Privacy policy (draft)

Effective [EFFECTIVE DATE]

Egg Money is made by [COMPANY]. This policy covers the Egg Money app and the website at geteggmoney.com.

The short version

The app reads photos of your grocery receipts and shows what store brands saved you.
To read a photo we send it to Anthropic, the company that makes the AI model Claude. The app asks for your agreement first.
We keep your email address, your ZIP code, your receipts and what was read from them.
Drafting note: Only if the founders confirm: We do not sell your personal information. We show no ads. We do not track you across other apps or websites.
The app does not connect to your bank, and it does not hold, move or invest money.
You can delete a receipt, or your whole account, at any time. Deleting your account removes your account, your receipts and your photos.

What we collect

When you create an account

Your email address. Each time you sign in, we send a six-digit code to it. There is no password. While the test is by invitation, we send a code only to an address we have invited or that already has an account. Once an address has an account, it is sent codes until the account is deleted, even if we remove its invitation.
Your ZIP code. It decides which store's prices your purchases are compared with, and it is recorded with each receipt it was used for. You can change it once every 90 days.

When you scan a receipt

The photos you take or choose, up to four for each receipt.
What is read from them: the store and its location, the date and time, the items as printed, their prices and quantities, and the totals.
Any corrections you make to what was read, and your answer when the app asks whether two receipts are the same one.

Drafting note: Only once checked on Android as well as iPhone: Before a photo is uploaded, the app saves it again as a new image. That removes the location, camera details and date that a phone attaches to a photo.

A receipt can also show things we do not need, such as the last digits of a payment card or a loyalty number. We instruct the reader not to record these, and we do not use them. They are still visible in the photo itself, which is stored and is sent for reading.

Drafting note: Only if a tester's copy of the app reads receipt text on the phone: The app also reads the text of each photo on your phone and sends that reading with the photos, and we keep it with the receipt. It holds whatever the receipt prints, a card or loyalty number included. It is not sent to Anthropic. It is deleted with the receipt, with your account, and with the photos of a receipt that did not count.

Records the service keeps about your account

An account number that the service gives your account.
When you agreed to have receipts read by AI, which wording you agreed to, and when you withdrew that agreement, if you did. Each receipt also records which wording was in force when its photos were sent.
A record of each sign-in code we send you, with your email address. A code works for 10 minutes; its record is kept for 48 hours.
Each failed attempt to sign in, kept as a scrambled code made from your email address, for 48 hours.
Your signed-in sessions. A session lasts 90 days, and its record is kept for 30 days after it ends or you sign out.
When you started each receipt and each upload of photos, kept for 48 hours to apply the daily limit on receipts.

If someone asks for a code for an address we have not invited, we send nothing. The service keeps that address, with a code nobody can use, for an hour or two, so that it answers every address in the same way.

Drafting note: Only if notifications are built: If you allow notifications, we keep the token that lets us send them to your phone.

Drafting note: Only if usage analytics are built: We record how the app is used, such as which screens are opened, to find problems and improve it.

If you apply to be a tester on our website

We collect what you enter in the form:

your first name, your email address, and a mobile number if you give one;
your ZIP code;
which phone you use, and your Google Account email if you use Android;
where and how often you shop, whether you take a paper receipt, and whether you buy mostly store brands or name brands;
who you shop for, and your age range;
whether you have an investment or retirement account, if you choose to say;
whether you know either of us;
whether you would do the closer test;
your confirmation that you are 18 or older and have read this policy, and which version of the policy it was.

We also record when you applied, and whether the test is a fit for you. We use all of this to choose testers and to contact you about the test.

We keep an application for [180] days and then delete it automatically. You can ask us to delete it sooner. If you later make an account in the app with the same email address, deleting that account deletes the application too.

We also note which of our links brought you to the form, from a short code in the link. We do not record the page you came from, or anything else about how you arrived.

If the test is not a fit for you, for example because you live outside the area, we keep only your first name, email address and ZIP code, the reason, the link code if your link had one, which version of this policy you saw, and when you applied, so that we can write to you if the test widens. We do not keep your other answers.

