Receipt Audit

Privacy policy

Last updated 2026-10-12. This policy covers https://receiptaudit.com and its API, operated by Godard Builds.

Receipts you check

The file is read once to extract its fields and look for signs of editing, then discarded. To do that it is sent to an AI model provider (Google or Anthropic, through Vercel AI Gateway) that processes it for us and does not keep it for training. We don't store the image, the text or the extracted fields.

Fingerprints for duplicate detection

We keep two one-way fingerprints per receipt: a perceptual hash of the image (64 bits) and a SHA-256 hash of the merchant, date, total, currency and receipt number. They let us recognise the same receipt when it comes back, and can't be turned back into the receipt. With each fingerprint we keep when it was first and last seen, how many times, and by how many accounts.

Accounts and keys

For API accounts we keep a hash of each key (never the key), the credit balance and its history, the number of checks, and which agent created the account (from its User-Agent). When you buy credits we keep your email and Stripe customer id. For the free web checker we count checks per day against a hash of your IP address.

Analytics

We use PostHog to count visits, checks and purchases, with cookieless defaults for anonymous visitors. We never send receipt contents to analytics.

Processors

Your choices

Email hello@godard.me to delete your account data. Fingerprints aren't linked to a person, so they can't be looked up by name; we delete those tied to your account on request.