Privacy Policy

Overview

Receipt Rabbit is a receipt scanning app for iOS. We built it with privacy as a default: no account, no login, and we never ask for your name. The data we hold on our servers is keyed to a random anonymous identifier, not to your identity. No email address is ever required, and we never store your email address, including when you use email forwarding. Email forwarding is strictly opt-in.

What Data We Collect

Receipt Images

Receipt images are captured by your camera or imported from your photo library or files, and are stored on your device (and mirrored to your private iCloud account when iCloud is available). To categorize a receipt accurately, the app makes a compressed copy of the image and, on your device, blacks out personal details it finds on that copy: phone numbers, card numbers, email addresses, authorization codes, member IDs, and cardholder names. Your stored original is not changed. The masked copy is sent over an encrypted (TLS) connection through our Cloudflare Worker proxy to OpenRouter, which routes the request to one AI model (LLM) at a time from the providers listed under Third-Party Services: a DeepSeek model hosted by Together AI first; if it does not respond, an Anthropic Claude model hosted on Google Cloud Vertex AI; and if that does not respond either, an OpenAI model hosted on Microsoft Azure (EU data centers first, US as failover). Each request is pinned to that one hosting provider, with no other provider in the path. App version 1.0 uses only the OpenAI model on Microsoft Azure. This applies to camera photos and imported images, and also to imported PDF receipts: each PDF page is rendered on your device into a compressed image, and those page images are masked and may be sent for categorization the same way. If the app cannot confirm that the mask covers those details, it does not send the image and sends the receipt text instead, with the same details removed (see Receipt Text below). You can choose to send unmasked images in Settings → AI & Privacy → Send Unmasked Images; it is off by default. The images are used only to produce the categorization response and are not retained on our servers afterwards. Every request we send in that chain carries training-data use denied and zero data retention (ZDR) requested. Our server sets both on every request; they are not per-scan options that can be left off. Forwarded email receipts are the one exception to “not retained.” If a receipt you forward carries a PDF or image attachment, that attachment is sent for categorization the same way as a scan. The forwarded receipt (its text and any attachment) is then encrypted on arrival to keys that only your devices hold and held, in that encrypted form, in our Cloudflare KV queue until your device downloads it or for up to 7 days, whichever comes first. We cannot read the queued copy. That queue exists so a receipt arriving while your device is offline is not lost. Any display artifact the app generates from an email (such as a rendered card or PDF preview) is never uploaded as the source of a categorization. If you delete a receipt in the app, its image is permanently deleted from your device.

Receipt Text (OCR)

When you scan or import a receipt, the app extracts text from the image using on-device OCR. The app uses that text on your device to find the personal details it masks and to make your receipts searchable. For a receipt with an image, the text is sent only when the image is withheld (see Receipt Images above) or when a request with the image fails and the app retries with text. Before any receipt text leaves your device, the app removes phone numbers, card numbers, email addresses, authorization codes, member IDs, and cardholder names. Text that is sent goes to our Cloudflare Worker proxy and through OpenRouter to the same providers, in the same order, for categorization. The text is used only to produce the categorization response and is not retained on our servers afterwards, with the same forwarded-email exception described above: the queued copy is encrypted to your devices and deleted once downloaded or after 7 days. For a forwarded email, the text sent for categorization is the message itself, which can include addresses that appear in it; it is handled the same way and not retained. As with images, every request denies training-data use and requests zero data retention (ZDR).

Anonymous Device Identifier

The app generates a random identifier (UUID) at first launch and stores it in your device's Keychain. This identifier:

• Is random, and is not derived from your name, Apple ID, or device
• Is the key our servers use for your usage limit (free tier: 30 categorizations/month, and blocking abusive usage if necessary), your subscription status (via RevenueCat), your forwarding registration and encrypted queued receipts if you use email forwarding, and any issue reports you send
• Persists across app reinstalls so your subscription state and usage count are preserved

Subscription Data

If you purchase a paid subscription, the transaction is handled by Apple's App Store and RevenueCat. We receive only an anonymous subscription status (active/inactive) tied to your anonymous device identifier. We never receive your name, Apple ID, or payment information.

Email Forwarding (Optional)

When you turn on email forwarding, the app shows you a personal forwarding address made from your anonymous device identifier. You can forward a receipt to it by hand, or set up an automatic forwarding rule in your mail client. We never store your email address. Mail sent to your personal address is routed by that address alone, which comes from the random identifier. Each device has its own forwarding address.

You can also forward from your own mailbox to [email protected] by entering your sender address in Settings → Email Forwarding. That address is saved on your device. Our servers keep only a keyed one-way hash of it, which is used to match incoming mail to your device; the address itself is never written to our storage or logs. Removing the address or turning off forwarding deletes the hash.

