Privacy Policy

Effective: 2026-10-08

This policy explains what What Receipt? collects, how we use it, who we share it with, how we protect it, and how you can delete it. It covers the website at whatreceipt.com, the web app at app.whatreceipt.com, the mobile apps, and the Mac app.

Who we are

What Receipt? is operated by Dylan Roy ("we", "us"). Contact: privacy@whatreceipt.com. Mail: 7251 Maple Grove Road, Cloquet, MN 55720, United States.

What we collect

Data	Why	Kept
Your email address. If you sign in with Google: the name, email address and profile photo Google shares with our sign-in provider (Firebase Authentication)	To create and secure your account and send sign-in links	Until you delete your account
Receipt images and PDFs you upload, forward or that we import from your email	To read, file and show your receipts	Until you delete the receipt or your account
Fields extracted from receipts (vendor, date, amounts, tax, payment method, line items, category, visible text)	The product: search, insights, duplicate detection, exports	Same as above
Gmail connection: your Gmail address, an encrypted refresh token, and for each message we checked its message ID, whether it was a receipt, and its subject line	To import receipts and avoid checking the same message twice	Until you disconnect Gmail or delete your account
Google Drive connection: your Google address, an encrypted refresh token, and the IDs and names of the folders and receipt files we put in your Drive	To keep the copies of your receipt files in your Drive up to date	Until you disconnect Google Drive or delete your account
Other inbox (IMAP) connection: the mail server name, your sign-in email address, an encrypted app password, and for each message we checked its message ID, whether it was a receipt, and its subject line	To import receipts from iCloud, Yahoo, AOL, Fastmail, Zoho Mail or another IMAP mailbox and avoid checking the same message twice	Until you disconnect that inbox or delete your account
Card and bank statements you import (CSV, OFX, QFX or PDF): for each charge, its date, description, amount and currency, the card's last four digits, and which receipt it matches or why it needs none. We read the file and don't keep it. Payments, refunds and deposits on it are counted and left out	To show which charges have no receipt yet (Missing receipts)	Until you remove the statement or delete your account
Card purchase alerts you forward to your What Receipt? address, or that we find in a connected inbox after you turn on card alerts: the charge's date, merchant, amount and the card's last four digits	Same as above	Until you remove them in Missing receipts or delete your account
Linked bank accounts (optional): the bank's name, the account's name, type and last four digits, and its outgoing transactions (date, amount and the description your bank shows), received from Stripe Financial Connections. Never your bank sign-in details or account number, and no balances or deposits	To show which purchases are still missing a receipt	Until you disconnect the account or delete your account
Settings you choose (categories, projects, vendor rules, default currency)	To file receipts the way you want	Until you delete your account
Billing status (plan, renewal date, Stripe customer ID)	To unlock paid features	Until you delete your account. Stripe keeps the invoices and payment records it is required to keep by law
Basic technical logs (request timestamps, IP address, errors)	To keep the service secure and running	30 days

We do not sell personal data. We do not show ads. We do not build advertising profiles. We do not use cookies for tracking or analytics.

Google user data (Gmail)

Connecting Gmail is optional. If you connect it, you grant What Receipt? read-only access to your Gmail (the gmail.readonly scope). This section describes exactly how we access, use, store, share and delete that data.

What we access

We search your mailbox for likely receipts with a fixed search: messages from the last 90 days (or a tax year you choose to import) whose subject mentions a receipt, invoice, order confirmation, payment or purchase, or that carry a PDF named like a receipt or invoice, excluding Gmail's Promotions tab. If you turn on card alerts (Missing receipts), the search also covers purchase alerts from card issuers such as Chase, American Express and Capital One. After that, every 15 minutes we run the same search over recent mail. When you ask us to look for the receipt of one charge, we search mail from the week before that charge to two days after it for its amount or merchant name. We open only messages that match. We do not open other messages, and we do not access your contacts, labels, drafts or settings.

How we use it

For each matching message we read its PDF or image attachments, or its text when there is no attachment, to decide whether it is a receipt and to extract the receipt's fields. Receipts are added to your account. A card issuer's purchase alert is never imported as a receipt: if you turned on card alerts we keep the charge it describes (date, merchant, amount, the card's last four digits), and otherwise we discard it. If a message is not a receipt, its content is discarded immediately; we keep only its message ID, the result, and its subject line so that we do not check it again. We use Gmail data only to provide this receipt-import feature to you. We never send email from your account and never change or delete anything in it.

How we share it

Receipt attachments and receipt email text are sent to our AI provider, Anthropic, solely to extract receipt fields for you, and only once you have allowed it in the app (see How receipts are read). Anthropic does not use this content to train its models. Gmail data is otherwise stored and processed only by our hosting provider, Google Cloud. We do not sell Gmail data, share it with advertisers or data brokers, use it for advertising, or use it to determine credit-worthiness or for lending. We do not transfer it to anyone else except as necessary to comply with the law, or as part of a merger or acquisition with notice to you.

