Reece1. Controller and contact
Reece is the operator (controller) responsible for processing personal information. For privacy inquiries, please contact support@reeceapp.com.
This policy applies to the Reece mobile app, reeceapp.com, cloud functions, technical support, and related services.
2. Voluntary and required information
Providing personal information is voluntary. Reece can be used in guest mode without creating an email-based account. In guest mode, receipts, receipt files, categories, and related app settings remain on the device and are not synchronized to Cloud Firestore or Cloud Storage. Creating an account enables cloud synchronization and recovery. A receipt image is required when you ask Reece to recognize that receipt. Refusing an optional permission does not affect features that do not need it.
Reece does not require a national identity number, complete payment-card details, contacts, microphone access, or precise location for its core functionality.
3. Information we process
Email address, display name, and profile image only when the selected Apple or Google provider shares them; internal user identifier; provider identifier; sign-in status and timestamps; email-verification status; Firebase authentication tokens; and security signals. If provided, the optional business name is stored as a profile setting and included in exported reports. Reece never receives your Apple or Google password.
Receipt photographs or files, merchant, date, document number, currency, subtotal, tax, total, category, notes, corrections, and exported records.
App version, platform, language, App Check results, security/abuse signals, and hashed technical identifiers used for rate limiting. Crash diagnostics are collected only if you enable optional diagnostics in the app.
Limited feature-usage events, an app/device identifier, app and device metadata, and approximate country or region inferred by Firebase may be collected only if you enable analytics in Settings. Reece does not request precise location. Receipt contents, email addresses, amounts, and merchant names are not included in analytics events.
Email address, message content, attachments, screenshots, app version, and other information you voluntarily provide.
4. Device permissions
- Camera: used only after you choose to photograph a receipt.
- Photos or files: used only to select or save a receipt and create exports, within the permission granted by the operating system.
- Notifications: may be used only after permission for service or account-related messages.
Reece does not continuously access the camera or photo library in the background. Permissions can be changed in device settings.
5. Purposes of processing
- Create accounts, sign users in with email and password or an optional Apple or Google account, verify email addresses, and restore access.
- Upload, recognize, edit, store, and synchronize receipts.
- Provide history, categories, statistics, and exports.
- Prevent fraud, automated attacks, abuse, and unauthorized access.
- If you opt in, collect limited usage analytics and Crashlytics diagnostics to improve reliability and stability.
- Respond to support and privacy-rights requests.
- Comply with law, protect rights, and resolve disputes.
We do not use personal information for targeted advertising, build advertising profiles, or track users across apps or websites owned by other companies.
6. Service providers and recipients
Reece may use the following categories of providers:
- Google Firebase: Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, App Check, Analytics, Crashlytics, and Hosting. Analytics and Crashlytics are optional in Reece and are disabled by default.
- Google Sign-In: optional account authentication. Google provides Firebase with an authentication token and may provide your email address, display name, profile image, and provider account identifier according to your Google account settings.
- Sign in with Apple: optional account authentication. Apple provides Firebase with an authentication token, provider account identifier, and—if you choose to share it—your email address, which may be a private relay address.
- OpenAI: when you explicitly allow AI receipt processing, Reece sends the receipt image and OCR text extracted from that image to OpenAI so the service can identify fields such as merchant, date, purchased items, totals, VAT, currency, and category and return the recognition result to Reece. Receipt content is not sent to OpenAI before you give this permission.
- Email and support providers: delivering messages and handling support requests.
Reece requires third-party service providers that receive personal data, including Google Firebase and OpenAI, to provide the same or an equivalent level of protection for personal data as described in this Privacy Policy and as required by applicable law and Apple platform privacy requirements. Providers act under contract or their mandatory service terms and receive only the access reasonably necessary for the stated purpose. Information may also be disclosed when required by law, court order, or to protect users, Reece, or third parties.
7. AI receipt processing and consent
Automatic receipt recognition uses OpenAI as a third-party AI service. Before the first transfer of receipt content, Reece displays an in-app disclosure that identifies OpenAI, explains what is sent and why, and asks for your explicit permission.
