Privacy Policy

Effective Date: October 21, 2026 • Operated by Unfold Loop LLC (California, USA)

Our Privacy Pledge: Private, Local-First, Zero Ad Tracking

Your grocery receipts reflect personal lifestyle habits, diet, and household budget. Scanning, stitching and your saved records stay on your iPhone; a receipt leaves your device to be read by AI, as described in Section 2, or when you choose iCloud sync, backup or sharing. We do not sell, rent, monetize, or broker your personal information, purchase records, or receipt images to third-party advertisers or data brokers. The App shows no ads and does not track you.

1. Who We Are & Scope

This Privacy Policy explains how Unfold Loop LLC, a California limited liability company ("we", "us", or "our"), collects, uses, and safeguards information through the SlipFresh mobile application and its Home Screen widget ("App"), the receipt reading service the App uses ("Service"), and website (slipfresh.com). It applies to TestFlight beta versions and App Store versions of the App.

2. Information We Collect

Most of what the App handles never leaves your iPhone (see Section 4). Information is sent off your device only in the cases below:

A. Receipts Sent for AI Reading

When you scan or import a receipt, the App stitches the receipt image and detects its text on your iPhone. Before the App first sends a receipt for AI reading, it asks for your permission and tells you that the receipt goes to Google's Gemini API through our Service.

To read a receipt, the App sends our Service the prepared receipt image, the text and layout detected on your iPhone, and the request fields needed to process it, such as identifiers for the request and the receipt and a digest of the request. Our Service sends the image and the necessary request fields to Google's paid Gemini API, which returns the items, prices, dates and store details it reads. A receipt may need a few follow-up requests, for example to read it again or to check where items appear on the image.

Processed, then removed: Our Service deletes temporary receipt images when processing ends and does not save receipt text or recognition results. Your saved receipts stay on your device and, if you enable sync, in your private iCloud.

Anything printed on the receipt, such as the store, items, prices, totals and sometimes the last digits of a payment card, can appear in the image that is sent.

B. Pseudonymous Security Identity & Receipt Allowance

The App doesn't ask you to sign in. To keep the Service secure and to count free receipts, the App uses Apple's App Attest to show that requests come from a genuine copy of the App, and our Service registers a pseudonymous identity for it, based on Apple-verified information about your copy of the App. We don't receive your name, email address or Apple Account details for this.

The Service keeps the verified App Attest public key and its counter, the App Attest receipt Apple provides for risk assessment, hashes of session tokens, your receipt allowance and usage, and identifiers, digests and status of your requests, so that a request is never charged or run twice. These service records are linked to the pseudonymous identity. Receipt text and reading results are not saved by our Service.

C. Subscriptions

When you subscribe or restore purchases, the App sends the Apple-signed transaction to our Service, which verifies it with Apple and links it to your pseudonymous identity. The Service stores a hash of the transaction, Apple's original subscription identifier (used to check its status with Apple), the product, and purchase, expiry, grace-period, refund and revocation status. It also receives Apple's App Store notifications about the subscription and keeps their identifier, a hash, type and time. Apple processes payment; we never receive your card or billing details.

D. Usage Statistics

The Share usage statistics setting (Settings > Privacy) is off by default. It changes only when you choose to enable it. While it is on, the App queues content-free events and sends them to our Service when available. Events include opening the App, starting, saving or failing a scan, choosing a scan source, viewing Fresh, History or an original receipt, using search, viewing the subscription screen, onboarding steps, choosing a plan and restoring purchases. Each event carries its time, a random installation ID created by the App and, for some events, whether Premium is active. Events never include your name, receipt images or shopping details. Turning this setting off removes unsent optional events from the App's queue.

Even with the setting off, the App reports each successful receipt, as a one-way hash of the receipt identifier with its time and the installation ID, so that we can monitor service usage and unusual volumes.

