Security & Privacy
Your Receipts,
and What We Do With Them
Encrypted storage, no passwords to leak, and an account delete you can press yourself.
PIPEDA · GDPR · CCPA
Receipts say where you were and what you bought, so they deserve better than a vague reassurance. Images are encrypted at rest in Cloudflare R2 and reachable only through time-limited signed links. There is no password on your account to be stolen. You can delete everything yourself, from Settings, without asking us.
Storage
Where the data lives
Receipt images are stored in Cloudflare R2 object storage, encrypted at rest. The application never hands out a permanent public URL for an image — every view goes through a signed link that expires, so a URL copied out of a browser tab stops working.
Extracted fields and account records live in a managed MongoDB database. Google Sheets refresh tokens, for users who connect a spreadsheet, are encrypted with a separate key before they are stored.
Access
Sign-in without a password
You sign in with Google, or with a one-time code sent to your email address. There is no password field, which means there is no password of yours for us to store, hash, or lose in a breach — and nothing for you to reuse from another site.
Sessions are JWTs that expire after seven days. Every API route other than sign-in and the health check requires a valid one.
Processing
What happens to a receipt image
To extract the fields, the receipt image is sent to a third-party AI vision model. That is the one moment your receipt leaves our infrastructure, and it is worth being plain about rather than burying: extraction is not done on-device.
Your receipts are not sold, and they are not used to train models. The full detail of what is collected, why, and how long it is kept is in the privacy policy.
Control
Deleting it is your decision
Delete individual receipts
Removes the record and the stored image, not just the row.
Delete the whole account
One action in Settings removes your account and everything attached to it. No support ticket, no waiting period.
Revoke Google Sheets access
Disconnect or fully revoke the Sheets authorization from Settings whenever you want.
Export before you go
Take your data with you in CSV, XLSX, or PDF first — it's yours, and leaving shouldn't cost you the record.
Compliance
Jurisdictions and legal basis
Awesome Receipts is operated by Superposition Labs Inc., a company registered in Vancouver, British Columbia, Canada. It complies with PIPEDA and BC PIPA in Canada, GDPR in the European Union, and CCPA in California.
The terms of service are governed by the laws of British Columbia. The privacy policy covers data subject rights, retention, and how to contact us about either.
Security FAQ
Where are my receipt images stored?
In Cloudflare R2 object storage, encrypted at rest. The app never exposes a permanent public URL for an image; access goes through time-limited signed links.
Can I delete my data?
Yes, entirely and yourself. Settings has an account deletion that removes your account along with every receipt and image attached to it. You don't have to email anyone to ask.
Do you have access to my receipts?
Receipt images are sent to a third-party AI vision model for extraction, and stored in our object storage. They are not sold, and they are not used to train models.
Which privacy regulations do you comply with?
PIPEDA and BC PIPA in Canada, GDPR in the EU, and CCPA in California. Awesome Receipts is operated by Superposition Labs Inc., a company registered in Vancouver, British Columbia.
How do I sign in? Is there a password to leak?
There's no password. Sign-in is either Google OAuth or a one-time code sent to your email address, so there is no password of yours for us to store or lose.
Related: Privacy policy · Terms of service
Last updated 2026-07-27.
Try it, and delete it if you don't like it.
50 receipts free, and the delete button is right there in Settings.