The plain version, before the formal one: your receipts exist to help you understand your own shopping — nothing else.
When you upload a receipt, its text is read by an external OCR service — the step that turns the image into machine-readable text. The receipt is passed to that service as-is to be read.
The text that service produces is then passed to a second, AI-based step that structures and enriches it — turning raw lines into products, prices, dates and stores you can actually use. Nothing is taken out in between: what is printed on the receipt is what both steps receive.
We do not remove anything for you. There is no automatic step that finds sensitive details and strips them out before a receipt is read. So if a receipt carries something you'd rather never leave your hands — a card number, a name, anything sensitive — remove it or black it out before you upload. When in doubt, clean it first.
The structured result — your products, prices, dates and stores — is kept in a database, the same way your history lives in the app.
We also keep the receipt image itself. It's stored in private object storage in the European Union, on servers we control access to. The storage is not public: there is no address anyone can visit to reach your receipts, and the only way an image is served is through a link this app creates for you, for your own receipt, that stops working within minutes.
We keep it because reading a receipt is imperfect and improving. When the reading gets better, we can re-read what we already have instead of asking you to photograph it again — and because when a number looks wrong, the honest answer is to show you the paper it came from.
Photos are shrunk on your device before they're sent, and that has a side effect worth stating plainly: redrawing the picture discards what your phone attached to it, including the location it was taken and the device that took it. Where a photo is already small enough to send as it is, we cut that same information out of the file before storing it. Two exceptions we'd rather name than hide: a photo in Apple's HEIC format, and a PDF, are stored as they arrive — a HEIC can still carry the location it was taken.
That information is what makes CartEncore useful over time. It's tied to your account, visible only to you and anyone you explicitly share a household with.
You can delete any receipt at any time, and that removes its lines, its prices and its stored photo. Two things are not built yet: exporting your whole history in a plain, portable format, and deleting all of your household's data when you close your account. Closing an account today removes your login, not the receipts. Until both exist, this page says so rather than promising them.
If you give us your email on the waitlist, we keep that address — and only that address, together with the page you came from and the date — in our own database. It is not sent to a mailing-list company, it is not shared with anyone, and it is not joined to anything else about you. We hold it for one purpose: to write to you once, when there is something to say. Ask us to remove it and it's gone.
To read and structure receipts, CartEncore relies on a small number of external processing services (for OCR and for AI structuring). They process the receipt text to do their job; they are not permitted to use your information for their own purposes. We keep this list as short as the product allows.
CartEncore is still in an early stage, and how it handles data will keep being refined as it grows. This page describes how things work today and will be updated as that changes. If something here isn't clear, or you want to ask exactly what happens to your data, get in touch — a straight answer is the whole point of this page.