Server data has no independent disaster-recovery backup. Encrypted receipt storage on D: does not protect against drive failure, corruption or loss of Ryan-PC. Keep eligible originals. A successful upload acknowledges server storage only.

Your receipts and your choices.

This candidate is not released. Private receipt backup uploads are unavailable until safe admission and the Android/server pair are qualified; qualified backup is required before the initial preview. Keep originals locally. Capture, local recognition and reviewed purchase history remain separate and available. Existing backup choices are retained; an ON preference does not mean an image was uploaded.

Private backup and local recognition

Recognition runs on your device. New accounts start with private server receipt image backup on after a visible signup disclosure. You can stop uploads in Account Settings → Receipts & Privacy and choose whether existing copies expire or are deleted now. Household membership gives no access to private images. Reviewed facts you explicitly publish into shared purchase history have that shared scope.

Transport uses HTTPS and server originals are encrypted at rest. The service operator holds the storage key and can technically access service data; encryption is not end-to-end encryption. No receipt image or raw OCR is sent to an outside OCR provider, analytics service or public data feed.

How long evidence stays

App-owned images and unnecessary raw OCR have a fixed maximum of three calendar months from original capture/import, in the recorded time zone. Upload, rescan, update and restore do not restart that clock. A powered-off phone cannot run cleanup; access is fenced at expiry and cleanup runs when execution is possible. The server enforces its deadline independently.

Your account shows its storage use and limit. Uploads stop at the limit; existing images are not secretly removed to admit another. You may delete older evidence earlier. Shared server-drive capacity can also pause uploads. Unacknowledged originals stay on your device with backup pending or unavailable. No additional storage-pressure deletion is authorized; future cleanup needs a separate owner decision. This app does not promise push or email delivery. Three months is a maximum, not a guarantee against storage failure. Source-provider photos and copies you export remain outside app deletion. Reviewed structured purchase history is retained under its separate policy.

Optional recognition research

Help improve receipt recognition is a separate, voluntary choice and starts off. Backup alone does not authorize research, model training or human labeling. Research processing is not active in this engineering candidate. Consent can allow future uploads to enter a restricted queue while evidence remains retained. Withdrawal stops future use and removes eligible identifiable queued references. Already-trained model weights may not be fully reversible.

Deletion and recovery

Receipt evidence can be deleted with separate immediate confirmation. The app shows when remote deletion is queued and when the service acknowledges it. Confirmed purchase history is preserved. Minimal private replay/deletion records may remain after image deletion to prevent retries from recreating evidence or renewing its deadline. They contain no image bytes or raw OCR and do not authorize research. Account recovery uses a private single-use code; save it privately. Whole-account closure and any existing-data migration require a reviewed operator procedure before real beta admission. Independent server disaster recovery is deliberately deferred and unsupported in this beta. Existing recovery tooling is retained for future qualification. Keep eligible phone originals. Optional passphrase-protected device recovery is bounded (16 MiB payload, 8 MiB image files, 4 MiB selected database); larger datasets require a separately reviewed transfer. External recovery files stay under your control and cannot be erased by this app.