AI and machine learning

We do not use Google user data to develop, improve or train generalized artificial intelligence or machine-learning models, and we do not allow our AI provider to do so.

Human access

No person reads your Gmail data unless you ask us to (for example, for support with a specific receipt), it is needed for security purposes such as investigating abuse, or it is required by law.

Storage, protection and deletion

Gmail data is stored in Google Cloud in the United States, encrypted in transit and at rest; the Gmail refresh token is additionally encrypted with a key only our servers hold. You can disconnect Gmail at any time in Settings. Disconnecting revokes our access with Google and deletes the stored token and the list of checked messages. Receipts already imported stay in your account until you delete them or your account. You can also remove our access at any time from your Google Account's security settings.

Limited Use disclosure. What Receipt?'s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data (Google Drive)

Exporting to Google Drive is optional. If you connect it, you grant What Receipt? access only to files it creates in your Drive (the drive.file scope). We cannot see, open or change any other file in your Drive. This is a separate permission from Gmail: connecting Drive does not give us access to your email.

We create a folder named WhatReceipt, at the top of your My Drive or inside a folder you choose with Google's folder picker (which can be in a shared drive), and put a copy of each of your receipt files in it, sorted by project, year and month and named by date, vendor and total. Choosing a folder gives us access to that one folder, so we can put the WhatReceipt folder in it; it does not give us access to anything else in it. If you choose a folder in a shared drive, everyone with access to that shared drive can see the copies, as Google's sharing settings for it decide. When you connect, and after that every 15 minutes or when you tap Export now, we add new receipts, rename or move copies when you edit a receipt, and move a copy to Drive's trash when you delete its receipt. If you delete a copy in Drive, we do not put it back. We keep the IDs and names of the folders and files we created so that we can update them; we never read their contents back, and we never read anything else in your Drive.

Drive data is used only to provide this export to you, is stored only by our hosting provider, Google Cloud, and is handled exactly as described for Gmail above: we do not sell it, use it for advertising, use it to train AI or machine-learning models, or let anyone read it except as described there. The Drive refresh token is encrypted with a key only our servers hold. You can disconnect Google Drive at any time in Settings, which deletes the stored token and the list of files we created; the copies already in your Drive stay there and are yours. You can also remove our access at any time from your Google Account's security settings. The Limited Use disclosure above applies to Drive data too.

Other inboxes (IMAP)

Connecting another inbox is optional. If you connect one, you give us your mail server's name, your sign-in address and an app password that you create with your email provider for What Receipt? (not your main password). The app password is encrypted with a key only our servers hold and is never shown back to you or written to logs. We connect only over an encrypted connection, open your inbox read-only, and look at message headers (sender, subject, date and attachment names) from the last 90 days, or a tax year you choose to import, and after that only at new mail, every 15 minutes. We download only messages that look like receipts (and, if you turned on card alerts, card issuers' purchase alerts), and handle them exactly like Gmail messages above: receipts are added to your account, a card alert's charge is kept only if you turned card alerts on, and other messages are discarded except for their message ID, the result and the subject line. When you ask us to look for the receipt of one charge, we search the mailbox for its amount or merchant name in mail from the week before that charge to two days after it. We never send, move, delete or mark anything in your mailbox. Disconnecting deletes the app password and the list of checked messages; you can also revoke the app password with your email provider at any time.

Statements and card alerts (Missing receipts)

Missing receipts is optional, and it never asks for your bank login. You import a statement you downloaded from your bank or card's website, or have your card's purchase alerts reach us, and we match each charge to your receipts so you can see which have none. From a statement we keep each charge's date, description, amount, currency and the card's last four digits; we don't keep the file. CSV, OFX and QFX files are read on our servers. PDF statements are sent to our AI provider, Anthropic, to list their transactions, on the same terms as receipts. Card payments, transfers, cash withdrawals, interest and bank fees are marked as needing no receipt. You can remove a statement, with every charge it added, at any time, and remove every charge that came from card alerts. In the Mac app, statements you import stay on your computer.

Linked bank accounts

Linking a bank or card account is optional and part of Pro. It runs through Stripe Financial Connections: you sign in to your bank in Stripe's window or on your bank's own page, never in ours, and Stripe's privacy policy covers what you share with Stripe there. Stripe may offer to save the account with Link, its own service; that is between you and Stripe, and you can continue without it. We ask Stripe only for transactions: not balances, not account owner details, and not account or routing numbers. Stripe sends us the account's transactions from up to the last 180 days, then new ones daily. We keep money going out (date, amount and your bank's description) and discard deposits, refunds and payments. We use them only to show which purchases are still missing a receipt and to match them to your receipts. Bank transactions are not sent to our AI provider.

If your Pro plan ends, we stop the daily transactions; the account stays linked and they start again if you return to Pro. Disconnecting an account in Settings ends our access at Stripe and deletes its transactions from What Receipt?. Your receipts are not affected.

