Reece1. Controller and contact
Daniel Olkha, operating Reece, is the operator (controller) responsible for processing personal information. For privacy inquiries, please contact support@reeceapp.com.
This policy applies to the Reece mobile app, reeceapp.com, cloud functions, technical support, and related services.
2. Voluntary and required information
Providing personal information is voluntary. Reece can be used in guest mode without creating an email-based account. In guest mode, receipts, receipt files, categories, and related app settings remain on the device and are not synchronized to Cloud Firestore or Cloud Storage. Creating an account enables cloud synchronization and recovery. A receipt image is required when you ask Reece to recognize that receipt. Refusing an optional permission does not affect features that do not need it.
Guest mode does not make automatic recognition an offline or device-only process. If you allow recognition, the receipt image is transmitted through the Reece server to OpenAI. Reece also keeps the structured recognition result, a hash of the submitted image, and processing status in a private server-side cache linked to your automatically created Firebase identifier. This avoids processing or counting the same request twice and is separate from cloud synchronization of your receipt history. The submitted image is not stored in this cache.
In guest mode, an automatically created anonymous Firebase identifier is used to verify and maintain subscription access without asking for an email address or other registration details. For verification, Reece sends Apple's signed purchase data, including the current and original transaction identifiers, and a device-verification identifier to its verification service. The device identifier is used transiently to verify the request and is not stored in the subscription database or analytics. Minimal purchase-status and access-grant records are retained to restore access and process renewals, refunds, expiration and revocation.
A verified guest subscription can be used without creating a personal Reece account. If you later choose to register or sign in, Reece asks separately before linking that subscription to the account. One Apple subscription chain can be linked to only one registered Reece account. A different registered account receives a “linked elsewhere” result and is not granted paid access. Signing in, signing out, reinstalling, or restoring purchases does not transfer ownership automatically. To request a transfer between registered Reece accounts, contact support; any transfer requires verification and is not automatic. Subscription access never transfers receipts, profiles, or other private account data.
Reece does not require a national identity number, complete payment-card details, contacts, microphone access, or precise location for its core functionality.
3. Information we process
Email address, display name, and profile image only when the selected Apple or Google provider shares them; internal user identifier; provider identifier; sign-in status and timestamps; email-verification status; Firebase authentication tokens; and security signals. If provided, the optional business name is stored as a profile setting and included in exported reports. Reece never receives your Apple or Google password.
For an App Store subscription, Reece stores the plan and product identifier, current and original transaction identifiers, entitlement status, and purchase, renewal, expiration, or revocation dates linked to an internal Reece identifier, including in guest mode. These records are used to unlock paid features, restore access, prevent fraud, and provide subscription support. Personal Reece registration is optional. Apple processes the payment; Reece does not receive or store complete payment-card details.
Receipt photographs or files, merchant, date, document number, currency, subtotal, tax, total, category, notes, corrections, exported records, and the profile to which an expense is assigned. For accounts that use multiple expense profiles, Reece also processes each profile’s name, type, creation and update timestamps, and identifier.
A locally stored receipt image may contain embedded metadata such as capture time, camera details or GPS coordinates added by the camera or another app. Before a supported JPEG or PNG image is sent for recognition or uploaded to Reece cloud storage, Reece creates a separate upload copy, normalizes pixel orientation when needed, and removes EXIF/GPS, XMP, IPTC, comments, timestamps, unknown non-rendering metadata and trailing data. Local original and processed files are not rewritten. Unsupported or malformed image containers fail closed instead of being uploaded unchanged. Reece does not request or use the device’s precise-location sensor for receipt storage.
When a Premium user connects Gmail, Reece reads the connected account email address, message and attachment identifiers, minimal attachment metadata (file name, media type, size and attachment ID), and supported PDF or image attachments found by the user-initiated search. Reece does not request message snippets, message headers or message-body text and does not modify or delete email. After the separate AI consent, supported attachments can be sent through Reece to OpenAI for recognition before you choose which results to add to receipt history. Processed attachment identifiers are stored only on the device to avoid importing the same file again and are removed when Gmail is disconnected.
When currency conversion is used, Reece stores the original amount and currency together with the converted amount, selected primary currency, official rate, rate source, and rate timestamp. The Reece server retrieves a public rate table without sending the National Bank of Ukraine any user data, receipt content, or selected currency pair.
App version, platform, language, App Check results, security/abuse signals, and hashed technical identifiers used for rate limiting. Crash diagnostics are collected only if you enable optional diagnostics in the app.