If two applications arrive for the same email address, the first one stands and its answers are not changed. A later, different one is only flagged for us to look at.

For each application the server also makes two scrambled codes: one from the internet address it came from, and one from that address and the email address together. We use them only to limit how often one source can apply, and delete them after 48 hours. We keep the codes, not the internet address itself.

The website sets no cookies and loads nothing from other companies. For the visit only, your browser holds the link code, and, once your application has gone through, your first name, so that the next page can greet you. That page clears both, and they are gone when you close the tab.

The form sends nothing to the email address entered. Any message after that is one we write ourselves: an invitation to the test, or a note that it is not for you yet. If you get one and did not apply, tell us at [email protected] and we will delete the application.

If we invite you to the test

We add your email address to the list of addresses the service will send a sign-in code to. The list holds a scrambled code made from each address, not the address itself. Your invitation is removed when you delete your account, or when we remove it.

Your internet address

When you ask for a sign-in code, enter one, or send an application on our website, our service reads the internet address the request comes from, to limit how often one address can try. It writes down only a scrambled code made from the address, never the address itself, and deletes that code after 24 hours for sign-in and 48 hours for an application. Its logs can show the first few characters of such a code. The address itself is held only in the running service's memory: at least ten minutes, until the next request to sign in or apply after that, or until the service restarts. For everything else the app does, our service does not read your internet address, and we never use one to work out where you are. The companies that host our service and our website may log it, as hosting companies do.

What stays on your phone

A key that keeps you signed in, held in your phone's secure storage. On an iPhone it can stay there after the app is deleted; a new copy of the app removes it before it is used.
Copies of photos the app prepared for upload. They sit in the app's temporary storage until your phone clears it.

What we do not collect

Bank account or payment card details.
Your phone's location. The app does not ask for it, and we never use an internet address to work out where you are. The only location information we hold is the ZIP code you type and the store named on each receipt.
Your contacts, or any photo other than the receipt photos you choose.

How your receipts are read

Reading a receipt photo is done by Claude, an AI model made by Anthropic, another company. Our service sends Anthropic the photos and everything printed on them, and Anthropic sends back a list of what it read. Nothing else about you is sent: not your email address, your ZIP code or your account number.

Before your first receipt, the app asks whether you agree to this. If you do not agree, the app cannot read receipts.

You can withdraw your agreement at any time: in Settings, under "Receipt reading by AI", choose "Withdraw agreement". After that, no new photo is sent. A read already under way cannot be recalled, because the photo has already been sent, but its result is thrown away.

For reading, photos are sent to Anthropic and to nobody else.

Drafting note: Lawyer, after confirming Anthropic's terms: Anthropic says it deletes what it receives this way within 30 days, apart from limited exceptions it describes, and that it does not use it to train its models.

What we use it for

To show you what you saved, item by item and over time.
To keep our price list current. The prices on your receipts, together with other people's, tell us what products cost.
To learn what the short item names printed on receipts mean. A person at [COMPANY] approves these from a list of printed names. The list shows how many receipts and people showed each name, not who they are, and not your photos.
To send your sign-in code.
To prevent abuse, for example by limiting sign-in attempts, how often one internet address can ask for codes or apply, and the number of receipts an account can scan in a day.
To find out why a receipt was read wrongly, when you ask us for help with it or when receipts are being read wrongly. One of us may look at its photos, and may have them read again by Anthropic's Claude, to compare its reading with the receipt and test how well receipts are read (see "How we protect it").
To measure whether the app is useful. We count things such as how many people scan a second receipt, worked out from the receipts in each account.

We do not use your information for advertising.

Who else handles it

Drafting note: Only if the founders confirm: We do not sell your personal information. We do not share it with advertisers, brands or stores.

These companies handle it for us, on our instructions:

Anthropic, which reads receipt photos.
Render, which runs our service and its database, in Ohio, in the United States.
Amazon Web Services, which stores the photos (Amazon S3) and delivers sign-in codes (Amazon SES), from its US East (Ohio) region.
Cloudflare, which serves this website.