E. Diagnostics

If App authentication fails, SlipFresh automatically queues a small service report: failed or interrupted authentication steps and timings, fixed numeric error codes, App and iOS versions, and a random identifier for that authentication attempt. Reports may include cancellation or timeout. If the App closes during authentication, it can report the interrupted step on its next launch. Reports do not include receipt content, Apple Account details, device keys, access tokens, error descriptions or a permanent installation identifier. They do not require successful sign-in and are separate from optional usage statistics. Up to ten unsent reports stay on your device. The App retries sending them while running or when you return to it. Detailed reports on the device and our server expire after seven days. The server keeps at most 5,000 reports outside business backups. The app operator may receive email summaries containing counts, versions, failed steps and error codes to repair the service; these summaries do not identify a user. Reports are client claims, not verified user identities or proof that Apple or our Service failed.

Scan diagnostics, such as timing, memory, thermal state and processing details, are created and kept on your iPhone. They leave your device only if you export and share them yourself, for example from the share sheet. The App does not automatically send diagnostic logs that contain your shopping content. If you test a beta through TestFlight, Apple may share crash reports with us, along with any feedback or screenshots you choose to send, under Apple's TestFlight terms.

F. Waitlist & Support Correspondence

If you sign up for early access on our website or email customer support, we collect your email address and message contents solely to communicate with you and fulfill your request.

G. Information We DO NOT Collect

We do not ask for your date of birth, identity documents, full payment card details, bank account credentials, contacts, or precise GPS location. Apple handles subscription payments. The App contains no advertising or third-party analytics SDKs and does not track you across other companies' apps or websites. Anything you choose to send in a receipt image or support message can be processed, including personal information printed on the receipt. Please do not send identity documents, medical records, or other sensitive information unrelated to grocery receipts. We do not use printed card details for financial transactions or marketing.

H. Adult Eligibility

SlipFresh is for adults aged 18 and over. During first-time setup, you declare that you are 18 or older and separately choose whether to allow AI receipt reading. The App does not request an age range from Apple or ask you to repeat an age check when you open it or return from the background.

The App saves your adult declaration on your device. It does not collect your date of birth, identity documents or age range, and does not send age information to our Service or Google. Your declaration is not independent age verification.

If Apple sends a signed notice that a parent or guardian has revoked consent, our Service stores a one-way hash of the Apple-verified App identity, the notice identifier and its time. It blocks new Service requests for that identity, including after reinstall, without saving age bounds or deleting saved receipts or resetting usage. Contact support if you believe access was blocked in error.

3. How We Use Your Information & No AI Model Training

We process your data strictly for legitimate operational purposes:

Reading receipts, extracting items, and organizing your grocery purchase history, display periods in Fresh, reminders and widget.
Verifying genuine copies of the App, counting free receipts, verifying subscriptions, and preventing duplicate charges.
Monitoring service usage and improving the App with content-free usage statistics.
Providing user support, answering inquiries, and troubleshooting technical errors.
Detecting and preventing fraud, abusive scans, or security threats.

Zero Model Training Commitment: We do NOT use your private receipt images, scanned contents, or grocery history to train publicly available or commercial foundation AI models without explicit, opt-in consent.

Google Gemini API: We use Google's paid Gemini API. Google’s terms for paid services state that Google does not use prompts or responses to improve its products. Google logs prompts and responses, including submitted receipt content, for a limited period to detect abuse and meet legal requirements. Google may temporarily store or cache that data in any country where Google or its agents have facilities. Our Service's deletion policy does not delete Google's logs. We cannot promise zero retention by Google or processing only in the United States.

4. Data Architecture: Local-First Processing & Security

SlipFresh is engineered with a local-first architectural philosophy. Camera capture, motion readings during a scan, multi-frame stitching and text detection run on your iPhone. Your receipts, receipt images, purchase records, corrections, Fresh shelf and shopping list are saved in the App's storage on your iPhone.

Home Screen Widget: The App saves a small snapshot of your Fresh shelf (food names, emoji and purchase or scan dates) in a container on your iPhone that only the App and its widget can read. The widget reads that snapshot and makes no network requests.