Firebase Remote Config is used to retrieve minimum and current app versions, build numbers and App Store links at launch and when Reece checks for updates. This operation is independent of the optional analytics setting. Firebase may automatically process the app version and build, operating-system version, language, time zone, country code, Firebase Apple app identifier and bundle identifier. Firebase also creates and processes a Firebase installation ID to retrieve and target configuration. This identifier is independent of the optional Analytics setting and of a Reece account; deleting a Reece account does not itself delete the Firebase installation ID, whose retention is governed by Firebase. Reece does not place receipt content, amounts, merchant names or email addresses in Remote Config requests.
Limited feature-usage events, app and device metadata, and approximate country or region inferred by Firebase may be collected only if you enable analytics. After opt-in, Reece associates these events with the internal Firebase user identifier so activity belongs to the correct account or guest profile; the identifier is therefore linked to you or your app account. Reece does not request the device’s precise-location sensor for analytics. Feature-usage event payloads do not include receipt contents, email addresses, receipt amounts or merchant names.
When you open a Reece QR or campaign link, the browser stores a random first-party identifier in local storage. For a direct server redirect, the same kind of identifier may instead be stored in a secure HttpOnly first-party cookie. The link label, broad device type, and identifier are sent to Firebase Cloud Functions, where only a one-way hash is retained to distinguish repeat visits. The counter does not store your email, Reece account ID, advertising ID, precise location, receipt data, IP address, or full user-agent string and is not used to track you across other websites. Clearing browser or site data, using private browsing, or using another browser creates a new identifier.
Email address, message content, attachments, screenshots, app version, an account code if you choose to share it, and other information you voluntarily provide. The code available under Settings → Account is your internal Firebase identifier. Reece copies it to the clipboard only when you request this; copying it does not automatically send it to support.
If you enable usage analytics, Firebase Analytics and Reece activity records may associate feature-usage events with your internal Firebase user identifier. Disabling analytics stops new optional usage reporting; it does not by itself delete previously collected records.
4. Device permissions
- Camera: used only after you choose to photograph a receipt.
- Photos or files: used only to select or save a receipt and create exports, within the permission granted by the operating system.
- Gmail: optional read-only access is requested only when a Premium user taps the Gmail import action. You can disconnect Gmail in Reece, which removes the local connection metadata and private recognition cache, and you can separately revoke access in the Google account settings.
- Notifications: may be used only after permission for service or account-related messages.
Reece does not continuously access the camera or photo library in the background. Permissions can be changed in device settings.
5. Purposes of processing
- Create accounts, sign users in with email and password or an optional Apple or Google account, verify email addresses, and restore access.
- Validate App Store purchases, maintain and restore paid access, link a subscription to one registered Reece account only after explicit confirmation, prevent subscription fraud, and help resolve ownership or access issues.
- Upload, recognize, edit, store, and synchronize receipts.
- At the user's request, find supported receipt attachments in connected Gmail from the last three months, recognize supported attachments before final selection after AI consent, show the results temporarily for selection, and skip attachments already imported on that device.
- Provide history, categories, statistics, and exports.
- Convert totals into the selected primary currency using the daily official rate while keeping each receipt's original amount and currency.
- Prevent fraud, automated attacks, abuse, and unauthorized access.
- If you opt in, collect limited usage analytics and Crashlytics diagnostics to improve reliability and stability.
- Measure total and approximate unique opens of Reece QR and campaign links and understand broad device types.
- Respond to support and privacy-rights requests.
- Comply with law, protect rights, and resolve disputes.
Reece does not display third-party advertising and does not use receipt contents for targeted advertising or advertising profiles. Optional Firebase Analytics is described separately in this Policy and is disabled by default.
6. Service providers and recipients
Reece may use the following categories of providers:
- Google Firebase: Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, App Check, Remote Config, Analytics, Crashlytics, and Hosting. Analytics and Crashlytics are optional in Reece and are disabled by default. Remote Config operates independently to deliver update configuration as described above.
- Google Sign-In: optional account authentication. Google provides Firebase with an authentication token and may provide your email address, display name, profile image, and provider account identifier according to your Google account settings.
- Gmail API: optional read-only access used only after the user starts Gmail receipt import. Reece searches for supported attachments from the last three months by requesting attachment metadata and separately downloading only supported attachment bytes. It does not request message snippets, message headers or body text and does not modify or delete messages.
- National Bank of Ukraine Open Data: the Reece server retrieves the public daily table of official rates for currency conversion. The request contains no user data, receipt images or amounts, merchant names, email addresses, or selected currency pair.
- Sign in with Apple: optional account authentication. Apple provides Firebase with an authentication token, provider account identifier, and—if you choose to share it—your email address, which may be a private relay address.
