Privacy Policy

This Privacy Policy explains how George Abdelnour ("we", "us", "our") collects, uses, stores, and protects information when you use the Receipt Flow mobile application (the "App") and any related services (together, the "Service").

By using Receipt Flow you agree to the practices described below. If you do not agree, please do not use the App.

1. Information We Collect

1.1 Account information

When you create an account we collect:

• Your name and email address, via Firebase Authentication.

1.2 Receipt and expense data (entered by you)

• Company names and any company-level settings you configure (expense categories, GL numbers, reference accounts).
• Per-receipt fields you create or edit: beneficiary, amount, currency, date, expense type, description, GL code, reference account.
• The receipt images themselves.

1.3 Information collected automatically

We do not collect device identifiers for advertising, do not use third-party trackers, and do not show ads. Standard server logs (IP address, timestamp, request path) may be retained briefly for security and abuse prevention.

2. How We Use Your Information

• To authenticate you and provide the core features of the App.
• To process receipt images and extract the company, date, and total so the form is pre-filled for you.
• To save receipt images into your own Google Drive folders.
• To generate the expense reports, charts, and exports you request.
• To respond to support requests and protect the Service from abuse.

3. Where Your Data Is Stored

3.1 Receipt images — your Google Drive

Every receipt image you save is uploaded directly into your own Google Drive, under a folder named after the company, organised as Company / YYYY-MM /. We do not keep our own copy of your receipt images.

3.2 Account and expense metadata — Firebase

Your account profile (name, email) and the structured expense data you enter (amounts, dates, categories, GL numbers, reference accounts, etc.) are stored in Google Firebase (Authentication and Firestore). Firestore security rules ensure each user can only read and write their own data.

4. Third-Party Services and Data Sharing

We share data with the following providers only as needed to deliver the App. We do not sell your data.

4.1 Google Firebase (Authentication, Firestore)

Used to authenticate you and to store your account and expense metadata. Subject to the Firebase Privacy and Security terms.

4.2 Google Drive (your account)

Receipt image files are uploaded to your own Google Drive using the Google Drive API. You connect your Google account from within the App, and we only request the scopes required to create and manage Receipt Flow's own folders and files. You can disconnect Google Drive at any time from the App's Settings.

4.3 Receipt OCR backend and Google Gemini

When you scan a receipt, the image is sent over an encrypted HTTPS connection to our receipt-reading backend. Our backend forwards the image to Google Gemini (model gemini-2.5-flash) to extract the company name, date, and total. The extracted fields are returned to the App so it can pre-fill the form.

Receipt images sent to our backend are processed in memory only and are not persisted on our servers. Use of Google Gemini is subject to the Gemini API Additional Terms of Service.

5. Data Retention

• Account profile and expense metadata are retained for as long as your account is active.
• Receipt images remain in your own Google Drive and are governed by your Drive account; deleting them in the App also deletes them from Drive (or you can remove them directly).
• Receipt images sent to our OCR backend are not stored after the request completes.
• When you delete your account, we delete your account profile and expense metadata. See section 7.

6. Your Rights

Depending on where you live, you may have the right to access, correct, export, or delete the personal information we hold about you, and to object to or restrict certain processing (GDPR, UK GDPR, CCPA, and similar laws). To exercise any of these rights, contact us at abdelnourgeorge75@gmail.com.

7. Account Deletion

You can delete your account and associated data in either of two ways:

• In the App: open Settings → Delete Account.
• By web request: visit the Account Deletion page.

Deletion removes your account profile and the expense metadata stored in our database. Receipt image files in your own Google Drive remain under your control; you can delete them directly from Drive at any time.

8. Security

We use industry-standard practices to protect your data, including encrypted transport (HTTPS/TLS), Firebase security rules that scope all reads and writes to the owning user, and least-privilege OAuth scopes for Google Drive. No system is perfectly secure, but we work to protect your information at every stage.

9. Children's Privacy

Receipt Flow is intended for adults (18+) using it for business or personal expense tracking. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal data, please contact us so we can delete it.

10. International Data Transfers

Your data may be processed in countries other than where you live, including data centres operated by Google (Firebase, Google Drive, Gemini). Where required by law, appropriate safeguards are in place.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" above and, where appropriate, notify you within the App. Continued use of the App after changes take effect constitutes acceptance of the revised policy.

12. Contact Us

Questions about this policy or your data? Email us at abdelnourgeorge75@gmail.com or use the Contact page.