Raw Scan Data: A scan's video recording and intermediate frames are used to build the receipt image. By default, once a scan has been processed successfully, the App does not keep them long term; the saved scan keeps its receipt image and reading. Developer builds have a Debug mode and can keep raw files for the latest 100 scans. TestFlight builds do not offer these development controls. Scans still processing or awaiting recovery keep their required files. Raw files already on the iPhone before the first public build are protected during upgrade. Basic diagnostics can be exported by you; exports exclude receipt images, shopping details, videos, notes and credentials.

Optional iCloud Sync: If you turn on iCloud sync, your saved receipts, original images, edits, Fresh status, shopping list, recommendations, budgets and custom keeping days sync through your private iCloud storage to devices using the same Apple Account. Raw videos and display preferences stay on your iPhone. Apple stores this data in your iCloud account; we cannot access it. Deletions also sync between your devices.

Backups & Exports: Backup & restore and record export create files that you choose where to save or share. They leave your iPhone only if you send them somewhere.

Security: The App stores its files in its iOS application container. Connections to our Service use HTTPS. The App keeps its Service session only in memory, our Service stores only hashes of session tokens, and the Service's private databases are accessible only to the Service. No method of storage or transmission is completely secure.

5. Third-Party Service Providers (Sub-processors)

We use these providers to operate the App, Service and website:

Apple App Store & In-App Purchases: Apple processes subscription payments and does not give us your payment card or billing credentials. Receipt images may separately contain printed payment details, as described in Section 2. Apple also provides App Attest, App Store transaction verification and the private iCloud storage used for optional sync.
Amazon Web Services (AWS): Hosts our receipt reading Service. Like any internet service, it receives your IP address and connection details when the App connects.
Google (Gemini API): Reads receipt images sent by our Service, as described in Section 3.
Cloudflare Inc.: Provides edge routing, domain routing, DDoS protection, and secure web hosting.
Website resources: Website pages load fonts from Google Fonts and styling from the Tailwind CSS CDN. These providers receive normal connection information, such as your IP address, when your browser loads those resources. The website waitlist also records your message source, browser user agent and country reported by Cloudflare, with your email address.

We do not sell, rent, or trade personal data to advertising networks, data brokers, or marketing syndicates.

Browser privacy signals: The website does not change its behavior in response to a Do Not Track signal. We do not use cross-site advertising tracking or sell or share personal information for cross-context behavioral advertising, whether or not your browser sends Do Not Track or Global Privacy Control. The service providers above still receive the connection information needed to provide their services.

6. Data Retention, In-App Deletion & Deletion Requests

We keep information only as described below:

On your iPhone: Your records, receipt images and readings stay until you delete them or delete the App. Raw scan data is kept as described in Section 4.
Your private iCloud: Synced records stay until you delete them in the App with sync on, or remove the App's data through your iCloud settings.
Readings on our Service: Readings returned by the Service contain receipt content. Our Service returns them to your device without saving the recognition result. It does not keep receipt text or recognition and line-check results. Temporary uploaded images are deleted when processing ends. If the connection fails before your device receives a result, the Service cannot retrieve that result later. Request status remains to prevent automatic duplicate AI calls.
Security, allowance and request records: Your pseudonymous identity, App Attest key data, receipt allowance and usage, subscription status, and request identifiers, digests and status (without the reading) are kept while your service account is active, so requests cannot be charged or run twice and allowances cannot be reset. Account deletion is described below. For each call to Google, the Service also records hashes of the image, text and result, the model, time, status and token counts, but not the image or the receipt text.
Usage statistics: Content-free events, receipt success summaries and related alerts expire 90 days after the Service first receives them. Expired records are removed when the statistics database is next accessed. For records already held when this rule began on October 15, 2026, the 90-day period starts on that date. Separate daily abuse counters use a hash of the verified Service identity and are cleared on the next database access after that UTC day ends.
Recovery backups: Encrypted off-host backups contain server databases and private service configuration. Backups exclude cached receipt content. After a new backup has been verified and saved, our routine keeps at most seven recent copies and removes copies older than seven days. The routine runs on our development Mac; if it cannot complete a new backup, it keeps the existing recovery copies until a successful run. Before an older backup is restored, cached receipt content is discarded and the current deletion journal is applied. This prevents deleted service accounts and associated records from returning. We keep a separate deletion journal only to carry out deletion and apply it to recovery copies.
Google: Prompt and response logs may be kept by Google for a limited period as described in Section 3.
Support correspondence: Kept as long as needed to respond and to keep a record of your request.