Turning forwarding on also creates an encryption key pair on your device. The private key stays on your device, in its Keychain, and is never sent to us or synced to iCloud Keychain. Our servers keep only the public key and a one-way hash of a device credential. A forwarded receipt is categorized as it arrives (see Receipt Images and Receipt Text above), then encrypted to your device's key before it is stored, so the queued copy is unreadable to us. It is deleted when your device downloads it, or after 7 days, whichever comes first. If your mail provider sends a confirmation link to approve a forwarding rule (Proton Mail does), that link is encrypted the same way and shown to you in the app, not emailed to you.

Our mail provider, Cloudflare Email Routing, keeps a routing log of each forwarded message's sender, recipient, and subject for up to 30 days. That log is kept by Cloudflare, not in our queue, and we do not use it. When you forward a receipt by hand, the sender in that log is your own email address.

Turning off forwarding in Settings → Email Forwarding deletes your forwarding registration, its keys, and any receipts still queued for you from our servers.

Financial Sync Connections (Optional)

If you choose to connect Lunch Money, QuickBooks Online, or Xero, you authorize the connection directly with that service (via API key or OAuth). The resulting access token, refresh token, and any related account identifiers are stored only in your device's Keychain. We do not store them on our servers. Depending on the service, the app reads existing transactions/accounts to match against your receipts, and writes new transactions, vendors, or category splits derived from your receipt data back to that service. Categorization mapping (which of our 42 categories corresponds to which of your accounts or categories in that service) is computed once, at connect time: the names and IDs of your accounts or categories in that service are sent through our Cloudflare Worker proxy to the same OpenRouter → Microsoft Azure → OpenAI chain, which matches them against our category list. Nothing else from that service is sent: no transactions, no balances, no company or customer details. The resulting map is stored only on your device and is not retained on our servers; as described above, that request also denies training-data use and requests zero data retention (ZDR). Each connection is user-initiated and can be disconnected at any time from Sync → [service] → Disconnect, which removes the stored token from your device.

Issue Reports (Optional)

If you choose Report an Issue, the report includes the receipt text used for processing, the Worker's response, your description of the problem, and technical diagnostics. Unless you turn off Include receipt image in the report, it also includes the receipt image with personal details blacked out on your device, as described under Receipt Images. Pages where the app cannot confirm the mask are left out. We store the report in Cloudflare KV for up to 24 hours, without the image, and a copy with the image is emailed to our support address so we can investigate. That copy is kept for up to 30 days, then deleted. Original PDF files are never included.

Third-Party Services

Data We Do Not Collect

• Name or any account credentials (no login is ever required)
• Email address. We never store it, including for email forwarding. If you enter a sender address for receipts@, we keep only a keyed one-way hash of it (see Email Forwarding above, which also covers our mail provider's routing log)
• Location data
• Contact list or any other device data
• Advertising identifiers (IDFA)
• Analytics or usage telemetry

GDPR / CCPA

We do not ask for your name, an account, or a login. The data we hold is keyed to a random anonymous device identifier, not to your identity. We never store your email address. If you use email forwarding, your queued receipts are encrypted to your devices, and you can delete them at any time by turning off forwarding in Settings → Email Forwarding. To request access to or deletion of any data we hold for your identifier, email [email protected]. We do not sell personal data. We do not engage in targeted advertising.

Data Retention

• Receipt images and line items: Stored on your device until you delete them in the app.
• Receipt text sent for categorization (when sent): Not retained after processing.
• Anonymous identifier and usage count: Retained in Cloudflare KV for rate limiting; reset monthly.
• Forwarded receipts (if you use email forwarding): Encrypted on arrival to keys only your devices hold, and held in Cloudflare KV until your device downloads them or for up to 7 days, whichever comes first. If we cannot process a forwarded email, we keep only a record of the failure reason and sizes, with no message content or addresses, for up to 7 days.
• Email routing log (if you use email forwarding): Cloudflare Email Routing keeps each forwarded message's sender, recipient, and subject for up to 30 days. We do not use it.
• Issue reports (if submitted): Retained in Cloudflare KV for up to 24 hours. The copy emailed to our support address is kept for up to 30 days, then deleted.

Children

The app is not directed at children under 13 and does not knowingly collect any information from children.

Data Deletion

• Receipt images and line items: Delete them in-app at any time.
• Email forwarding: Turn it off in Settings → Email Forwarding. This deletes your forwarding registration and any receipts still queued for you from our servers.
• Anonymous device identifier: Stored in your iOS Keychain and persists across app reinstalls (by design, to preserve your subscription state). To request removal from our servers, email [email protected]. Note: this will reset your usage count and may affect subscription recognition.

Changes to This Policy

We may update this policy as the app evolves. Significant changes will be noted in the App Store release notes. The "Last updated" date above always reflects the current version.

Contact

Questions about this policy: [email protected]