What a receipt app can see

A receipt records where you were, at what time, what you bought and how you paid — and a few years of receipts is a detailed picture of your movements, habits, health, and who you spend time with. Any tool that processes them holds that picture. Worth deciding consciously who does.

This isn’t an argument against scanning receipts. It’s an argument for knowing what the data is, because most people think of receipts as boring and they’re among the more revealing records they own.

What’s actually in a receipt

More than the amount:

Location and time. A store address and a timestamp, which is a location trace. Enough receipts and you have a movement history.

What you bought. Line items are a direct record of consumption — including pharmacy purchases, which are health information, and anything else you’d consider nobody’s business.

Payment method. Card type and last four digits, which links receipts to a specific card and to each other.

Who you were with. Restaurant receipts show covers. A table for four at a particular time and place, with a note about the meeting, is a social record.

Loyalty identifiers. Often printed, and they link your receipts to whatever profile the retailer holds.

Individually mundane. In aggregate, one of the more detailed personal datasets most people generate.

The questions worth asking of a tool

Where does processing happen? On the device, or on a server? Server-side processing means the image leaves your control, which is normal and worth knowing. On-device processing is less common and keeps the image local.

Is the data used for anything besides serving you? Specifically: is it used to train models, is it aggregated and sold as market research, is it shared with partners? Aggregated purchase data has real commercial value, and a free tool is being paid somehow.

How long is it kept, and what happens when you delete? Deletion from your view is not the same as deletion from their systems, and backups have their own retention.

Who inside the company can see it? Support access is usually necessary and should be limited and logged.

Where is it stored, jurisdictionally? Relevant if you’re subject to particular data protection rules, or if you’d rather your records weren’t in a specific country.

What happens if the company is acquired or shuts down? Your data is an asset in both cases.

The answers should be findable. If a privacy policy is vague on training and sharing specifically, treat the vagueness as the answer.

Business receipts have a second dimension

If you’re scanning for a business, the receipts aren’t only about you.

Client meetings reveal relationships. Supplier receipts reveal what you pay and to whom, which is commercially sensitive. Travel patterns reveal what you’re working on. Team expense data is personal data about the people who submitted it, and you may have obligations toward them regardless of what your tool’s policy says.

Which means the choice of tool is a business decision about where commercially sensitive information lives, not just a convenience question.

Practical positions

Reasonable options, in rough order of caution:

On-device processing. Images never leave the phone or computer. Strongest privacy position; fewer tools offer it, and the trade-off is usually accuracy and convenience.

A paid tool with a clear policy. Paying removes the incentive to monetise the data, and a specific policy that rules out training and sharing is meaningful. This is the sensible default for most people.

Self-hosted. Full control, real maintenance burden. Worth it if the data is unusually sensitive.

A free tool with a vague policy. The one to avoid. Not because free tools are malicious, but because the economics have to work somehow and vagueness about data use is not an accident.

Reduce what you hand over

Independent of tool choice:

Don’t capture what you don’t need. If a receipt supports nothing — no tax position, no warranty, no dispute — you don’t need a copy of it. Personal purchases don’t belong in a business expense system.

Separate business and personal. Different systems, or at minimum different accounts. Mixing them means your business tooling holds your personal purchase history.

Skip line items where you don’t need them. Totals are far less revealing than itemised purchases, and most expenses only need the total anyway. This is a privacy argument that happens to align with the data quality one.

Delete when retention ends. Records kept past any obligation are pure liability — no longer useful, still sensitive. Retention has an end date; use it.

The point

Receipt scanning is a straightforwardly good trade for most people: real time saved, real records improved. The data involved is more sensitive than it feels, and the cost of taking that seriously is one afternoon of reading a privacy policy and one decision about which system holds what.

Worth doing once, at the start, rather than discovering the answers later.