Privacy and data practices
This describes the current invite-only personal service. It is a factual data-handling notice, not a claim of certification or compliance with every privacy law.
Updated 17 October 2026
What is processed
Google sign-in provides verified account information. The service stores receipt photos/PDFs, extracted purchase details, shopping lists, budgets, household membership, model-generated insights, and connection names, permissions, expiry dates and credential hashes. Sign-in security and language preferences use cookies. Uploaded images are re-encoded to remove embedded metadata; PDFs are stored as provided. Receipts may still visibly contain names, addresses or payment details—remove anything unnecessary before upload.
Services involved
The app runs on Vercel, uses Neon Postgres for structured data and private Vercel Blob storage for production uploads. Google handles sign-in; Google-hosted fonts can receive normal browser connection information. Anthropic receives receipt files for recognition and purchase context for requested model features. Ingredient preview itself uses no model. If email intake is enabled by the operator, forwarded mail is additionally processed by its configured Cloudflare or Resend route. Those providers apply their own service terms and retention policies; this app does not promise zero retention by them.
Households and connected agents
An accepted household invitation grants access to the shared ledger; personal ledgers are not automatically merged. Data added to that ledger is visible to its members and to agents the owner has authorized. The owner controls new external grants, including the records that members add. Managed credentials are stored as hashes, expire, and can be revoked. Revocation blocks new requests; it cannot undo an in-flight action or recall copies held by recipients. A household change prevents a managed key from transferring access to a different ledger. This service has no advertising or data-sale feature.
Retention and deletion
Records remain until deleted through the app or handled by the operator. A receipt can be deleted in the signed-in app. Deleting a receipt does not guarantee removal of previously generated summaries, backups, provider logs or copies already received by agents. There is currently no automatic account-wide erasure control or fixed automatic deletion schedule. Ask the operator to review those stores separately if you need a complete deletion request.
Questions and requests
This service is privately invitation-only. Contact the person who invited you using your existing private contact channel for access, correction, deletion or security concerns. Do not send them API keys or receipt files in a public issue. A broader public launch would require a separate review of operator contact details, applicable law, provider terms and user rights.