In-App Deletion: You can delete receipts and records in the App at any time. Deleting removes them from your iPhone and, with iCloud sync on, from your private iCloud storage through sync. Our Service does not retain receipt images, receipt text or recognition results after processing. Deleting a local receipt does not delete your service account. Use the account deletion entry below for server records.

Delete your service account: Open Settings > Privacy > Delete service account. Confirm once to request permanent deletion. The Service stops online features when it accepts the request and completes deletion within 30 days. You can check progress and completion on that page. You do not need to email us or send identity documents. Deletion removes your service account, keys, sessions and associated request and subscription records. It also removes usage records matching the installation ID sent with your request. Other usage records that cannot be matched to your account expire within 90 days. Content-free cost totals remain after links to your account and request content are removed. We keep minimum hashed allowance and security records to prevent deletion from resetting the lifetime trial, referral limits or access restrictions, plus a record of your deletion request and the recovery journal described above. These limited records are retained for these purposes; we do not claim that all of them are required by law.

Apple subscriptions: Deleting your service account does not cancel Apple billing or request a refund. Please cancel an active subscription in Apple subscription settings. You can request deletion without waiting for the subscription to expire. Your saved local records and private iCloud library stay under your control. Google's limited logs follow Google's terms.

Other privacy requests: Settings > Privacy > Recognition privacy explains retention and links to privacy support. You can request access, correction or deletion by emailing support@slipfresh.com with the subject "Privacy Request". Tell us which data and App installation your request concerns. Do not send your password, full payment card details or identity documents. Because there is no App sign-in, we may need information already available in the App to match and verify your request. If we cannot match records, we will explain that limitation. We will respond within the time required by applicable law. We may retain the minimum records needed for security, fraud prevention, duplicate protection, subscription accounting or legal obligations where permitted by law. If we deny a request, you can reply to the same address to appeal. Your saved local records and private iCloud library remain under your control. Google's logs follow Google's terms; we cannot directly erase them through the App.

7. Adult-Only Service & Children's Privacy

SlipFresh does not offer service to anyone under 18, even with a parent's permission. The first-time adult declaration in Section 2.H supports that product rule. COPPA separately protects children under 13; the App is not directed to children under 13, and we do not knowingly collect their personal information. If we learn that a person under 18 has provided personal information, we will stop their access and take steps to delete information we can identify, except the minimum records we must retain as permitted or required by law. If you believe a minor has provided personal information, contact support@slipfresh.com so we can investigate.

8. California Privacy Rights (CCPA / CPRA Notice)

Where the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") applies to our processing, California residents have the rights below. We also accept privacy requests described in Section 6 from users in other states and honor rights that apply under their state laws.

Right to Know & Access: The right to request information about the categories and specific pieces of personal information we have collected about you, the categories of sources, and the business purpose for collecting it.
Right to Delete: The right to request the deletion of your personal information, subject to certain legal exceptions.
Right to Correct: The right to request correction of inaccurate personal information.
No Sale or Sharing of Personal Information: We do NOT "sell" or "share" (for cross-context behavioral advertising) your personal information as defined under the CCPA/CPRA.
Non-Discrimination: We will never discriminate against you for exercising any of your statutory CCPA/CPRA rights.

To exercise your California rights, please submit a verifiable consumer request to support@slipfresh.com.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory updates. We will notify you of any material changes by revising the "Effective Date" at the top of this policy and, where appropriate, through in-app notifications. We encourage you to review this policy periodically.

11. Contact Information

For privacy inquiries, data deletion requests, or questions regarding our data practices, please contact our privacy compliance officer at:

Unfold Loop LLC

Attn: Privacy Officer

Email: support@slipfresh.com / support@unfoldloop.com

Website: unfoldloop.com