Privacy policy

Version 2026-08-09

The short version

Slips stores your receipts so your family can search them. Your receipts belong to you. We never sell them, never show them to other families, and never use your name or your family's identity in anything shared.

What we hold

• Your account — name, email, and a hashed password (we can never read your password).
• Your receipts — the photos you upload and the store, items, prices and totals read from them.
• Anything you add — notes, tags, categories, loyalty cards.

Each family's data lives in its own separate database and file store. One family physically cannot read another's.

Reading your receipts

To turn a photo into items and totals, the image of the receipt is sent to our AI processor, Anthropic (United States), and processed there. Your name, email, account details and family information are not sent with it, and Anthropic does not use it to train models. A receipt photo can incidentally contain things printed on the slip itself — a loyalty number, the last four digits of a card — so we treat receipt images as sensitive and never share them further.

Product names (not prices, not you) may also be sent to an image-search provider to find a picture of a product.

Shared price statistics

When you sign up you agree that data from your confirmed slips may contribute to shared price statistics — this is what lets Slips tell anyone which shop is cheapest for a product, and how prices are moving.

What contributes: product, size, price, store and month, plus country. Nothing else. Specifically never: your name, your family, your notes, your photos, your totals, or anything that ties a purchase to a person. Contributions are keyed to an irreversible pseudonym, not to your account.

Additional protections:

• Private slips never contribute — anything you mark Private stays entirely yours.
• Medical and pharmacy purchases never contribute, under any circumstances.
• A price is only ever shown when at least 3 different families have seen it (5 families and 10 observations before anything is public; 10 for alcohol-related categories). A statistic that could point back at one household is never shown.
• If you delete your family, your contributions are removed from future statistics.

Who can see your data

Your family members, and nobody else. The platform operator can see counts and error rates for your family — how many slips, how many failed to read — so support and billing work. Seeing your actual receipts requires a family admin to grant 24-hour access from your own admin screen; it is recorded, shown to you, and you can end it at any time.

Keeping and deleting

We keep your data while your family exists. If you delete your family, it is locked immediately and permanently destroyed after 30 days — database, photos and all. You can export everything you have at any time from Admin → Export.

Security

Traffic is encrypted (HTTPS), passwords are hashed with argon2, sessions are signed, backups are taken nightly and verified. No system is perfect; we'll tell you promptly if something goes wrong that affects you.

Your rights and contact

You can export your data, correct anything in it, or delete your family, yourself, at any time — from inside the app. For anything else, contact the operator at the address in your welcome email.

If we change this policy in a way that matters, we'll show you the new version and ask you to accept it.