What actually leaves your phone when you scan a receipt
“Scan your receipts!” says every finance app. Almost none of them finish the sentence: …to our servers, where your purchase history becomes ours to keep.
A receipt is surprisingly intimate. It says where you were, on which day, at what time, and what you bought — medicine, baby formula, a gift, a bad week’s worth of snacks. String a year of receipts together and you have a diary someone else wrote about you. So before you pick a scanning app, it is worth asking one precise question: what exactly leaves the phone?
Here is how Pip answers it. Even if you never use Pip, this is a useful checklist to hold against any scanner you’re considering.
1. The photo — never
Text recognition happens on the iPhone itself, using Apple’s Vision framework. The picture of your receipt does not need to travel anywhere to be read, so it doesn’t. Our servers have no endpoint that can receive an image — not a policy, an architecture. Photos live on your device, where we cannot see them.
If a scanner’s privacy policy says photos are uploaded “to provide the service”, that is the trade you’re making. It might be worth it to you — but it should be a decision, not a surprise.
2. The text — redacted first, then sent for interpretation
Turning raw text into structured data — this line is an item, that number is the tax — is done by an AI model, and that part does leave the phone. Two things happen first:
- Redaction, on the device. Patterns that look like card numbers, email addresses, phone numbers and labelled identity numbers are stripped out before the text is transmitted. (We’re honest about the limit: redaction works on recognisable patterns, so something unusual a merchant prints may slip through. A strong reduction, not a mathematical guarantee.)
- Nothing is kept. The text is processed in transit and the result comes back. Our server holds it only while the scan is in flight, then deletes it. It is never written to a log.
We also name the provider and the jurisdiction in our privacy policy — including that the AI provider is in China — so you can decide with the facts in front of you. And if you’d rather no receipt text leave your phone at all, manual entry is unlimited, free, and never contacts an AI.
3. The account — the boring minimum
The server knows three things: an identifier from Sign in with Apple, how many AI scans you’ve used this month, and whether you subscribe. That’s the list. Wallets, budgets, items, merchants, amounts — all of it stays in your own storage.
The test to apply to any receipt app
- Does the photo leave the device? If yes, where, and for how long?
- Is anything removed from the text before it’s sent? On the device, or after it arrives?
- Can the company name every third party that touches the data, and the countries involved?
- What does deleting your account actually delete?
Good apps answer these in a table, not a paragraph of “we value your privacy”. Ours is right here — and if something is not in that table, we don’t have it.
We have also held those questions against the alternatives, Pip included, in the most private way to scan receipts. Apple’s own scanner comes out above us on question 1 — nothing leaves at all — and we say so there rather than quietly ranking ourselves first.
If that is the trade you want, Pip is on the App Store — free, with 30 AI scans a month. Download it here.