- Apple App Store and In-App Purchase: Apple processes subscription payments and provides Reece with signed transaction and subscription-status information needed to verify and maintain paid access. Reece does not receive complete payment-card details. Billing, cancellation, and refund requests are handled under Apple’s terms and processes.
- OpenAI: when you explicitly allow AI receipt processing, Reece sends the receipt image to OpenAI so the service can identify fields such as merchant, date, purchased items, totals, VAT, currency, and category and return the recognition result to Reece. Receipt content is not sent to OpenAI before you give this permission. Reece submits these requests with
store: false, which disables Responses API application-state storage but is not Zero Data Retention. Unless OpenAI has approved and configured Reece for Zero Data Retention or Modified Abuse Monitoring that excludes customer content, request and response content may remain in OpenAI abuse-monitoring logs for up to 30 days, subject to OpenAI’s documented legal and security exceptions. - Email and support providers: delivering messages and handling support requests.
Google data and Limited Use
Reece handles and transfers information received through Google APIs under the Google API Services User Data Policy and the Google Workspace user data and developer policy, including their Limited Use requirements. Gmail information is used only to provide and secure the visible receipt-import and expense-record features you request. Reece does not sell Google user data; use it for targeted advertising, creditworthiness assessment or unrelated profiling; use or permit it to train generalized AI or machine-learning models; or use it to improve products, models or services that are not the user-requested Gmail import. After your explicit recognition consent, supported attachment images are transferred through Reece to OpenAI only to extract receipt details for you; cache, synchronization and deletion are described in this policy. A Gmail connection is not permission for unrelated data uses.
Reece requires applicable third-party service providers identified above to provide the same or an equivalent level of protection for personal data as described in this Privacy Policy and as required by applicable law and Apple platform privacy requirements. Providers act under contract or their mandatory service terms and receive only the access reasonably necessary for the stated purpose. Information may also be disclosed when required by law, court order, or to protect users, Reece, or third parties.
7. AI receipt processing and consent
Automatic receipt recognition uses OpenAI as a third-party AI service. Before the first transfer of receipt content, Reece displays an in-app disclosure that identifies OpenAI, explains what is sent and why, and asks for your explicit permission.
- Data sent: the receipt image. It can contain the merchant name, purchased items, date, receipt or invoice number, amounts, VAT, currency, and other text visible on the receipt.
- Purpose: only to analyze the receipt, extract structured receipt information, and return the result to Reece.
- Choice: if you select “Not now,” Reece does not send that receipt content to OpenAI. Manual expense entry and other non-AI functionality remain available.
- Withdrawal: permission can be withdrawn in Reece under Settings → Information → Receipt processing. After withdrawal, no new receipt content is sent to OpenAI unless you explicitly allow processing again.
OpenAI is required to handle information under its applicable service terms and privacy/security commitments. Reece submits recognition requests with store: false, which disables Responses API application-state storage but does not by itself provide Zero Data Retention. Unless OpenAI has approved and configured Reece for Zero Data Retention or Modified Abuse Monitoring that excludes customer content, request and response content may remain in OpenAI abuse-monitoring logs for up to 30 days, subject to OpenAI’s documented legal and security exceptions. Reece does not authorize OpenAI to use receipt content for advertising, cross-app tracking, or training generalized AI models.
When you start a Gmail search and allow automatic recognition, supported receipt attachments are checked by the same recognition service before you select which results to add to your receipt history. Reece requests only the MIME attachment metadata needed to locate supported files and then downloads the supported attachment bytes found by that search before you select which recognized results to save; it does not request message snippets, message headers or body text. Reece sends supported attachment images, including rendered PDF pages, for recognition. Unsaved review copies are removed when you dismiss the results, disconnect Gmail, change accounts, after 15 minutes while Reece remains active, or on the next app launch if Reece was terminated first. Deselecting an import result does not delete its private server-side recognition cache immediately; it uses the same universal seven-day limit described below, and disconnecting Gmail or deleting the Reece account or guest profile deletes the private recognition cache.
8. International transfers
Cloud providers may process information outside Israel. Where personal information is transferred from Israel, we use mechanisms permitted by applicable law, including contractual commitments by recipients regarding possession and use of information. Additional notification, accuracy, necessity, retention, and deletion duties may apply to information covered by rules for data transferred from the EEA.
9. Retention
- Account and synchronized receipts: while the account is active, until deletion, or until the information is no longer needed for the stated purpose.
