Version draft-1 · Draft — not yet in effect
Receipt to Pantry is operated by the operator of this deployment ("we", "us", "our").
Receipt to Pantry turns grocery receipts into a household inventory: you upload a receipt, review what was extracted, and track what is in your fridge, freezer and pantry. This policy describes what information the service handles, where it goes, and the choices you have.
Account information: your email address, household name and time zone, provided when you create an account.
Receipts you upload: photos and PDF files of receipts, the text extracted from them, and the purchase records you review and confirm (store, date, items, quantities and prices).
Household data you create: inventory, recipes, shopping lists, price history derived from your own receipts, and monthly usage counters (receipt pages and AI requests).
We do not ask for or store payment card numbers. Payments are handled by Stripe (see "Processors we use").
Your account data, receipt files and confirmed records are stored with Amazon Web Services in the Canada (Central) region, ca-central-1, in database and file storage operated for this service. Confirmed purchase records remain stored there until you delete them or delete your account.
Amazon Web Services (hosting, database, file storage, email delivery): stores and processes your data as described in this policy.
Amazon Textract (optical character recognition): receipt images are sent to Textract to extract the printed text and line items. Uploads are scanned for malware before OCR runs.
DeepSeek (artificial intelligence): when AI features run, French receipt text and recipe prompts are sent to the DeepSeek API for structured extraction and recipe suggestions. This processing happens outside Canada — see "Processing outside Canada".
Brave Search (product lookup): product descriptions are sent as search queries to identify package sizes and product metadata. See "Product lookups and search".
Open Food Facts (product catalog): when a receipt line carries a barcode, the barcode is sent directly to Open Food Facts to identify the product and its package size. Barcodes are public product identifiers, not personal information.
Stripe (payments): if you subscribe, Stripe processes your payment and manages the subscription. We store your Stripe customer and subscription identifiers and their status, never your card details.
AI extraction for French receipts and AI recipe features use DeepSeek, an AI provider outside Canada: the French receipt text and recipe prompts our backend sends are processed on DeepSeek's systems outside Canada, even though your stored data remains in Canada, and they may be subject to the laws of the jurisdictions where that processing occurs. The upload screen discloses this before every upload. Receipts you type in manually are never sent for AI extraction, and English receipts are structured by Amazon Textract in Canada without an AI provider.
To fill in package sizes and product details, the service sends product descriptions and store identifiers as search queries to Brave Search, restricted to Canadian results, and sends barcodes directly to Open Food Facts. Returned results are limited to a fixed list of Canadian grocery retailers and Open Food Facts. Whole receipts are never sent to search providers, and lookup queries do not include your name or email address.
Receipt originals and raw OCR output: purged automatically 90 days after upload by a daily retention sweep. The confirmed purchase record built from a receipt is not part of that purge and stays until you delete it.
Unconfirmed draft uploads expire after 24 hours and their files are purged.
Exports: an export file you prepare expires 24 hours after it is created.
Structured household records (purchases, inventory, lists, recipes): kept until you delete them or delete your account. Usage counters reset every calendar month.
You can export your household data as JSON or CSV at any time from Settings, and you can delete your account from Settings without contacting us.
Deleting your account stops access immediately. Erasure of the active data runs in the background and targets completion within seven days. A hashed tombstone of the household storage prefix survives erasure so that late-arriving uploads or events for the erased account are purged instead of recreating data, and scheduled sweeps keep checking erased prefixes. Backup copies age out on their normal rotation; erased data is not restored from backups into the live service. Records that Stripe holds as payment processor are governed by Stripe's own retention and policies.
Service email is sent with Amazon SES from receipts@brainodev.com. Reminder emails are opt-in only, and every reminder carries an unsubscribe link that turns them off for your account.
Data is encrypted in transit and at rest. Access to stored data is limited to the service's own scoped AWS roles; receipt files live in private storage and are served only through the application. Sign-in sessions are held in your browser's session storage and expire with the session.
This page is versioned. When the policy changes, the new version and its effective date are published here before the change applies to your data.
Support contact options for this deployment are listed on the Support page. Export and account deletion are self-serve in Settings and never require contacting support first.
Questions about this policy? See Support.