What happens to your receipt after you scan it

Every receipt app asks you to hand over something weirdly personal: where you shop, what you buy, what you paid, and — depending on the week — how the diet is going. Most apps bury what happens next somewhere around page 14 of a legal doc that nobody has ever read voluntarily. We figured we'd just… tell you?

What happens when you snap a receipt

Your photo goes up to our cloud storage — a private bucket, encrypted in transit and at rest, the works — and gets sent to an AI model that reads it and sends back the useful stuff: store, date, line items, taxes, total. Anything the model wasn't sure about comes back flagged, and the app asks you to double-check it instead of quietly guessing. Confident-sounding nonsense is very much not the vibe we're going for.

Who actually sees it

Parsing is done almost entirely by Google's Gemini models, through the paid commercial API — not the free tier. That word "paid" is doing a lot of work: under the paid tier's data-governance terms, Google is contractually not allowed to use your receipts to train its models, and doesn't keep them beyond processing. Not a pinky promise — a contract. For a few smaller tasks we sometimes use other commercial AI APIs, all on equivalent paid terms. Every provider is named in our privacy policy, no scavenger hunt required.

We never attach your Cirola account details — email, name, user ID — to what we send. But here's the honest part most apps conveniently skip: the receipt itself can contain personal info. A printed loyalty-card number, a shipping address in an order email, the last digits of a card. We don't strip or redact receipt content before parsing — the AI sees whatever the retailer printed. If a particular receipt feels too personal, just don't scan it. The app won't be offended, promise.

What we keep — and what we delete

Your data lives in Canada, with backups in the US. On the free tier, cloud images get deleted 30 days after upload; on Pro they stick around until you delete them. Delete your account and your profile, entries, lists, and images all go with it. The one thing that stays behind is anonymized item-price history — product, store, price, date, with the link to you removed — because other people's price comparisons depend on it. That's the trade, and it can't be traced back to you.

Why the free tier shows an ad

One small, boring, non-personalized banner. We don't ask for tracking permission and we don't share advertising identifiers — it exists purely to keep the free tier's lights on. Pro is ad-free, and honestly the banner won't exactly be missed.

The test we hold ourselves to

If a data practice would make us squirm while explaining it in a blog post like this one, we shouldn't be doing it. That's genuinely the whole policy — the long version just adds lawyers' punctuation. Something we didn't answer? Ask us — we read everything.