Where your data lives
Receipts, their images and your settings are stored in Supabase — a Postgres database with object storage — tied to your account.
Who can see it
Row-level security in the database means each account can read only its own records. The rule is enforced by the database itself, not only by the app. If you invite someone to a workspace, they see that workspace's receipts with the permission you set — and nothing else.
Encryption
Data is encrypted in transit over HTTPS, and at rest by our infrastructure providers.
AI and your receipts
When you scan a receipt, the image is sent through our server to Google Gemini to read the vendor, date, amount and similar fields. Google processes it to return that text and does not use it to train its models under our API terms. Nothing is sent unless you scan, and you can always type the details yourself.
Mistakes are recoverable
Deleted receipts wait in Trash for 30 days before they are removed, and daily backups keep a snapshot of each workspace that you can restore.
What we never do
We never sell personal data or use it for advertising, and we do not collect location, contacts or advertising identifiers.
Reporting a problem
Found a security issue? Email [email protected].