Privacy Policy for Receipto

Effective Date: September 15 , 2026 • Last Updated: September 19, 2026
Application: Receipto (com.selie.receipto)
Developer: Receipto Team • Contact: selie@senaydesign.com
Official URL: https://senaydesign.com/receipto-app/privacy-policy/

1. Introduction

Receipto ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy details our data collection, processing, and retention practices when you use our mobile application.

Receipto is an on-device personal and business expense tracking utility designed with privacy-first principles. We do not sell your personal information, do not track you across apps, and do not persist your receipts or accounting ledgers in remote cloud databases.

2. Information We Collect and Process

Data Category	Specific Elements	Purpose	Retention & Storage
Photos / Receipt Images	Physical receipt photos captured via camera or selected from photo picker	Optical Character Recognition (OCR) and expense data extraction	Stored locally on device sandbox. Processed ephemerally in backend RAM during extraction and discarded immediately upon response.
Financial & Receipt Data	Vendor name, transaction date, line items, VAT, totals	In-app expense categorization, calculation, and spreadsheet export	Stored strictly locally on your device. Never saved to external databases.
Tax & Fiscal Fields	Buyer Name and TIN printed on receipts	Accurate tax reporting and receipt deduplication	Stored strictly on your local device. Never uploaded to external databases.
Device or Other IDs	Installation ID (`inst_...`), License ID (`AND-XXXXX`), Secondary Device Signal	Scan quota management (50 free scans), license activation, and anti-abuse protection	Stored in entitlement database linked to your scan balance. Never sent to Google Gemini or included in receipt payloads.
Authorization Token	Single-use scan token (`stk_...`)	Authorizes a single scan without exposing persistent device IDs	Ephemeral (expires in 3 minutes, single-use, discarded).

3. Receipt Processing & Structured Fields

Receipt Images: When you scan a receipt, the image is transmitted securely via HTTPS (TLS 1.3) through our backend proxy to Google's Gemini API for optical character recognition (OCR) and structured parsing. The image is held ephemerally in RAM during extraction and is never written to disk or stored in an external database. The receipt image remains stored locally in your device's sandboxed storage.

Structured Fields: Extracted vendor names, dates, line items, totals, and any optional Buyer Name or TIN printed on the receipt are returned to the application and saved strictly in your device's local database. We do not maintain any cloud-based receipt database.

4. Device and Installation Identifiers

Receipto uses distinct technical identifiers solely for operational integrity:

Installation ID: An app-scoped random identifier used to manage scan entitlement allowances and prevent automated service abuse.
License / Device ID: Used exclusively for offline license key validation and anti-reset protection.
Secondary Device Signal: Derived from platform properties for entitlement validation and computing a secure device-binding hash.

Neither identifier is ever sent to Google Gemini or included in receipt processing payloads.

5. Third-Party Service Providers

Google Cloud / Google Gemini API: Provides optical character recognition (OCR) and structured parsing. Data handling is governed by Google Cloud and Gemini API applicable terms of service.
Supabase (Edge Functions & Database): Manages anonymous scan quotas, rate limits, and cryptographic verification of scan authorization tokens.

Neither service provider uses your receipt information for advertising, marketing, or cross-application tracking.

6. Android Permissions

android.permission.CAMERA: Used solely to take photos of physical receipts directly within the app.
android.permission.INTERNET: Used solely to communicate with our secure proxy for OCR extraction and scan entitlement verification.

Photo selection from your gallery uses the Android system Photo Picker. Receipto does not request broad storage permissions (READ_MEDIA_IMAGES or READ_EXTERNAL_STORAGE), location, contacts, microphone, SMS, or phone status.

7. Data Retention and Deletion

Local Data Control: You retain complete control over all receipt records and can delete individual entries at any time.
In-App Purge: You can permanently wipe all stored receipts, line items, and thumbnails inside the app via Settings → Danger Zone → Purge All Data.
Uninstallation: Uninstalling the application deletes all local application data from your device.
Server Quota Records: Scan quota balances and license activation records are maintained in the backend entitlement system to preserve your scan quota and license status across app re-installs. Temporary scan tokens expire automatically after 3 minutes.

8. Data Security

All network transmissions between the mobile app, backend proxy, and AI processing infrastructure are encrypted in transit using industry-standard TLS 1.3 / HTTPS. Production server logs sanitize and redact all device identifiers, receipt photos, buyer names, TINs, and authorization tokens.

9. Children's Privacy

Receipto is not directed to individuals under the age of 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page and reflected in the app with an updated revision date.

11. Contact Us

If you have any questions or concerns regarding this Privacy Policy, please contact us:

Email: selie@senaydesign.com
Developer: solomon Tewolde
Website: https://senaydesign.com