Privacy Policy

ReceiptVault ("we", "the app") stores proof of purchase so you can make a return or a warranty claim. A receipt is a sensitive document — it can carry card digits, a signature and a phone number — so this policy sets out exactly what leaves your phone, what is stored, and what never happens at all.

1. What we collect

2. What happens to a receipt image, step by step

This is the part that matters most, so it is written out in full:

1. You choose an image. It stays on your device.
2. It is sent once to Google's Gemini model, through Firebase AI Logic, to be read. The request only succeeds from a genuine copy of the app, verified by Play Integrity App Check. At this point the image is as you photographed it, because the AI has to see the page in order to find both the values and the sensitive regions to mask. Google processes it under the Gemini API terms. ReceiptVault does not keep this copy.
3. Masking is burned into the image on your device. The regions the AI identified as card numbers, account numbers, signatures or personal phone numbers are drawn as solid opaque bars and flattened into the pixels. The bars are not an overlay — there is no unmasked layer underneath.
4. The masked image is encrypted on your device with AES-256-GCM, using a key generated on the device for that single image.
5. That image key is wrapped. It is sent to our Cloud Function, which asks Google Cloud KMS to encrypt it, bound to your user ID and that specific receipt. Only the wrapped (encrypted) key is stored. We do not retain the plaintext key.
6. The ciphertext is uploaded to Firebase Cloud Storage under a path scoped to your account, with a random file name that reveals nothing about the merchant or the purchase.
7. Reading it back reverses the process on your device. If the upload or encryption fails at any point, the receipt is not saved at all rather than saved unprotected.

3. Where your data is stored

Extracted receipt records are stored in Cloud Firestore under a path scoped to your Firebase user ID. Encrypted images are stored in Firebase Cloud Storage under the same scope. Security rules enforced on Google's servers — not merely in the app — restrict both to your own account, and reject any image upload that is not marked as masked and encrypted.

So that your vault still opens without a connection — at a shop counter, say — the app keeps a copy of your receipt records (merchant, date, totals, items, deadlines) in its private storage on your device, refreshed after each successful sync. It never holds receipt images or encryption keys, and deleting your account removes it.

These services run on Google Cloud infrastructure, which may process and store data in data centres outside your country. Where required, transfers rely on Google's standard contractual clauses.

4. Location: what the app does and does not do

When a receipt shows where a purchase happened, that comes from two places only: the store address printed on the receipt itself, and — where the AI recognises that specific outlet — an approximate coordinate the AI supplies from its own knowledge. No mapping, geocoding or places API is called. An AI-supplied coordinate is labelled as an estimate in the app, and is discarded when it is implausible or low-confidence; in that case the "open in maps" button simply hands the printed address, as text, to whichever maps app you have installed. What you do in that app is between you and its provider.

5. What we do not collect

• No device location, ever
• No sale or sharing of personal data with data brokers or advertisers
• No phone number, no contacts, no messages, no other apps' data
• No bank or card account connection — ReceiptVault never links to your bank

6. Third-party processors

• Google Firebase — Authentication, Firestore, Cloud Storage, Cloud Functions, Analytics, Crashlytics, Remote Config, Cloud Messaging and App Check. firebase.google.com/support/privacy
• Google Gemini, via Firebase AI Logic — reads the receipt image and returns the extracted values. ai.google.dev/gemini-api/terms
• Google Cloud KMS — wraps the per-image encryption keys.
• RevenueCat — manages subscription entitlements; receives purchase and entitlement metadata tied to your app account. revenuecat.com/privacy
• Google Play Billing — processes the purchase itself. We never see your payment details. policies.google.com/privacy

7. Notifications

Deadline reminders are scheduled on your device from the dates stored in your vault. They are not sent from a server, and the reminder does not disclose the merchant or amount in its text. You can turn them off in the app or in Android's notification settings.

8. Retention and deletion

Your data is kept while your account exists. Deleting your account from Profile → Delete Account in the app permanently removes your profile, your receipt records, your encrypted images and their wrapped keys, and cancels scheduled reminders. This cannot be undone, and there is no backup from which we can restore it.

You can also request deletion in writing through the account and data deletion request form. Requests are actioned within 30 days. Anonymised analytics and crash counts, which cannot be traced back to you, may remain.

9. Your rights

• Delete — in the app, or via the form above.
• Access and export — contact us and we will send a copy of the receipt records held for your account.
• Correction — every extracted value is editable in the app; you are not stuck with what the AI read.
• Withdraw consent — stop using the scanner, turn off notifications, or delete the account entirely.

If you are in the European Economic Area or the United Kingdom, you hold rights under the GDPR and UK GDPR, including access, rectification, erasure, restriction, portability and objection, and you may complain to your national supervisory authority. If you are a California resident, you hold rights under the CCPA/CPRA; we do not sell or share personal information as those terms are defined. Our legal basis for processing is the performance of the service you asked for, and your consent where the law requires it.

10. Children

ReceiptVault is not directed at children under 13, or under the minimum age that applies in your country, and we do not knowingly collect their data. If you believe a child has used the app, contact us and we will delete the account and its contents.

11. Security

Data in transit is encrypted with TLS. Stored receipt images are encrypted with AES-256-GCM before upload, with keys wrapped by Google Cloud KMS. Access is restricted to your own account by server-enforced security rules, and our key-handling functions verify both your sign-in and, through Play Integrity App Check, that the request came from a genuine copy of the app. No system is perfectly secure and we cannot promise absolute security, but a stored page is designed to be useless to anyone who obtains it without your key.

12. Changes

We may update this policy as the app changes. Material changes will be reflected in the "Last updated" date above, and significant ones will be surfaced in the app.

13. Contact

Questions about this policy, or a request about your data: textsmessaging@gmail.com

Data controller: Texts Dev · SET POSTAL ADDRESS