Privacy policy

How the Receipts app and the Receipts server handle your personal data, and what you can do about it.

Last updated 18 October 2026

1. Who we are

Receipts is a family expense tracker for iPhone, made and run by Skaap Limited. Skaap Limited is the controller of the personal data described here, which means we decide how it is used and are responsible for it.

Skaap Limited
Aisling House
Gortnadiha Upper
Ring
Co. Waterford
Ireland
support@skaap.ie

2. What we keep on our server

Receipts keeps a family's receipts on the Receipts server so that they are safe if a phone is lost and so that the family can share them. The server stores:

Your account

Anyone with the app can create an account, in one of two ways: by starting a new family, which makes you that family's admin, or by joining an existing family with an invite code from its admin. To create an account you enter your name, email address and a password, and, when you start a new family, the family's name if you want to choose it (otherwise it is made from your name).

• Your name, email address and password. The password is stored only as a one-way hash, so nobody can read it, including us.
• Your role in your family (admin, family editor or member), the short name in your receipts email address (for example the “anna” in receipts+anna@…), your currency and your default business.
• Passkeys, only if you add one: its public key, the name you give it and when it was added and last used. The passkey itself stays in your iCloud Keychain or password manager; we can't use it to sign in as you.

Your family

• The family's name, its members and their roles, and invite codes (with the role they give and who created them).
• Categories, and businesses (name, colour, email code and default person).

Receipts

• The details of each receipt: merchant, date, amount, VAT, currency, the amount your bank charged (if you enter it, or confirm it from a bank statement), personal or business, category, business, payment method, notes, who it belongs to, and when it was added and changed.
• The originals: photos, scans, PDFs and other files you add, and for receipts that arrive by email the complete email with its attachments. Originals are stored exactly as they arrive.
• Which way up each original is shown: your iPhone works out which way up each picture or page is (on the device), and you can turn a page by hand. We store only that turn (in degrees) with the file, and whether a phone or a person chose it and when. The files themselves are never changed.
• Emailed attachments that a phone flagged as unsuitable (see “Checks on your iPhone” below): only the attachment's record (file name, type, size and a fingerprint of the file) with a note that it was removed and why; not the file.
• “Matched” marks, only if you check bank statements in the app: for each matched receipt, which receipt it is, who matched it and when, and when it was unmatched if it was. Nothing from the statement itself (see “Bank statements” below).
• Receipts in the Bin: when they were deleted and when they will be deleted for good. After that we keep only a short record that the receipt was deleted for good (its internal ID number, the family's and owner's ID numbers and the date), so that every phone removes its copy; it contains no receipt details and is deleted with the family.

Keep my originals only on my devices (only if you turn it on)

• That you turned it on and when, and for each original which family members have confirmed a copy in their own iCloud (their ID number, a checksum of the file, a one-way code for the iCloud account it is in, so that two copies in the same iCloud account are not counted as two, and when it was saved). When a receipt is deleted for good, we keep the ID numbers of the people whose iCloud still holds a copy of its originals until their phone confirms it deleted them. We don't receive anything else from your iCloud.
• Until both copies are confirmed, the original stays on our server as described above. After that the server keeps only the receipt's details and a record of the file (its name, type, size and checksum).

Email import (only if your family connects a mailbox)

• Emails that arrive at your family's receipts addresses, including their sender, recipient, subject and date. This includes emails waiting for approval, emails sent to an address nobody in the family has, emails that were rejected, and emails that could not be read or imported (your family's admins can see these; for an email too large to download or that could never be downloaded we keep only a record of it, without its sender, subject or contents).
• Your list of approved senders (email addresses or domains whose mail becomes a receipt straight away).
• The connected mailbox's address and what the server needs to read it: for Microsoft 365, the address of the Microsoft account used to connect it and the access details Microsoft issues; for other email (IMAP), the server name, user name and password. Passwords and access details are stored encrypted.

Sign-in and security records

• For each device you sign in on, a sign-in record: a random key (stored only as a hash), the device type that iOS reports (such as “iPhone”), and when it was created and last used.
• Notifications, if you allow them on a device: the push token Apple gives that device for this app, whether it is a test or App Store version, and the app's build number. It is tied to the device's sign-in and deleted when you sign out on that device or delete your account.
• The app's build number, which the app sends with each request so the server can ask very old versions to update. The server compares it; it is stored with a device's notification registration and, as part of the app version, in our web server logs (see Server logs below).
• Every sign-in, sign-up and password attempt (passkey sign-ins without an email address), the IP address (for IPv6, only the network part) and whether it succeeded. We use these only to limit password guessing. They are deleted automatically after 90 days.
• Server logs. Our web servers log each request's IP address, time, requested address, referring page and app or browser version. The app's own log records technical events, mostly with internal ID numbers rather than names. It also records the mailbox address (and the address of the account used to connect it, or the email server's name) when a mailbox is connected or set up, and an IP address when a sign-in limit is reached; error messages in it can contain an email address. Logs are used only to keep the service running and secure, and are deleted after a set time (see “How long we keep it”).