- Data sent: the receipt image and OCR text recognized from the image. This can include merchant name, purchased items, date, receipt or invoice number, amounts, VAT, currency, and any other text visible on the receipt.
- Purpose: only to analyze the receipt, extract structured receipt information, and return the result to Reece.
- Choice: if you select “Not now,” Reece does not send that receipt content to OpenAI. Manual expense entry and other non-AI functionality remain available.
- Withdrawal: permission can be withdrawn in Reece under Settings → Information → AI & receipt processing. After withdrawal, no new receipt content is sent to OpenAI unless you explicitly allow processing again.
OpenAI is required to handle information under its applicable service terms and privacy/security commitments. Reece does not authorize OpenAI to use receipt content for advertising or cross-app tracking.
8. International transfers
Cloud providers may process information outside Israel. Where personal information is transferred from Israel, we use mechanisms permitted by applicable law, including contractual commitments by recipients regarding possession and use of information. Additional notification, accuracy, necessity, retention, and deletion duties may apply to information covered by rules for data transferred from the EEA.
9. Retention
- Account and synchronized receipts: while the account is active, until deletion, or until the information is no longer needed for the stated purpose.
- Local information: until deleted by the user, app, or operating system.
- Optional diagnostics and analytics: only when enabled by you, and then within provider-configured periods reasonably required for reliability and security.
- Support records: for as long as needed to resolve the request, document the response, prevent abuse, and comply with legal obligations.
- Backups and technical logs: may remain for a limited period until routinely overwritten or securely deleted.
We periodically assess whether retention remains necessary and aim not to retain personal information longer than required.
10. Account and data deletion
Registered users can initiate account deletion in the app through Settings → Account → Delete account. Guest users can either remove only their locally stored receipts, receipt files, and categories through Settings → Account → Delete all data, or permanently remove the automatically created guest Firebase profile and all associated data through Settings → Account → Delete guest profile. If the app is unavailable, a request may be submitted through the account deletion page or by emailing support@reeceapp.com.
Deletion is intended to remove the account and associated cloud receipts, expenses, and files, except limited information that must or may be retained for security, fraud prevention, legal obligations, or dispute resolution. Temporary deactivation is not a substitute for deletion.
11. User rights
Subject to applicable law, users may request:
- information about personal data held about them;
- access to and, where applicable, a copy of that information;
- correction of inaccurate, incomplete, or outdated information;
- deletion where no lawful reason for continued retention applies;
- restriction or cessation of certain processing where such a right applies;
- withdrawal of consent for future processing based on consent;
- submission of a complaint to the competent data-protection authority.
Reasonable identity verification may be requested to protect the account. Requests should be sent to support@reeceapp.com.
12. Security
Reece uses technical and organizational measures proportionate to the nature and risk of the information, including access control, authentication, encrypted connections, restricted administrative permissions, App Check, server-side rate limiting, daily AI quotas, hashed abuse-prevention identifiers, security logging, backups, dependency updates, and incident-response procedures.
For a serious security incident, we follow applicable assessment, documentation, and notification requirements, including notification to the competent authority or affected users when required. No system can guarantee absolute security.
13. Accuracy and automated processing
Receipt recognition is automated and may be inaccurate. Reece does not make legally significant decisions about users and does not determine creditworthiness, insurance, employment, or eligibility for services. Users should review totals, dates, taxes, and other recognized fields before relying on or exporting them.
14. Children
Reece is not directed to children under 13 or a higher minimum age required by local law. We do not knowingly collect information from children below the applicable age. Contact us if you believe a child created an account without appropriate authorization.
15. Policy changes
We may update this policy when features, providers, or laws change. The revised version will be posted here with a new effective date. Material changes may also be communicated in the app or by email.
16. Contact
Operator (Controller): Reece
Country of operation: Israel
Email: support@reeceapp.com
Website: reeceapp.com