Open App

Privacy Policy

Last updated: April 7, 2026

Awesome Receipts is operated by Superposition Labs Inc. ("Company", "we", "us", "our"), a corporation registered at 1600 – 925 West Georgia Street, Vancouver BC V6C 3L2, Canada.

Awesome Receipts is a web application ("the App") that allows you to upload receipt images for AI-powered OCR (optical character recognition) processing, organize expense data, and export records.

This Privacy Policy describes how we collect, use, store, and protect your information. By creating an account and using the App, you consent to the practices described herein.

1. Legal Basis for Processing

We process your personal data on the following legal bases:

  • Consent: You provide explicit consent when you accept this Privacy Policy and Terms of Service upon registration.
  • Contractual necessity: Processing required to provide the App's services to you (account management, receipt processing, data storage).
  • Legitimate interest: Improving service reliability, preventing fraud, and maintaining security.

You may withdraw your consent at any time by deleting your account or contacting us. Withdrawal does not affect the lawfulness of processing performed before withdrawal.

2. Information We Collect

Information You Provide

  • Account information (required): When you create an account via Google Sign-In or email registration, we collect your name and email address. This information is used for account creation, identity verification, and to associate your data with your account.
  • Receipt images: When you upload receipt images, the original image files are stored on our cloud storage infrastructure and retained for as long as your account is active.
  • Receipt data: Information extracted by OCR (merchant names, dates, amounts, taxes, totals) and any data you manually enter or edit (categories, notes, job codes) is stored in our database, associated with your account.

Google Account Data (Google Sheets Integration)

If you choose to connect the optional Google Sheets export feature, we collect and store the following data from your Google account:

  • OAuth refresh token (required): A long-lived token that allows us to access your Google Sheets and Google Drive on your behalf. This token is encrypted using AES-128 symmetric encryption (Fernet) before being stored in our database and is never stored in plaintext.
  • Spreadsheet metadata: The ID, title, and sheet tab name of the spreadsheet you create or connect to. This is used to identify where to sync your receipt data.

We request only the minimum Google API scopes required:

  • spreadsheets – to create, read, and write data to your connected Google Sheets spreadsheet.
  • drive.file – to list and access only the spreadsheet files created or opened by this app. We cannot see or access any other files in your Google Drive.

Awesome Receipts' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Information Collected Automatically

  • Authentication tokens: A JSON Web Token (JWT) is stored in your browser's local storage for session management. Tokens expire after 7 days.
  • Server logs: Standard web server logs may record your IP address, browser type, and request timestamps for security and diagnostic purposes. These logs are retained for no longer than 90 days.

3. How We Use Your Information

We use your information solely to:

  • Provide the App's receipt scanning, data extraction, and expense management services
  • Authenticate your identity and maintain your session
  • Store and display your receipt images and extracted data
  • Enable you to export your data (e.g., CSV export, Google Sheets sync)
  • Respond to your support requests
  • Maintain security and prevent abuse

We do NOT use your receipt images or data to train machine learning models. We do NOT use your data for advertising or marketing purposes. We do NOT build user profiles for any purpose beyond providing the App's services.

4. Image Storage and Processing

When you upload a receipt image:

  • The image is stored on Cloudflare R2 cloud storage, associated with your account.
  • The image is sent to a third-party AI service (via OpenRouter) for one-time OCR text extraction. The AI service processes the image to extract text and structured data, then the image data is not retained by the AI service beyond the processing request.
  • The original image remains stored on our infrastructure so you can view it within the App.
  • Receipt images may contain sensitive financial or personal information. You are responsible for ensuring you have the right to upload any images you submit.

You may delete individual receipts at any time, which permanently removes both the image and associated data. You may also delete all data by deleting your account.

5. Data Storage and Location

  • Uploaded images: Stored on Cloudflare R2. Cloudflare operates a global network; data may be stored in multiple regions. See Cloudflare's privacy policy for details.
  • Account and receipt data: Stored on MongoDB Atlas. Our database cluster is hosted in cloud infrastructure. See MongoDB's privacy policy for details.
  • Authentication tokens: Stored locally in your browser. Not transmitted to any third party.

All data is transmitted and stored using industry-standard encryption (TLS/HTTPS in transit, encryption at rest where supported by infrastructure providers).