Notifications carry only generic text, such as “New receipt” or “An email is waiting for your approval”; never a sender, subject, amount or email address. They may also carry the number of items waiting in your Inbox (shown on the app icon), never what they are. A reminder to save originals names the family member they belong to. We don't collect your location, contacts or advertising identifiers.

3. What stays on your iPhone

• Reading receipts. The app reads the text of photos, scans, PDFs and emails on your iPhone, using Apple's on-device text recognition. Only the details it finds (such as merchant, date and amount) are saved to the receipt. Receipt content is never sent to an online text-reading or AI service.
• Guessing the category. To suggest a category, the app also reads the receipt's line items (each item and its price) and learns from the categories your family chose before. On iPhones with Apple Intelligence it may use Apple's on-device language model for this, never Apple's online Private Cloud Compute. The line items, what the app learns from them and any suggested new category stay on that iPhone; only the category you keep is saved to the receipt.
• Checks on your iPhone. When you add a photo or file (camera, scanner, photos, files or the share sheet) and when your iPhone reads an emailed receipt, it checks the pictures (and the first pages of PDFs) on the device; for an emailed receipt, it checks up to ten of its pictures and PDFs. If Sensitive Content Warning or Communication Safety is turned on in your iPhone's settings, Apple's on-device Sensitive Content Analysis looks for nudity, and Receipts doesn't add such files (nothing is uploaded). It also warns you when a file doesn't look like a receipt (no readable text, amount or date); you can keep it anyway. Nothing is sent to us or anyone else for these checks. If neither setting is on, pictures aren't checked for nudity.
• Emailed attachments a phone flags. Emailed receipts reach our server before a phone reads them. If the phone that reads one flags an attachment, it tells our server, and we delete that attachment and our stored copies of the whole email it came in, including any email forwarded inside it as an attachment (the sender and subject stay with the receipt's email record). If nothing else in the email looked like a receipt and the receipt holds nothing but the email and the flagged files, the receipt is deleted, as with Delete now in the Bin. Otherwise we keep only the attachment's record (file name, type, size and a fingerprint of the file) with a note that it was removed and why, not the file. Your family's iPhones delete their copy when they next sync (an iPhone still on the first App Store version of Receipts keeps its copy until the receipt is deleted), iCloud copies are deleted by the phones that hold them, and our logs record only how many files were removed. The copy in your family's own mailbox isn't touched.
• Page orientation. The app works out on your iPhone which way up each photo, scan or PDF page is, so it reads and shows it upright; you can also turn a page yourself (open the file and tap Rotate). Only the turn is stored with the file, and synced to your family's phones; the file itself is never changed, and exports and shared files are the original files.
• Background updates. When iOS allows it, the app syncs and reads new receipts in the background (for example after a notification, or overnight while charging), in the same way as when it is open.
• Face ID. If you turn on the lock, iOS checks your face, fingerprint or passcode and only tells the app whether it succeeded. Your face and fingerprint data never leave your iPhone and the app never sees them.
• Your copy. The app keeps a copy of the receipts and originals you can see, so it works offline. It is removed when you choose “Sign out and remove data from this iPhone”, when someone else signs in on the iPhone, or when your account or family is deleted. A plain “Sign out” keeps it for your next sign-in.
• Exports. CSV files, PDF reports and zip files with the originals are made on your iPhone and go only where you send them. The app deletes its own working copy when you have shared or saved the export, and when a receipt is deleted for good. If an email is too large and you choose Send with Mail Drop, Apple's Mail uploads the files to Apple's iCloud for 30 days, and anyone with the link in the email can download them; the app asks you before that happens.
• Keep my originals only on my devices. If you turn this on (on your own page in Settings), the app saves the originals of your receipts in the app's private storage in your own iCloud account (Apple), and the phones of your family's admins save a copy in their own iCloud accounts, so the family can still open them. Once your copy and an admin's copy are confirmed (your own copy is enough if you are the family's only admin), the original is deleted from our server. If you turn it off, the app puts the originals back on our server and the iCloud copies are deleted. Family editors and members then see “Original kept on …'s devices” instead of the image.
• Try the demo. The demo uses made-up data in the app's memory. Nothing in it is saved or sent anywhere.