How receipts are read

Receipt images, PDFs and receipt email text, whether uploaded, forwarded or imported from Gmail or another inbox, are sent to our AI provider (Anthropic) to extract the fields shown in the app. PDF statements you import are sent the same way to list their transactions. Under our agreement with Anthropic this content is not used to train their models. Extracted fields are stored in your account. We do not keep the request itself beyond the technical logs above.

The app asks for your permission before it sends anything to Anthropic. You can change your answer at any time in Settings → Reading receipts. While it is off, nothing is sent: you can't add photos or PDFs or import PDF statements, connected inboxes aren't checked, and mail forwarded to your What Receipt? address waits, unread, until you turn reading back on and approve it. You can still add expenses by hand, import CSV, OFX and QFX statements (we read those on our own servers), and export everything. Turning it off doesn't delete receipts that were already read.

Who processes data for us

Google Cloud and Firebase: sign-in, application servers, database and private file storage, in the United States (us-central1).
Anthropic: receipt field extraction, and reading PDF statements you import.
Cloudflare: hosting of this website and the web app, network protection for our API, and delivery of sign-in emails.
Stripe: payments, and Financial Connections if you link a bank account. We never see or store full card numbers or your bank sign-in details.

Each processes data only on our instructions and under its own security and privacy commitments.

How we protect data

All connections use HTTPS (TLS). Data is encrypted at rest by Google Cloud.
Receipt files are kept in private storage. The app shows them through short-lived signed links, or through export and accountant links you choose to create (see below).
Every request is checked against your account, so one user can never read another user's receipts.
Access to production systems is limited to the operator. Our admin tools show account-level information (email, plan, receipt counts), not receipt or email content.

Your choices and rights

Export everything as CSV or Excel at any time from the app.
CSV and Excel exports include a link to each receipt's image so the people you send the file to (an accountant, say) can open it without an account. Anyone who has a link can open that one receipt, so share exports the way you would share the receipts themselves. Links stop working after one year (you can choose a shorter time or no links when you export), when you delete the receipt, or when you turn off an export's links. We record when a link was last opened and how many times.
An accountant link is one web address that shows the receipts you pick (all of them, or one project and date range): their details, totals, images and a CSV download (Excel too while you are on Pro). Anyone who has the address can see all of that without an account until it expires (one year unless you choose another time, at most three) or you turn it off, and receipts you delete or move out of its range drop out right away. The page shows the label you give the link, not your email address, and asks search engines not to index it. We record when it was last opened and how many times.
Delete any receipt, or disconnect Gmail, Google Drive, another inbox or a linked bank account, from the app at any time.
Remove an imported statement and the charges it added, or every charge from card alerts, in Missing receipts at any time. Turning card alerts off stops us keeping new ones.
Turn off reading receipts with AI at any time in Settings → Reading receipts (see How receipts are read).
Delete your whole account at any time in Settings → Delete account, on the web app or in the iPhone and iPad app (see Deleting your account below). You can also email privacy@whatreceipt.com from the address you sign in with and we will do it for you within 30 days.
If you are in the EU/UK or California you may also have rights to access, correct, restrict or object to processing of your data; email us and we will respond within 30 days.

Deleting your account

Open Settings → Delete account on the web app at app.whatreceipt.com or in the iPhone and iPad app. The app shows what will be deleted and asks you to confirm. Deleting is immediate and can't be undone. In this order, we:

Cancel your Pro subscription at Stripe right away (not at the end of the period you paid for), so you are never charged again, and delete your customer record at Stripe.
Disconnect every linked bank account at Stripe, which ends our access to it.
Revoke our access to your Gmail and Google Drive with Google.
Take you out of any shared account you were added to. Receipts you added to someone else's shared account belong to that account and stay there; the inboxes you connected to it are disconnected. If you shared your own account with other people, they lose access to it.
Delete every receipt, receipt file and extracted field, forwarded mail we were holding, statement and card alert charges, inbox and Google Drive connections (with their encrypted tokens and app passwords), forwarding addresses (mail sent to them bounces from then on), export and accountant links (they stop working), your settings, and the links to any Mac you connected to your account (it is signed out).
Delete your sign-in account, so you can't sign in to it again. Signing up later with the same email starts a new, empty account.

If Stripe can't be reached, nothing is deleted and the app asks you to try again, so you are never left with a deleted account that is still being charged. Backups of our database roll off within 35 days. We keep only a note that an account with that internal ID was deleted, and when, with no email address or content, so that the deleted account can't be signed in to again. Basic technical logs expire as described above.

What stays with you: copies already in your Google Drive, files you exported or downloaded, and exports you sent to someone else are yours and are not touched. Stripe keeps the invoices and payment records it is required to keep by law. The Mac app's own library on your computer stays there until you remove it.

The Mac Privacy Edition

The Mac app, when not signed in to an account, stores everything on your computer and sends nothing to us, including statements you import to find missing receipts. If you enable the optional local AI, it runs on your machine.

Children

What Receipt? is not directed at children under 13 and we do not knowingly collect their data.

Changes

We will post changes here with a new effective date and, for material changes, notify you in the app or by email before they take effect.