What we keep from your email (almost nothing)

Asking people to forward their receipts is asking for trust. Receipts say what you buy, where and when. So here is exactly what RECEIPT sees, what it keeps and what it throws away.

We never log into your inbox

RECEIPT does not use the Gmail API and never asks for your password or for access to your mailbox. You set up forwarding yourself with a standard Gmail filter. You decide which senders it covers, you can see it in your settings, and you can delete it whenever you want.

The filter lists the exact addresses brands use for receipts, never whole domains. Big domains also send password resets and security codes, and those should never leave your inbox. We give you the filter pre-filled, so you don't have to write it yourself.

What reaches us

Only the messages your filter forwards reach your personal RECEIPT address. When one arrives, our service checks its signature, checks that it was sent to one of your verified addresses, and reads a handful of fields: merchant, date, amount, currency and order number.

What we keep

Once a receipt is processed, a short record stays:

• The merchant and the date of the receipt.
• The amount and its currency.
• A hash of the order number, used to stop the same order from being claimed twice.
• A hash of the email address it was sent to.
• The verification result and the points it earned.

A hash is a one-way fingerprint. It lets us recognise the same order number again without storing the number itself.

What we delete

The raw email, with its body, its line items, your address details and anything else in it, is deleted after processing. The target is minutes, not days. We don't keep a copy to improve the product later.

We keep the fact that you bought something from a brand, for how much and when. Not the email that says so.

When a receipt doesn't count

Rejected receipts follow the same rule. If a message fails a check, for example because its signature is broken or the order was already claimed, the raw email is deleted just the same. What stays is the short record and the reason it failed, so you can see what went wrong in the app.

The rest of the picture

• Forwarding confirmation. When you add your RECEIPT address in Gmail, Google sends a confirmation code to it. We catch that one message and show the code in the app, so you can paste it back into Gmail.
• Your data, your call. You can export your data or ask us to delete your account. RECEIPT is built in France, under the GDPR.
• Public by design. Only on-chain facts, such as payouts to your wallet, are public, because that is how a blockchain works.

Why we built it this way

The less we hold, the less can leak, and the less you have to take on faith. A reward program built on receipts only works if people are comfortable forwarding them. Keeping almost nothing is not a feature we added at the end. It is the condition for the whole idea to work.