- Recognition cache, including guest mode: every request from the camera, Photos, a file, the share sheet or Gmail is assigned an expiration no later than seven days after the recognition request begins, including a result that you do not select for receipt history. The server also caps reuse and sweeps legacy records under this universal limit. Automatic database deletion runs asynchronously after expiration and is not instantaneous. Disconnecting Gmail deletes the private recognition-request cache for that Firebase identifier, including legacy records that cannot reliably be distinguished by source. Deleting the Reece account or guest profile also removes its private recognition cache; a one-way hashed deletion marker containing no receipt image or recognition result may remain solely to stop an in-flight server task from recreating deleted cache data. Deleting only local receipts does not remove this server-side cache.
- OpenAI abuse-monitoring logs: unless OpenAI has approved and configured Reece for Zero Data Retention or Modified Abuse Monitoring that excludes customer content, request and response content may remain for up to 30 days under OpenAI’s API data-controls policy and documented legal or security exceptions. Deleting a Reece account or guest profile cannot immediately remove those provider-controlled logs.
- Subscription records: while needed to provide or restore paid access and, after expiration or account deletion, only as reasonably necessary for purchase support, security, fraud prevention, dispute resolution, or legal obligations. If the registered owner account is deleted, Reece retains a limited ownership-status marker so the same subscription cannot be silently reassigned to another registered account. Apple retains its own purchase records under Apple’s policies.
- Local information: until deleted by the user, app, or operating system.
- Optional diagnostics and analytics: only when enabled by you, and then within provider-configured periods reasonably required for reliability and security.
- QR and campaign-link identifier: in browser storage until you clear it; its one-way server-side hash is retained while reasonably needed to avoid duplicate counting. Aggregate counters may be kept longer without the raw identifier.
- Support records: for as long as needed to resolve the request, document the response, prevent abuse, and comply with legal obligations.
- Backups and technical logs: may remain for a limited period until routinely overwritten or securely deleted.
We periodically assess whether retention remains necessary and aim not to retain personal information longer than required.
10. Account and data deletion
Registered users can initiate account deletion in the app through Settings → Account → Delete account. Guest users can either remove their locally stored receipts, receipt files, categories, expense profiles and related settings through Settings → Account → Delete all data, or permanently remove the automatically created guest Firebase profile and all associated data through Settings → Account → Delete guest profile. If the app is unavailable, a request may be submitted through the account deletion page or by emailing support@reeceapp.com.
Deletion is intended to remove the account and associated cloud receipts, expense profiles, expenses, files, analytics activity stored by Reece, and private recognition cache, except limited information that must or may be retained for security, fraud prevention, legal obligations, purchase support or dispute resolution. Temporary deactivation is not a substitute for deletion.
Deleting a Reece account or the app does not cancel an active App Store subscription and does not delete purchase records controlled by Apple. To stop renewal, manage or cancel the subscription in the Apple Account subscription settings. If a registered account that owns a linked subscription is deleted, a later link to another registered Reece account requires support verification; Reece does not silently transfer ownership. Guest restoration on a verified Apple device can remain available, but it does not restore the deleted account’s receipts, profiles or other cloud data.
11. User rights
Subject to applicable law, users may request:
- information about personal data held about them;
- access to and, where applicable, a copy of that information;
- correction of inaccurate, incomplete, or outdated information;
- deletion where no lawful reason for continued retention applies;
- restriction or cessation of certain processing where such a right applies;
- withdrawal of consent for future processing based on consent;
- submission of a complaint to the competent data-protection authority.
Reasonable identity verification may be requested to protect the account. Requests should be sent to support@reeceapp.com.
12. Security
Reece uses technical and organizational measures proportionate to the nature and risk of the information, including access control, authentication, encrypted connections, restricted administrative permissions, App Check, server-side rate limiting and processing controls, hashed abuse-prevention identifiers, security logging, backups, dependency updates, and incident-response procedures.
For a serious security incident, we follow applicable assessment, documentation, and notification requirements, including notification to the competent authority or affected users when required. No system can guarantee absolute security.
13. Accuracy and automated processing
Receipt recognition is automated and may be inaccurate. Reece does not make legally significant decisions about users and does not determine creditworthiness, insurance, employment, or eligibility for services. Users should review totals, dates, taxes, and other recognized fields before relying on or exporting them.
14. Children
Reece is not directed to children under 13 or a higher minimum age required by local law. We do not knowingly collect information from children below the applicable age. Contact us if you believe a child created an account without appropriate authorization.
15. Policy changes
We may update this policy when features, providers, or laws change. The revised version will be posted here with a new effective date. Material changes may also be communicated in the app or by email.
16. Contact
Operator (Controller): Daniel Olkha (Reece)
Country of operation: Israel
Email: support@reeceapp.com
Website: reeceapp.com