The purpose is to create recognized text for the Luna composer or message.

Recognized text may be sent automatically after recording is released or placed in the composer for editing before sending, depending on the selected input mode. Transcription may be inaccurate. Sending the resulting message follows the Luna chat processing described above. Cloud voice transcription requires an internet connection and is separate from saving a receipt or invoice to your cloud ledger.

Android Build 112 and later use this cloud transcription flow for Luna voice input and do not use the Android system speech-recognition service for that feature. Older Android versions may still use the device's system speech-recognition service, which can process audio online under its provider's rules.

Account deletion

You can request account deletion in Receipta account settings or use our external account deletion request after uninstalling the app. We verify account ownership before acting. The request is intended to remove account identity, sign-in sessions, current cloud ledger records, and known attachments; cleanup may remain pending for late files or a failed storage deletion and must be retried. Receipta may retain minimal security, deletion-coordination, purchase-ownership, and one-time trial-prevention records where needed to prevent abuse, complete deletion, or comply with law. Local records remain on your device. Deleting an account does not cancel subscriptions: cancel separately in Apple or Google Play subscription settings. Back up records you want to retain.

Withdrawing Smart Scan or Luna consent stops new requests through those app features. External ChatGPT and Claude connections require their own disconnection as described above. These controls cannot recall data already sent to Alibaba Cloud, OpenAI or Anthropic; provider-side deletion is subject to the provider's current terms and controls. Contact us if you need help identifying a request or asking about provider deletion.

Contact

For privacy questions, contact developer@tandlhealthservice.com.au.