Last updated: 13 October 2026
Application: ReceiptFolio for Android and iOS (com.receiptfolio.app)
ReceiptFolio helps keep receipts, track purchases, returns and refunds, store warranty documents and organize expenses into projects. Its approach to privacy rests on one principle: purchase information is kept on the device, not on ReceiptFolio’s servers.
This policy explains what information the app uses, when some of it may be sent to external services, and how it stays under the user’s control.
ReceiptFolio keeps the information needed to manage purchases in the app’s private storage:
This information is not synced with the ReceiptFolio account, nor with a Google or Apple account. Signing in on another device therefore does not bring back the purchases saved on the first one.
ReceiptFolio does not extract or store in its data a full payment card number, a security code or a banking identifier. An already masked label, such as Visa ••••4582, may be kept. A sequence of five or more digits next to a card term is discarded rather than partially reproduced.
Recognized text is stored without the lines that carry a card number, an authorization code or a transaction identifier, and without email addresses. The same removal applies, where relevant, to text sent for AI enhancement.
Important: original photographs and PDF files are not altered. Sensitive information visible on a photographed or imported document — a full card number, for example — remains visible in that document, just as on the paper. Text stored before 9 October 2026 is cleaned when the app updates, and an older backup is cleaned when it is restored. A backup file already exported is not changed for as long as it is kept.
Deleting an item also deletes its returns, warranties and flagged issues, without deleting the purchase or its receipts. Deleting a purchase removes its receipts, its items and everything attached to them. Deleting a receipt removes only that document and keeps the purchase and its items.
Uninstalling the app removes the local library. Copies may still exist in the operating system’s backup, depending on device settings. That backup is managed by Apple or Google; ReceiptFolio does not perform it, does not read it, and offers no online sync.
Text recognition always runs on the device, using Google ML Kit. On Android, ML Kit also frames documents; on iOS, framing uses Apple’s scanner.
Reading a receipt never sends its image anywhere — not to recognize the text, not to frame the document, and not for AI enhancement. A document leaves the device only when it is shared, exported or backed up to a destination the user chooses (sections 5 to 7), or through the operating system’s backup when it is turned on.
ML Kit sends Google certain technical data about its own operation, whether or not AI enhancement is used. This transmission cannot be turned off from the app.
According to Google’s documentation, this data includes: the device manufacturer and model, the operating-system version, the available machine-learning hardware, the app name and version, per-installation identifiers (which Google states are not intended to identify a person or a physical device) and, for features delivered through Google Play services such as the document scanner on Android, a device identifier, as well as processing times, the library’s configuration, input and output sizes, its version, the event type and error codes.
These diagnostics contain no image, no recognized text and nothing from the purchase library. ReceiptFolio neither receives nor reads them. They are not linked to the ReceiptFolio account, so deleting the account does not delete them. Google states that it encrypts them in transit, uses them for diagnostics and usage analytics, and does not transfer them to third parties. They are governed by Google’s Privacy Policy.
AI enhancement helps interpret a receipt: an artificial-intelligence model reads its text again and proposes the merchant, the date, the amounts, the taxes, the discounts and the items.
This option is off by default. It requires signing in to an account and giving prior consent, and it turns itself off on sign-out. It can be allowed or withdrawn at any time under More → Preferences → Improve with AI.
Once allowed, an enhancement is started with the Improve with AI button. A separate option, Improve automatically after each scan, also off by default, starts one after every scan with no further action. Each automatic enhancement counts against the AI allowance, just like a manual one.
Without this permission, or after it is withdrawn, ReceiptFolio reads receipts with its own local rules alone, without sending their text, and every feature stays available.
Only when AI enhancement is allowed and started, and for that one document:
Before sending, lines containing card data, authorization codes or transaction identifiers are removed, and so are email addresses. Despite this filtering, receipt text may still contain personal information, such as a name, a postal address, a phone number or a loyalty number printed on the receipt.
Never sent, either to the ReceiptFolio service or to AI providers: the photograph or PDF file, the file name, the time of capture, or any identifier of the device, the purchase or the receipt.
The request to the ReceiptFolio service carries the opaque account identifier, to check access and count AI enhancements. The service never forwards it to AI providers.
The text is analyzed to propose a more complete reading of the receipt. The app compares that proposal with its own reading before presenting it, and the information can then be reviewed and corrected. ReceiptFolio uses this data for no other purpose and trains no model with it.
The text is first sent to ReceiptFolio’s analysis service, hosted on Cloudflare Workers, and then to one or more third-party providers specialized in artificial intelligence, each operating under its own terms of service and privacy policy. Communications are encrypted (HTTPS).
The providers selected, and what their policies state about retention, are recorded in the service’s configuration with their source and date rather than assumed. They may change over time; what they are sent remains what is described above.
