The plain version, before the formal one: your receipts exist to help you understand your own shopping — nothing else.
When you upload a receipt, its text is read by an external OCR service — the step that turns the image into machine-readable text. The receipt is passed to that service as-is to be read.
Before the text goes any further, it passes through a cleanup step that looks for sensitive details and removes them. A second, AI-based step then structures and enriches what's left — turning raw lines into products, prices, dates and stores you can actually use.
The cleanup step is good, but not guaranteed to catch everything. If a receipt contains something you'd rather never leave your hands — a card number, a name, anything sensitive — we recommend removing or blacking it out before you upload. When in doubt, clean it first.
The structured result — your products, prices, dates and stores — is kept in a database, the same way your history lives in the app.
We also keep the receipt image itself. It's stored in private object storage in the European Union, on servers we control access to. The storage is not public: there is no address anyone can visit to reach your receipts, and the only way an image is served is through a link this app creates for you, for your own receipt, that stops working within minutes.
We keep it because reading a receipt is imperfect and improving. When the reading gets better, we can re-read what we already have instead of asking you to photograph it again — and because when a number looks wrong, the honest answer is to show you the paper it came from.
Photos are shrunk on your device before they're sent, and that has a side effect worth stating plainly: redrawing the picture discards what your phone attached to it, including the location it was taken and the device that took it. Where a photo is already small enough to send as it is, we cut that same information out of the file before storing it. Two exceptions we'd rather name than hide: a photo in Apple's HEIC format, and a PDF, are stored as they arrive — a HEIC can still carry the location it was taken.
That information is what makes CartEncore useful over time. It's tied to your account, visible only to you and anyone you explicitly share a household with.
You can export your information at any time, in a plain, portable format. You can delete it at any time, and deletion means it's gone. Your source data — the products, prices, dates and stores you gave us — is always yours to take.
To read and structure receipts, CartEncore relies on a small number of external processing services (for OCR and for AI structuring). They process the receipt text to do their job; they are not permitted to use your information for their own purposes. We keep this list as short as the product allows.
CartEncore is still in an early stage, and how it handles data will keep being refined as it grows. This page describes how things work today and will be updated as that changes. If something here isn't clear, or you want to ask exactly what happens to your data, get in touch — a straight answer is the whole point of this page.