Bank statements

You can check a bank statement in the app to find receipts you're missing. The statement is read on your iPhone and is never sent to us: not the file, not its transactions and not your account details. The app deletes its copy of the file once it has read it (a statement you chose in Files stays there, as your own file; one you share to Receipts from another app waits on your iPhone until you next open Receipts, and is left out of the iPhone's backups). Your iPhone keeps all of the statement's transactions: for each, the bank's description of the transaction, its date and its amounts. You don't see most of them in the app: it keeps them so it can check them again for matches when you add receipts or tap Check again. It shows you the transactions it matched to receipts, the ones waiting for you to check, and the missing receipts (for a business account every payment out; for a personal account payments at shops you already have receipts from, or a match you later undid). For each statement it keeps the account it is from and the dates it covers; for each account, the last four digits of the account number, whether it is personal or a business's, and the account's currency; and, for transactions you set aside (for example with Not needed), which ones and the reason you chose (for transactions set aside with an earlier version of the app, only a one-way fingerprint, for 18 months). These stay on your iPhone and in its backup (for example your own iCloud), never on our server. They are removed with the app's copy of your data (see “Your copy” above), when you are removed from the family, or on their own in Settings → Data → Bank statements.

For each matched receipt we store a “matched” mark: which receipt, who matched it and when, and when it was unmatched if it was. Only the person who matched it and the family's admins can see a mark. If you confirm what your bank charged for a receipt in another currency, that amount is saved on the receipt like any other change you make. Marks are deleted with the receipt when it is deleted for good, and with the family; when someone deletes their account, their marks stay with the family's receipts as a former member's.

The app contains no analytics, advertising or other third-party code.

4. Who can see your data

• Your family. Admins and family editors can see all of the family's receipts and the family's member list (names, email addresses and roles). Members see only their own receipts. Emails waiting for approval are visible to the person they were sent to and to the family's admins; emails sent to an address nobody in the family has, and emails that could not be imported, are visible to the family's admins. If you keep your originals only on your devices, your family's admins also keep a copy of them in their own iCloud.
• Matched marks from bank statements are visible only to the person who matched the receipt and to the family's admins, who also see who matched it. The statement itself is seen by nobody but you, on your iPhone.
• Other families on the server can't see anything of yours.
• Us. We look at data on the server only when we need to: to keep the service running and secure, to help you when you ask us to, or when the law requires it.

5. Other companies involved

• Hosting. Our server is located in Ireland. It is our own equipment, run by us, not by a hosting company.
• Apple distributes the app through the App Store and TestFlight. Apple's own privacy policy covers your Apple Account and downloads. If you have chosen in your iPhone's settings to share analytics with app developers, Apple may pass us crash reports and usage statistics, which we use only to fix problems.
• Microsoft, only if your family connects a Microsoft 365 mailbox. Our server then signs in to Microsoft to read the emails sent to your family's receipts addresses and moves them to an “Imported” folder in that mailbox. With automatic setup, a family admin signs in with Microsoft and the server sets up that access in the family's Microsoft organisation; Microsoft also tells our server when new mail arrives. Microsoft handles this under your organisation's agreement with Microsoft.
• Your email provider, only if your family connects another mailbox (IMAP). Our server signs in to it with the details your admin enters and reads the emails sent to your family's receipts addresses.
• Apple Push Notification service. To notify you, our server sends the device's push token and the generic notification text to Apple, which delivers it to your iPhone. Silent notifications that only wake the app to sync go the same way.
• Apple iCloud, only for people who turn on “Keep my originals only on my devices”: the originals are stored in their own iCloud account and in their family's admins' iCloud accounts, under each person's agreement with Apple. We have no access to them there.
• European Central Bank. To estimate amounts in other currencies, our server downloads the ECB's public exchange rates. Nothing about you is sent. The app gets the rates from our server, never from anyone else.

We don't sell, rent or trade personal data, we don't share it with advertisers or data brokers, and we don't track you across other companies' apps or websites. We disclose data to authorities only when the law requires it.

Apple and Microsoft may handle data outside the European Economic Area under their own terms and safeguards. Our server stays in Ireland.

6. Why we use your data

• To provide the service you signed up for (the contract between us): your account, sharing within your family, keeping your phones in step, importing emailed receipts and estimating other currencies.
• Our legitimate interest in keeping the service safe and working: limiting password guessing, logs, backups and fixing problems.
• Legal obligations, when the law requires us to keep or hand over data.