Apple and Google deliver the test app, under their own privacy terms:

On an iPhone the test app comes through Apple's TestFlight. If you send feedback from TestFlight, Apple passes us your comments, any screenshots, and details of your phone, such as its model and system version, with your email address if we invited you by email or you enter it. If the app crashes, Apple can pass us a report of the crash.
On Android the test app will come through Google Play's closed testing. We give Google the Google Account email you entered on our form, only to add it to the list of people allowed to install the test app. Google Play can pass us reports of crashes, and feedback you send through it.

We use what Apple and Google pass us to find and fix problems in the app.

Drafting note: Lawyer: disclosure when the law requires it.

Drafting note: Lawyer: what happens to this information if the company is sold or merged.

How long we keep it

What	How long
Your account, and your record of agreement to AI reading	Until you delete your account
Receipts, what was read from them, and their photos	Until you delete the receipt or your account
Photos of receipts that were rejected, were duplicates, or could not be read	30 days after the receipt was last read. The rest of such a receipt stays until you delete it or your account
Photos uploaded but never submitted	About a day
A sign-in code	It works for 10 minutes. Its record is kept 48 hours, or an hour or two if it was never sent
A failed sign-in attempt	48 hours
A signed-in session	It lasts 90 days. Its record is kept 30 days after it ends
When you started receipts and uploads	48 hours
The scrambled codes made from an internet address	24 hours for sign-in, 48 hours for an application
An invitation to the test	Until you delete your account, or we remove it
An application to be a tester	[180] days, then deleted automatically. Sooner if you ask, or if you delete an account made with the same email address
Our service's logs	[7] days
Backups of our database	[3] days

Your choices

See it. Every receipt you have scanned, and what was read from it, is in the app.
Correct it. You can correct any line the reader got wrong.
Delete a receipt. This removes the receipt, its photos, what was read from them, and the prices it added to our price list.
Withdraw your agreement to AI reading. The app stops reading receipts until you agree again.
Delete your account, in the app (Settings, then "Delete account") or at https://geteggmoney.com/delete-account/.

Deleting your account removes, from our database and our photo storage, your account record and email address, your sessions and sign-in records, your invitation to the test, your tester application if you made it with the same email address, your receipts and everything read from them, your photos, your record of agreement, and the prices your receipts added to our price list. Nothing about you or your purchases is kept there. The same email address can be used again, and starts empty; while the test is by invitation, it needs a new invitation first.

What remains after deletion:

Printed item names, such as which product a store's abbreviation stands for, once a person has approved or turned one down, or while it is on someone else's receipt too. They are facts about products and name nobody.
A copy of a receipt's photos and what was read from them, that one of us took to look into a misread (see "How we protect it"), until we delete it: at the latest 30 days after we took it.
A note of each receipt reading the whole service made, with its time and nothing that identifies anyone, kept for 48 hours to cap how many receipts the service reads in a day.
The scrambled codes that limit how often one internet address can sign in or apply, which name no account: 24 hours for sign-in, and 48 hours for an application, where one of its two codes is made from your email address together with the internet address.
Our service's logs. They never hold your email address. They can hold the internal number of your account, for [7] days.
Our email provider's own records: of the sign-in emails it delivered to your address, and, if a message to your address bounced or was reported as spam, your address on its list of addresses not to send to. They are kept for as long as that provider keeps them.
Backups of our database, for [3] days.

Deleting your account removes what our service holds. It does not remove anything kept on your own phone.

Drafting note: Lawyer: whether any state privacy law gives further rights, and how to describe them.

How we protect it

Connections between the app and our service are encrypted, and so is our service's connection to its database.
Photos are stored encrypted, in storage that is closed to the public.
In the app, a photo is shown only to the signed-in account that uploaded it. There is no web link to a photo.
People at [COMPANY] can see a receipt's photos when you ask us for help with that receipt, or to find out why receipts were read wrongly. A copy we take for that, of the photos and what was read from them, is kept on our own computers, shared with nobody except Anthropic for reading it again, and deleted when we are done: at the latest 30 days after we took it.

Drafting note: Lawyer: a general statement on security and its limits.

Egg Money Privacy Policy