Privacy Policy

• Account basics — username, email, hashed password (never the plain password), birth date, and optional fields like phone number you choose to add.
• Receipts you give us — the photo or email, the parsed items, totals, dates, store names, and any tags / categories you assign.
• Rewards & memberships — only what's printed on receipts you upload, plus loyalty numbers you enter yourself.
• Household + chat — when you create or join a household, the membership record + chat messages you send.
• Usage data — basic logs (which API endpoint, response time, error counts) tied to your account, kept 30 days for debugging and abuse prevention.

We do NOT collect: bank credentials, social-security numbers, biometrics, your contacts, your location (beyond a receipt's store address), or your browsing history outside GetGuac.

• You see all of it.
• Your household members see only: the shared shopping list rows you mark as shared, the household chat messages, and other members' display names. They do not see your receipts, rewards, totals, categories, or any analytics.
• Other GetGuac users can find you by email to start a 1:1 chat — same disclosure surface as a password reset. They cannot see any of your data unless you send them a message.
• GetGuac employees — only on-call engineers, only when investigating a specific issue you reported, only the minimum needed to fix it. Every read is logged.
• Nobody else. We don't sell data. We don't share your account or receipt data with advertisers — no advertising network ever receives your purchases, totals, categories, email or phone number. We don't train external AI models on your receipts. Our public marketing pages do carry advertising scripts, which see only that a browser loaded a page; section 8 names them.

Database rows are protected by per-user Row Level Security — even a bug in our application code can't return one user's receipts to another. Connections are HTTPS-only. Passwords are hashed with bcrypt. Storage URLs (the actual receipt photos) are time-limited and signed.

The Security page has the technical breakdown — what's encrypted, what RLS policies exist, what we audit-log.

We email you for: account confirmation, password reset, security alerts (e.g. new sign-in from a new device), and household invites. Marketing emails are off by default. You can disable everything except security alerts from your profile page.

The free @getguac.app address that comes with your username is for receiving merchant receipts. We parse incoming messages to extract receipts; we do not read message bodies for any other purpose, and we don't send anything from your address without your explicit action.

If you choose to link a retailer account (Connections page → "Link account"), you sign into that retailer's own website inside an isolated browser session on your device. We never see your credentials. Username and password are typed into the retailer's own HTML form, on the retailer's own origin.

What we do see, only after you've signed in and only on the retailer's order-history page: the order metadata our extractor reads (store name, date, total, line items). We store these as receipts in your account, the same way email-forwarded receipts are stored.

The browser session — including any auth cookies the retailer set — is discarded when you close the linking screen. We don't store passwords, tokens, or any persistent credential. To pull receipts again later, you sign in again.

This feature is in beta and may break without notice. Some retailers' Terms of Service prohibit automated access to their sites; by using this feature you accept that risk. If a retailer requests that we disable a linker, we will do so promptly.

You can delete your entire account from your profile page. One click. Hard delete in 24 hours. Backups age out within 30 days.

You can also delete individual receipts, rewards, household memberships, and chat messages at any time — those deletes are immediate.

If you're in the EU/UK/California or another jurisdiction with data-protection laws, you can request: a copy of your data, correction of inaccurate data, deletion, or a portable export. Most of this is already self-serve in the app (profile → export / delete). For anything else, email us.

We respond within 30 days. We don't charge for these requests.

Inside the app — once you are signed in, we use exactly one cookie: your sign-in session. No advertising pixel, no cross-site tracker and no analytics cookie runs on your dashboard, your receipts, or any other signed-in page. That is a hard line, and it is enforced in code rather than by policy: the ad tracker is not loaded by the app at all.

On our public marketing pages — two third-party advertising scripts run, and we would rather name them than describe ourselves as tracker-free:

• Meta pixel — only on /join, /start and /register: our two ad landing pages and the signup form they lead to. It sets an _fbp cookie and tells us whether people who clicked an ad actually arrived and finished signing up. It is the only way to know if we are wasting money on ads. It does not run anywhere else on the site, and never once you are signed in — creating your account is the last page it sees.
• Google AdSense — loads across our public pages to serve the ads that fund the free tier, and sets its own cookies (test_cookie and others from doubleclick.net).

Neither of these ever receives your receipts, your totals, your categories, or anything we have parsed from a purchase. We do not send your email address or phone number to any advertising network — Meta’s “advanced matching” feature, which would do exactly that, is deliberately turned off.

Our own analytics are first-party and aggregate: a per-day, per-page view count and a visitor tally where the visitor identifier is a salted hash whose salt rotates daily, so the same person on two days cannot be linked. We store no IP address and no user agent against it. Error and performance logs are kept 30 days.

• Supabase — our database + auth + storage host. They cannot read your row-level-security-protected data; they hold the encrypted-at-rest copy.
• Google Gemini / Groq — receipt parsing. Only the receipt photo + text is sent, no account identifiers, and Anthropic's and Google's terms forbid them from training on this data.
• Vercel — runtime hosting + CDN. They see request metadata, not response bodies.
• Sentry — crash + error reporting. We send the error stack and a coarse user identifier (so a single user's repeated crashes group together). No receipt content, no balances.
• PostHog — behavioral analytics. We send screen-view events and product-action events (e.g. "smashed a list item"). No receipt content, no PII beyond the user ID.

GetGuac is not directed at children under 13. If we learn we have a sub-13 account, we delete it.

If we change what we collect, who can see it, or how it's protected, we'll post the new policy here with a new "last updated" date and email you before the change takes effect for any data we already hold.

Privacy questions go to privacy@getguac.app. Security reports (please) to security@getguac.app.