The most private way to scan receipts
Every receipt app answers one question differently: what happens to the photo, and to the data on it? Here is the honest map, including the options that aren't apps at all — and including where our own app is not the right pick.
The spectrum, most private to least
1. Apple Notes / Files scan — private, but dumb
The scanner built into iOS keeps everything in your iCloud. Nothing leaves your control. But you get a picture, not a record: no items, no totals, no search on what you bought, no budgets. Fine for archiving a single warranty receipt; useless as a ledger.
2. Pip — private and structured
Our app, so judge accordingly. OCR runs on the iPhone; the photo never leaves your devices — the server has no endpoint that can receive an image. What is sent for AI interpretation is redacted text (card numbers, emails, phone numbers stripped on-device), processed in transit and not stored. In return you get item-level records, search, budgets, and per-date currency conversion. The trade-off vs Apple Notes: redacted text does leave the device — we name the provider and jurisdiction so you can decide, and manual entry never contacts an AI at all.
3. Smart Receipts — local-first, manual-heavy
A long-standing expense-report app where data lives on your device and exports to PDF/CSV. Privacy posture is good; the cost is effort — it is built around typing expenses and generating reports, not around reading the receipt for you or answering "what did this cost last time?"
4. Expensify and business tools — cloud by design
Receipts upload to the provider's cloud, where scanning happens. Reasonable for company expenses — the employer wants the data centralised — but as a personal ledger you are storing your purchase history on someone else's servers. Full comparison: Pip vs Expensify.
5. Rewards scanners (Receipt Hog and similar) — the data is the price
These apps pay you points for scanning receipts because the purchase data is the product — it is aggregated and sold as market research. That is a legitimate trade if you make it knowingly. Just make it knowingly: you are selling your purchase history, at roughly the price of a coffee per month.
The four questions to ask any receipt app
- Does the photo leave the device? Where, and for how long?
- Is anything stripped from the text before it is sent — and is it stripped on the device?
- Can they name every third party that touches the data, with countries?
- What does deleting your account actually delete?
An honest app answers these in a table. Ours is here; hold every competitor — including us — to the same standard.
Where Pip is behind
Keeping everything on one device is a real privacy answer and a real limitation, and a comparison that only listed the first would be cherry-picking. Pip does not sync between your devices yet — receipts live on the phone that saved them. Syncing through your own private iCloud is built and switched off, and this page will say so when it is on. Pip is iPhone only, and the free plan keeps two wallets and exports CSV.
Every app above syncs across devices as a matter of course, because their copy lives on a server. That is the trade, stated in both directions.
If you are in Malaysia
The apps a Malay-language search actually returns are a different set — ResitVault, eResit, Resitku, Receipt Scanner: Resit Cukai — and they are built around LHDN relief categories rather than around privacy. Their App Store privacy labels, read side by side and including ours, are in app simpan resit cukai di Malaysia(in Malay). One of them declares tracking across other companies' apps; one keeps your images in your own Google Drive. They are not the same trade.