Privacy Policy

Privacy Policy

Last updated: September 2, 2026

Overview

At Crackin’ Receipts, we take your privacy seriously. This policy explains what we collect, how we use it, and who else sees it.

We do not sell your data, we do not use it for advertising, and we do not track you across other companies’ apps or websites.

Information We Collect

Receipt Data

  • Images of receipts you upload
  • Text and metadata extracted from those images — vendor, date, line items, totals
  • Purchase details and amounts

Receipts often carry personal details: your name, an address, a loyalty number, the last four digits of a payment card. We treat everything on a receipt as personal information linked to your account.

Account Information

  • Email address, for account creation and sign-in
  • Authentication tokens
  • Device information

Friends, Sharing, and Email

  • Email addresses you enter to send a friend request, share a receipt, or email a copy of a receipt

We use an address you enter only to deliver that invitation, share, or copy.

We do not read your device’s address book. When you tap “Add to Contacts,” the app hands an address to your phone’s own contacts app — that stays on your device and is never sent to us.

Usage and Diagnostic Data

  • Which screens you open and which features you use
  • Session recordings in which all on-screen text and images are masked before the recording leaves your device — these show layout and navigation, not the contents of your receipts
  • Crash reports, error logs, and performance metrics

How We Use Your Information

To Provide Our Service

  • Process, store, and organize your receipts
  • Enable search, chat, and organization features
  • Share receipts with people you choose
  • Sync across your devices

To Answer Questions About Your Receipts

See AI Processing below.

To Improve Our Service

  • Understand which features get used
  • Diagnose crashes, bugs, and performance problems

We do not use your receipts, images, or questions to train AI models.

To Communicate With You

  • Send important updates about the service
  • Respond to support requests
  • Notify you of new features

AI Processing

Crackin’ Receipts uses AI in two places. Both are Amazon Web Services products, and both run inside our own AWS account:

  • Amazon Textract reads the text out of receipt images.
  • Amazon Bedrock answers questions you ask about your receipts and generates the search index that makes those questions answerable.

When you ask a question, the relevant receipt content is sent to Amazon Bedrock at that moment to produce an answer. Under AWS’s terms, content sent to Bedrock is not used to train Amazon’s models and is not shared with third-party model providers.

No AI vendor outside of AWS receives your data.

Sharing Your Information

With people you choose

When you share a receipt with a friend or email a copy to someone, that person receives the receipt data you sent. You control who and what.

With our service providers

  • Amazon Web Services — receipt images and data, account information, and the questions you ask. Provides hosting and storage (S3), authentication (Cognito), text extraction (Textract), AI (Bedrock), and email delivery (SES). Your data is stored in the United States.
  • Sentry — crash reports and error diagnostics, including which screen and which network requests were involved. Configured not to collect personal information by default.
  • PostHog — product analytics and masked session recordings, associated with your user ID and email address so we can investigate problems on your account.

These providers process data on our behalf and are not permitted to use it for their own purposes.

We may disclose information if we are legally required to, or where we believe it is necessary to protect our rights or someone’s safety.

We do not sell your personal information, and we do not share it with advertisers or data brokers.

Data Storage and Security

  • All receipt data is encrypted at rest
  • Transmission is encrypted using TLS
  • Stored in secure cloud infrastructure (AWS), in the United States
  • Every operation is scoped to your authenticated account
  • Regular security review and updates

Data Retention and Deletion

We retain your receipt data for as long as your account is active.

  • Individual receipts can be deleted from the app at any time. Deleted receipts are removed from our systems within 30 days.
  • Your account can be deleted by emailing [email protected] from the address on your account. We verify the request, then permanently erase your receipts, images, and account data within 30 days. Encrypted backups are cycled out within 90 days.
  • Diagnostic and analytics data held by Sentry and PostHog is retained for up to 12 months and then deleted.

Your Rights

You have the right to:

  • Access your data
  • Request a copy of your receipt data
  • Correct inaccurate account information
  • Delete individual receipts, or your entire account and all associated data
  • Ask us how your data is used

To exercise any of these, email [email protected].

Children’s Privacy

Crackin’ Receipts is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, email [email protected] and we will delete it.

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the date at the top.

If we make a material change to how we use your information — for example, using it for advertising, or sharing it with new categories of third parties — we will notify you in the app or by email before the change takes effect, and where the law requires it, ask for your consent.

Contact Us

If you have questions about this privacy policy, please contact us at [email protected]