The service and those providers may process the text outside the user’s province, state or country of residence, in countries whose data-protection rules may differ. While it is there, it may be accessible to the courts, law-enforcement agencies and national-security authorities of those countries under their laws. The list of providers used and the countries where they process data can be requested at the address given in section 16.
The ReceiptFolio service keeps nothing of the receipt. No text, image, result or history is written to a database, a queue or a log. While reading, the text is held in memory, with calculation caches that belong to that single request; once the request is over, the runtime frees that memory on its own schedule, with no guarantee of instant erasure.
Providers apply their own retention rules, and ReceiptFolio does not control them. ReceiptFolio guarantees neither zero retention, nor immediate deletion after processing, nor the absence of temporary copies, nor that the data is anonymous. Under its policy, a provider may keep what it receives for some time and use it for its own purposes, including improving its models. As of the date of this policy, the provider in use states that it retains the data it receives.
Allowing AI enhancement therefore means accepting that the text of a receipt, without the image and without the account identifier, may be processed in other countries and retained by those providers. Withdrawing permission stops any new transmission; it does not delete information already sent, which is governed by the policy of the provider concerned.
As with any internet request, the service sees the IP address the request comes from, but never stores it. To prevent abuse, it derives from it a salted, keyed cryptographic digest, meaningless anywhere else, kept for the length of a rate-limiting window, never logged and never linked to receipt content.
Operational logs contain only limited technical information: processing times, result categories, quota checks. Every permitted field is a number, a boolean or a value from a fixed list, so no field can hold the content of a receipt. They contain no receipt text, merchant, amount, AI request or response, IP address or access token. Cloudflare keeps these logs for a few days.
To prevent software other than ReceiptFolio from using the service, an enhancement request may carry a platform attestation: Play Integrity on Android, App Attest on iOS.
These checks contain no receipt content. A Play Integrity verdict contains no device identifier. On iOS, the attestation carries the identifier of a key generated by the app and renewed regularly; the service checks it without storing, logging or returning it.
The published version requires a successful check. If the device cannot provide one (an emulator, or a device without the platform’s services, for example), AI enhancement does not take place and local reading remains available.
A saved document can be shared with another app: email, messaging, cloud storage or any other destination the device offers.
No document is sent automatically. Sharing happens only after an explicit action and the choice of a destination in the system share sheet. ReceiptFolio proposes, remembers and contacts no destination on its own. Only the chosen document is shared: no product, merchant, price or note is attached, and no message is written.
To hand the file over, the system share sheet may make a temporary copy in the app’s private storage until it is cleaned up; that copy is not part of the library. Once the file is sent, how it is used and kept depends on the receiving app or service. Sharing a document does not sync the library.
The purchase list and a project’s page can produce a file of what they show, as CSV or PDF.
The export is created on the device, with no network and no artificial intelligence. ReceiptFolio keeps no copy of it, apart from the temporary sharing copy described in section 5, and sends it nowhere without a sharing action.
Depending on the list exported, the file may contain merchants, dates, amounts, items, warranty or return details, flagged issues and notes, but no internal identifier. It should therefore be protected like any document containing purchase information.
A CSV or PDF export is not a restorable backup of the library.
The Premium feature More → Data and backup creates a .rfbackup file to move the library to another device. Both creating and restoring a backup require Premium.
The file is created on the device, with no network and no artificial intelligence. It contains purchases, items, taxes and discounts, receipts, recognized text, returns, refunds, warranties, flagged issues, projects and histories, as well as the documents themselves (receipt photographs and warranty files). It also includes four local preferences: merchant-logo display, interface language, default currency, and whether the welcome screen has already been seen.
Important: this file is not encrypted, and the app says so before creating it. Anyone with access to it can view the documents and information it contains. It should therefore be kept in a safe place and shared only with trusted recipients. A forgotten password would destroy the only copy of a library: that risk was judged more serious, and optional encryption is still under consideration.
The file contains no sign-in session, account identifier, plan or Premium entitlement, token, AI enhancement allowance or authenticity attestation. Consent to AI enhancement is not restored: it must be given again on the other device.
ReceiptFolio does not upload the file and keeps no copy of it, apart from the temporary sharing copy described in section 5. The transfer depends on the destination chosen and the practices of the receiving service.
Restoring completely replaces the library on the device. The app states what will be deleted before doing so. A file that is damaged, lacks library data, or uses a format the installed version cannot read is refused, and the existing library is left unchanged. A file created by a newer version whose format remains readable can be restored: the app first warns that some information might not be restored, and cancelling changes nothing. A document missing from the file does not prevent the restore; the app says so.
To make purchases easier to recognize, ReceiptFolio shows the public logos of some merchants. This option is on by default. It is the only feature of the app that loads an image from the internet.
