Privacy

The short version

• Your receipts and purchase history are visible only to you.
• They are never sold, never shared with advertisers, and never used to target advertising at you.
• One third party sees a receipt: the service that reads it. Nobody else does.
• You can export everything, and you can have it all deleted.

What is stored

Your account. A username, a display name, a password stored only as a hash that cannot be reversed, and your settings. If you use Google to sign in, the Google address and account identifier that are permitted to do so.

Your receipts. The image or PDF you uploaded, and the lines extracted from it: store, date, products, quantities, prices and discounts. Files are stored on the same server as the application and are served only to you, with headers that prevent them being embedded or executed anywhere.

What is derived from them. Products, price histories, shopping lists and the statistics on your dashboard. All of it is computed from your own receipts and belongs to your account alone.

Sessions. When you sign in, a random token is created. The server stores only a hash of it, so a copy of the database does not yield a working session. Rows are kept while the session is valid and removed when it expires or you sign out.

Sign-in attempts. Recorded to limit brute-force guessing. Passwords are never written to a log, in any form, at any time.

Who else processes it

OpenAI. Reading a receipt is done by a vision model run by OpenAI, which means the receipt image is sent to them for processing. This is the one place your receipt leaves this server, and it happens only for receipts you upload, only at the moment you upload them. Nothing else about your account, and no part of your purchase history, is sent with it.

If that is not acceptable to you, receipts can be entered by hand instead, and nothing leaves the server at all.

Google. If you choose to sign in with Google, Google confirms your identity to us. We receive your address and an account identifier. We do not receive, and never ask for, access to your mail, contacts or anything else.

No analytics. There is no tracking script, no analytics service and no third-party pixel anywhere in the application.

Advertising

Some accounts are shown advertising. It is off unless it has been switched on for an account, and when it is off no advertising code is loaded at all: no script is fetched, no frame is created, and no request reaches an ad network. It is not hidden with styling, it is absent.

Where advertising is shown, two rules hold without exception.

• Your grocery data is never sent to an advertiser. Not your receipts, not your products, not your history, not a summary or a segment derived from them.
• Advertisers receive counts, not people. An advertiser running a campaign here sees how many times it was shown and how many times it was clicked. There is no record anywhere of which account saw or clicked an advertisement.

Where a campaign is aimed at a grocery category, the matching happens inside Basket and the advertiser learns nothing about who matched.

Advertising served by Google is subject to Google’s own handling of the request, which is why a consent dialog appears where the law requires one. Until you have answered it, advertising is served non-personalised.

What we do not do

• We do not sell data. There is no arrangement under which we could.
• We do not share your purchase history with anyone, for any purpose.
• We do not use your grocery data to target advertising, here or anywhere else.
• Administrators cannot read your receipts. Account administration and data access are separate things, and every query for user-owned data is restricted to its owner with no exception for administrators.

Cookies

One cookie, holding the session token, set when you sign in and needed for the application to work at all. It is not readable by scripts, is restricted to this site, and is sent over HTTPS. There are no advertising or analytics cookies set by Basket. Where Google advertising is shown, Google may set its own, which is what the consent dialog is about.

Your data, and getting rid of it

Settings contains an export that gives you everything Basket holds for your account as a plain file you can read.

You can ask for your account and everything in it to be deleted. That means the receipts, the files, the history and the account itself, not an archived copy.

Where it runs

On a single server in Germany, operated privately rather than on a platform. Backups are kept on the same server. Traffic is encrypted in transit.

Changes

If what happens to your data changes, this page changes with it. It describes current behaviour and is updated as part of the change rather than afterwards.

Asking about any of this

Write to naghmeh.ghorashi@gmail.com. Questions about what is stored, requests for a copy and requests for deletion all go to the same place.

Terms of use