Privacy policy

• Account details: your email address, and your name and profile picture if you sign in with Google. Guests get an anonymous account with no personal details.
• Receipts: the photos you save and what is read from them — shop name and address, date and time, items, prices, totals and currency — plus any notes, categories and translations.
• Settings: your language, and, if you connect Odoo, its address, database name, login and API key.
• Split bills you share: a copy of the split (the names you typed and the amounts), so the link keeps working.

We don't collect your device's location, your contacts, or any photo you don't choose to save.

Only to run Paper Trail: to read and translate your receipts, place them on the map, show them back to you, keep you signed in, and send an expense to Odoo when you press “Send to Odoo”. We don't show ads, we don't sell your data, and we don't use your receipts to train AI models.

• Supabase stores your account, receipts and photos. Photos are kept in private storage that only your account can open.
• Vercel hosts the website and its server.
• OpenRouter and xAI (Grok): when you scan a receipt, the photo is sent to them to read and translate it. Receipt text is sent again when an older receipt is translated into a new language.
• Google Maps Platform receives the shop name and address read from a receipt, to find the place on the map.
• Google handles sign-in if you choose “Continue with Google”.
• Odoo receives a receipt only if you connect it and press “Send to Odoo”.

Each provider handles data under its own terms. Your data may be processed outside your country, including in the United States.

Anyone who has a split link and signs in, or continues as a guest, can see that split. Only send links to people you want to see it.

We keep your sign-in session and language choice in your browser. We don't use advertising or third-party tracking cookies.

We keep your data while your account exists. Deleting a receipt in the app deletes its photo and details. You can delete your whole account and everything in it yourself under Settings → Delete account. To get a copy of your data or correct it, or if you can't sign in, email privacy@infiniduo.com from your account's email address and we'll handle it within 30 days.

Everything is sent over HTTPS, each account can only read its own receipts, and photos are private. No system is perfectly secure, but we work to keep yours safe.

From Google sign-in, Paper Trail only receives your name, email address and profile picture. We use them only to create and identify your account, and don't share them except with the services listed above. Paper Trail's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Paper Trail is not meant for children under 13.

If this policy changes, we'll update this page and the date at the top.

Questions or requests: privacy@infiniduo.com