The merchant is recognized on the device, from a list built into the app: merchant names are never sent anywhere to be identified. An image request is then sent to a logo service. It states the brand requested and ReceiptFolio’s public client identifier for that service, which is the same for every user, and contains no receipt, item, amount, date, note, or identifier of the user, the device or the purchase.
That service can nevertheless see the brand requested and the technical details of the connection, including the IP address, as any website visited can. Across a whole library, the brands a device asks about may give an indication of the stores its owner visits.
Logos can be turned off at any time under More → Preferences. Every request stops at once, and there is nothing to delete anywhere. Merchant initials are then shown instead. Offline, or for an unknown merchant, initials are shown too, and no other feature is affected. Logos remain the property of their respective owners.
The free plan’s limits, including the number of active projects and of automatic scans, are set by ReceiptFolio’s service, so they can change without an app update.
When an account is signed in, this information comes with the plan details. Otherwise, at most once a day, when the projects or the add screen are opened, the app asks the service for the current limits. That request contains no receipt, purchase, project, account identifier or device identifier; the service sees only the connection it comes from.
Free automatic scans are counted on the device only: no scan, count or receipt is sent to check them. Offline, the app uses the most recently received limits or, failing that, the ones shipped with the app.
ReceiptFolio does not request access to location, contacts or the microphone.
On Android, the app also asks Google Play whether an update is available and may offer it; that check is carried out by Google Play and involves no data from the library.
A ReceiptFolio account is optional. Sign-in uses Google, or Apple on iOS; there is no password and no emailed code.
At sign-in, the service checks the token issued by Google or Apple and keeps only the stable identifier that provider assigns to the account, linked to an opaque ReceiptFolio identifier. Google’s token may contain the account’s email address, name or photo: the service neither uses nor keeps them. With Apple, neither a name nor an email address is requested.
The service keeps only: the opaque account identifier and its creation date, the sign-in provider’s stable identifier, the count of AI enhancements, the Premium status (plan and end date), the references of store transactions linked to the account, and a version number used to invalidate sessions.
The email address of the Google account is kept on the device only, to show which account is in use under More → Account. It is not sent to the ReceiptFolio service and is removed from the app on sign-out or account deletion.
A session lasts for a limited time and may be renewed without any action from the user. Signing out invalidates, with the service, every session already issued for the account, through a signed request that contains no receipt, document, amount or email address. If the service cannot be reached, the session is still removed from the device and expires on its own.
Premium subscription. Payment is handled by Google Play or the App Store; ReceiptFolio receives no payment details. A subscription-management provider validates purchases: at sign-in, the app gives it the opaque account identifier so that a purchase can be linked to the right account. That provider keeps a customer profile and the purchase history needed to validate purchases, grant Premium and produce its subscription-management statistics. The ReceiptFolio service may query it with the same identifier to keep the Premium entitlement up to date, for example after a transfer or a refund.
ReceiptFolio shows no ads, uses no advertising identifier, sells no personal data, and does not track actions in the app for profiling or marketing. No data broker receives anything.
ReceiptFolio collects no usage or crash reports for its own analytics. This does not prevent Google ML Kit’s technical diagnostics or the processing needed to manage subscriptions, described above.
ReceiptFolio does not access email inboxes or bank accounts.
ReceiptFolio is a purchase-management tool for a general audience. It is not directed at children and does not knowingly collect their personal information.
Library information can be viewed, corrected or deleted directly in the app, or removed entirely by uninstalling it. Because ReceiptFolio keeps no copy of that library on its servers, it can neither retrieve nor delete it remotely.
To delete account information, use More → Account → Delete account. Deletion erases the account identifier, the AI enhancement count, the Premium entitlement and the store references, and requests the deletion of the associated information from the subscription-management provider.
An account created with Google can also be deleted from a browser, without the app and without reinstalling it: Request deletion of a ReceiptFolio account. The page asks for a sign-in with the Google account concerned and then a confirmation; it keeps no copy of that sign-in and logs none of it. An account created with Apple is deleted from the app.
Deleting the account deletes no receipt and cancels no subscription. Receipts never left the device, and the subscription must be canceled separately in the store where it was purchased. Google ML Kit’s diagnostics, which are not linked to the account, are governed by Google.
Withdrawing consent to AI enhancement immediately stops future transmissions. Since the ReceiptFolio service kept nothing, there is nothing to delete there; a request about text already sent to a provider is governed by that provider’s policy. The list of providers used can be requested at the contact address.
For any request about account information or the exercise of applicable data-protection rights, write to the contact address below.
This policy may be updated to reflect changes to the app, the services it uses or applicable requirements.
If what may be sent for AI enhancement changes, the consent version changes with it, and the app asks for new consent before any further transmission. Changing providers does not, by itself, change the information sent or the conditions described in this policy.
The date at the top of this document indicates when it was last updated.
For questions about this policy, the information processed or the external providers used:
receiptfolio.support@gmail.com