7. How long we keep it

• Receipts, originals and emails are kept until the receipt or the family is deleted. Deleting a receipt moves it to the Bin (Settings → Data → Bin), where it can be restored. After 7 days, or straight away when you choose Delete now, the receipt, its originals, the stored email and its sender and subject are deleted from our server and from your family's devices (and from iCloud, for originals kept there: each person's phone that saved a copy deletes it the next time the app runs, and keeps trying until it is gone); the email itself stays in your own mailbox. We keep only the short record described above. Who can delete and restore a receipt follows the same rules as editing it.
• Matched marks are kept until the receipt is deleted for good (Bin) or the family is deleted. Unmatching a receipt keeps the mark with the time it was unmatched, so the other devices of the person who matched it learn it. When someone deletes their account or is removed from the family, their marks stay with the family's receipts as a former member's. Bank statements and their transactions are never on our server (see “Bank statements”).
• Emailed attachments a phone flags are deleted from our server, with our stored copies of the email they came in (and of any email forwarded inside it), as soon as the phone reports them (see “What stays on your iPhone”).
• Deleting your account (Settings → Account → Delete account): your name and email are replaced with “Former member”, your password stops working, your devices are signed out, and your approved senders, passkeys and notification registrations are deleted. The receipts you added stay with your family, because they are part of the family's shared records, and emails you forwarded still contain the addresses in them. If you kept originals only on your devices, the copies of your own originals in your iCloud stay yours (delete them in your iCloud settings if you want); originals already off our server stay with your family's admins' copies and are put back on the server, after which the admins' phones delete their copies. If you are an admin, the app deletes the copies of other family members' originals from your iCloud. If you connected the family's mailbox, the address of the account you used stays with the mailbox connection (see below). The family's last admin can't delete only their own account: they make someone else admin first, or delete the whole family.
• Mailbox connection. The connected mailbox's address and the account used to connect it (the Microsoft account's address, or the IMAP user name) are kept with the family until the family is deleted, also after the mailbox is disconnected. Disconnecting deletes the stored passwords and access details straight away.
• Deleting the family (the last admin, from the same screen): everything the family has on our server is deleted, including every person, receipt, original, email, category, business, invite and the mailbox connection. The mailbox itself and the emails in it stay in your email account. The phones of the family's people delete the copies of other people's originals they kept in their own iCloud (“Keep my originals only on my devices”) when they learn the family is gone; copies of a person's own originals stay in that person's iCloud. If automatic Microsoft 365 setup was used, the access it created stays in your Microsoft organisation until your administrator removes it. Sign-in attempt records stay until they expire, without the email address, and log entries stay until the log is deleted. So that phones still signed in to the deleted family learn it is gone and remove their copy, we keep a one-way hash of each of their sign-in keys for 90 days; it contains nothing that identifies a person.
• Removal from the family. When an admin removes someone, their devices are signed out and the copies of other family members' originals in that person's iCloud are deleted by their phone; the family no longer counts them as a copy.
• Sign-in records are kept while the account exists. Sign-in attempt records are covered under “Sign-in and security records” above. Passkeys are kept until you remove them, your password is reset (an admin sets a temporary password for you), or the account is deleted; changing your own password keeps them. A device's notification registration is deleted when you sign out on it.
• Logs. Web server logs are deleted after 14 days. Each month's app log is deleted automatically 90 days after the end of that month. Log entries are not removed when an account or family is deleted; they go when the log is deleted.
• Backups. We back up the server's data, for example before each update of the server, so we can recover from a failure. They are stored on our server; no other company holds them. Backups are kept for up to 30 days and then deleted. Data you delete disappears from the backups when they expire. We use backups only to restore the service.
• The App Review demo account. The demo account we give Apple's reviewers contains only made-up data and is reset every night. Deleting that account in the app marks it as deleted so that it can be restored for the next review.

8. How we protect it

• The app talks to the server only over encrypted connections (HTTPS).
• Passwords and sign-in keys are stored only as hashes, for passkeys only the public key, and mailbox passwords and access details are stored encrypted.
• The server checks who may see each receipt on every request; the app is never trusted to decide that. Originals can only be downloaded by family members allowed to see them.
• After too many wrong passwords, further attempts are refused for a while, and the database is not reachable from the internet.

9. Your rights

Under the EU General Data Protection Regulation (GDPR) you have the right to:

• access your data and get a copy of it;
• correct it: edit your name and your receipts in the app, or ask us (for example to change your email address);
• delete it: delete receipts (Bin → Delete now) or your account in the app, or ask us;
• take it with you: export receipts as CSV or PDF, with or without their originals, in the app (Settings → Data → Export), share any original from its receipt, or ask us for a full copy;
• restrict or object to how we use it.

To use any of these rights, email support@skaap.ie. We answer within one month. We may need to confirm that the request comes from you, usually by replying to your account's email address.

You can also complain to a data protection authority. Ours is the Irish Data Protection Commission (dataprotection.ie); you can also contact the authority where you live or work.

10. Children

Receipts is made for adults keeping track of household and business expenses. It is not directed at children, and we don't knowingly collect personal data from children. If you think a child has an account, contact us and we will delete it.

11. Changes to this policy

When we change this policy we update this page and the date at the top. If a change affects how we use your data in a significant way, we tell account holders by email before it takes effect.

12. Contact us

Questions about privacy or this policy: support@skaap.ie, or write to Skaap Limited, Aisling House, Gortnadiha Upper, Ring, Co. Waterford, Ireland.