6. Data Sharing and Third-Party Services

We do not sell, rent, or trade your personal information. We share data only with the following service providers, solely for the purpose of operating the App:

  • OpenRouter (AI/OCR processing): Receipt images are sent for text extraction. OpenRouter acts as a data processor. Images are processed in real time and are not retained by OpenRouter beyond the API request, per their data processing terms.
  • Cloudflare (image storage and delivery): Receipt images are stored on Cloudflare R2.
  • MongoDB Atlas (database): Account information and receipt data are stored on MongoDB Atlas.
  • Google (authentication): If you use Google Sign-In, Google processes your authentication. We receive only your name, email, and an identity token.
  • Google Sheets & Drive API (optional export): If you enable the Google Sheets integration, we use the Google Sheets API to write your receipt data to a spreadsheet you designate, and the Google Drive API to list spreadsheets created by this app. All API calls are made server-side using your encrypted OAuth token. We do not share your Google data with any other third party. We do not use your Google data for advertising, market research, or to train AI/ML models.
  • Resend (email delivery): When you register via email, one-time verification codes are sent via Resend. Resend processes your email address solely for code delivery.

We may disclose your information if required by law, court order, or governmental authority, or if necessary to protect the rights, property, or safety of us, our users, or the public.

7. Data Retention

  • Account data (email, name, preferences): Retained while your account is active. Permanently removed upon account deletion.
  • Receipt images: Retained while your account is active. Permanently deleted from cloud storage upon account deletion or individual receipt deletion.
  • Receipt data (extracted and manual): Retained while your account is active. Permanently deleted from the database upon account deletion or individual receipt deletion.
  • Server logs: Retained for up to 90 days, then automatically purged.
  • Browser data (JWT token): Stored in your browser until you log out, clear browser data, or the token expires (7 days).
  • Google OAuth tokens: Your encrypted refresh token is retained while your Google Sheets integration is active. It is permanently deleted when you revoke Google access from the Settings screen, disconnect your spreadsheet, or delete your account. You may also revoke access at any time from your Google Account permissions page.
  • Verification codes: Automatically expire and are deleted upon account deletion.

8. Account Deletion and Data Removal

You can delete your account at any time from the Settings screen within the App. Upon account deletion:

  • Your personal information (name, email, authentication identifiers) is permanently removed from your account record.
  • A one-way cryptographic hash of your email address is retained solely to verify prior account ownership if needed.
  • All your receipt images are permanently deleted from cloud storage.
  • All your receipt data is permanently deleted from our database.
  • Verification codes associated with your email are deleted.
  • Your Google OAuth refresh token (if any) is permanently deleted and Google access is revoked.

If you wish to delete specific data without deleting your entire account, you may delete individual receipts from the App, which permanently removes both the image and associated data.

You may also request data deletion by contacting us at privacy@superpositionlabs.com. We will process deletion requests within 30 days.

9. Your Rights

Under Canadian Privacy Law (PIPEDA and BC PIPA)

Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA), you have the right to:

  • Access: Request a copy of the personal information we hold about you.
  • Correction: Request correction of inaccurate or incomplete personal information.
  • Withdrawal of consent: Withdraw your consent to our collection, use, or disclosure of your personal information at any time.
  • Deletion: Request deletion of your personal information.
  • Complaint: File a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or the Office of the Information and Privacy Commissioner for British Columbia (www.oipc.bc.ca).

Under the EU General Data Protection Regulation (GDPR)

If you are located in the European Economic Area (EEA), you additionally have the right to:

  • Data portability: Receive your personal data in a structured, commonly used, machine-readable format (e.g., CSV export).
  • Restriction of processing: Request that we restrict processing of your personal data under certain circumstances.
  • Objection: Object to processing of your personal data based on legitimate interests.
  • Erasure ("right to be forgotten"): Request erasure of your personal data.

Under the California Consumer Privacy Act (CCPA)

If you are a California resident, you have the right to:

  • Know what personal information is collected, used, and shared.
  • Delete personal information held by us.
  • Non-discrimination for exercising your privacy rights.

We do not sell personal information. We do not use or share personal information for cross-context behavioral advertising.

To exercise any of these rights, contact us at privacy@superpositionlabs.com. We will respond within 30 days (or sooner if required by applicable law). We may verify your identity before processing your request.

10. Children's Privacy

The App is not directed at children under 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information promptly.

11. Security

We implement reasonable technical and organizational measures to protect your data:

  • All communications use HTTPS/TLS encryption.
  • Authentication uses JSON Web Tokens with expiry.
  • The App does not store or transmit passwords – authentication uses OAuth (Google) or one-time email codes.
  • Access to production infrastructure is restricted to authorized personnel.

No method of electronic transmission or storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

12. International Data Transfers

Our service providers may process data in jurisdictions outside Canada, including the United States and other countries. Where personal data is transferred internationally, we ensure that appropriate safeguards are in place, including contractual data processing agreements with our service providers.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the App (e.g., requiring re-acceptance). The "Last updated" date at the top indicates the most recent revision. Continued use of the App after changes constitutes acceptance of the revised policy.

14. Contact

If you have questions about this Privacy Policy, your data, or wish to exercise your privacy rights, contact us at:

privacy@superpositionlabs.com

Superposition Labs Inc.
1600 – 925 West Georgia Street
Vancouver BC V6C 3L2
Canada