Privacy Policy

We wrote it to be read. If something is unclear, write to our Privacy Officer at team@ripn.app.

The short version

• Ripn reads the grocery receipts you choose to scan so it can show what you bought, what you spent and what you threw out.
• To read a receipt, we send it to Anthropic, the company that makes the Claude AI models. We ask your permission in the app before the first one is sent. Anthropic doesn't use it to train its models. It deletes it within 30 days, but can keep content its safety systems flag for up to 2 years.
• If you join a household, everyone in it sees the receipts, photos and spending of the whole household.
• We don't sell your personal information, and we don't use your receipts to target ads at you.
• Analytics and advertising measurement only run as described in section 9, and you can turn them off in Settings.
• You can export your data and delete your account from inside the app at any time, or request deletion at ripn.app/delete-account.

1. Who we are and how to reach us

Ripn is run by MN8 Technologies Inc., a Canadian corporation located at 390 Grosvenor Avenue, Westmount, Quebec H3Z 2M2, Canada. MN8 is responsible for the personal information described in this Policy (in European terms, MN8 is the "controller").

Privacy Officer. Our person in charge of the protection of personal information is our Privacy Officer. You can reach them at team@ripn.app or by mail at the address above, marked "Attention: Privacy Officer". A summary of the rules we follow to protect personal information is available at ripn.app/privacy-governance.

Brazil. Our Privacy Officer also acts as our data protection officer (encarregado) for Brazil, and can be reached at team@ripn.app in Portuguese or English.

2. What we collect

Information you give us

• Account details. Your email address, and your name if you sign in with Apple or Google and they share it with us. If you sign up with an email and password, the password is stored only in hashed form by our authentication provider. If you use Apple's "Hide My Email", we receive a relay address instead of your real one.
• Receipts. The photos, screenshots and PDFs of receipts and order confirmations you choose to scan. A receipt can show more than groceries: the store's name and address, the date and time, a loyalty card number, the last digits of a payment card, or the name of the cashier. Ripn extracts only the items, prices, quantities, totals, store and date, but the image you keep still shows everything printed on it.
• Grocery and spending data. The items read from your receipts and any changes you make to them: names, prices, quantities, categories, the store, the purchase date, estimated expiry dates, and whether you later marked each item as used or thrown out. You can also set a grocery budget and a home currency.
• Household details. The display name you choose when you create or join a household, and the invitations you send.
• Messages to us. Your email address and what you write when you contact support, and the device and app version details our support form sends so we can help.
• Email preferences. Whether you agreed to receive tips and offers from us.

Information collected automatically

• Identifiers. An account identifier that we create when you first open Ripn, before you sign up (see "Starting without an account" below).
• Device and app details. Your device model and operating system, app version, language, region setting and time zone. If you allow it in your device settings, Apple or Google also share crash reports with us.
• Notification token. If you allow notifications, a push token for your device, with your device type and language, so we can send you notifications that come from our servers.
• Usage events. The screens you open and actions you take in Ripn, such as starting a scan, saving a receipt or opening the paywall. See section 9 for when this runs and how to turn it off.
• Advertising measurement events. If you allow it, a small number of events (such as opening Ripn for the first time, saving a first receipt, starting a trial or subscribing, with the price and currency) and your device's advertising ID. See section 9.
• Subscription status. Whether you have a subscription, which plan, its renewal and expiry dates, and trial status. We receive this from Apple or Google through our subscription provider. We never receive your payment card details.
• Technical data. Our providers process your IP address when your device connects to them. It can indicate your approximate location (city or region). We don't use it to track where you are.

Information from other people and companies

• Apple and Google, when you sign in with them (your name and email, depending on what you choose to share).
• Apple App Store and Google Play, for your subscription status.
• Members of your household, whose receipts and spending become visible to you when you share a household (see section 6).

Starting without an account

You can start using Ripn without signing up. When you first open the app, we create an anonymous account so the receipts you scan can be saved. If you later sign up, everything moves into your new account. If you never sign up and don't open Ripn for 12 months, we delete the anonymous account and its data.

What is required and what is optional

To scan receipts, Ripn needs the receipt images and your permission to have them read by AI. To subscribe, join a household or use Ripn on more than one device, you need to sign up with an email address (or Apple or Google). Everything else is optional: notifications, product analytics, advertising measurement, marketing emails and a household display name. Saying no to an optional item never stops you from using Ripn or from buying a plan.

What we don't collect

We don't collect your precise location, your contacts, your photo library (only the receipt images you pick), your microphone, or your browsing history. We don't ask for health information. Receipts can still list things like medicine. Ripn treats them as ordinary line items, and we never use them to draw conclusions about your health.

3. How we use your information and why

We use personal information only for the purposes below. For users in the European Union, the United Kingdom, Brazil and other places that require it, we also list the legal basis we rely on.

When we rely on legitimate interests, these are our interests: for usage analytics, understanding how Ripn is used so we can fix problems and improve it; for scan improvement and anonymized statistics, making Ripn read receipts accurately and understanding grocery prices; for security, protecting accounts and keeping Ripn working; for legal matters, defending our rights. We have weighed each one against your rights, and you can object at any time (section 11).

If we want to use your information for a new purpose that isn't compatible with the ones above, we will tell you first and, where the law requires it, ask for your consent.

Automated processing. Ripn uses automated processing to read receipts, sort items into categories and estimate expiry dates. These results only help you track your groceries. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

4. How receipt scanning works

When you scan a receipt, Ripn sends the image, screenshot or PDF to our server. Our server sends it to Anthropic, the company that makes the Claude AI models, which reads the text and returns the items, prices, store and date. We also send item names to Anthropic to help match them to foods and categories.

• We ask first. Before your first receipt is sent, Ripn asks for your permission to share receipts with Anthropic. You can withdraw that permission at any time in Settings. Without it, Ripn can't read receipts for you.
• Anthropic works for us. Anthropic processes receipts on our behalf, under a data processing agreement, to return the result to us.
• No training. Anthropic does not use the receipts we send, or the results it returns, to train its AI models.
• How long Anthropic keeps it. Anthropic deletes what we send and what it returns within 30 days. It may keep content that its automated safety systems flag for up to 2 years to enforce its usage policy, and longer where the law requires it.
• Where. Anthropic may process receipts in the United States and other countries.

We store the receipt image itself in a private storage area. Only your account can see it and, if you share a household, its members. Access by our team is limited to what's needed for support, security or legal reasons. We keep the image so you can check a figure against the receipt it came from. We also keep the complete structured result returned for each receipt (its items, prices, quantities, totals, store and date), so a scan can be corrected or read again later without asking you to retake the photo.

Please don't scan documents other than receipts and order confirmations. If you'd rather not keep a loyalty number or card digits in your photos, cover them before scanning. Ripn doesn't need them.

5. How we use receipts to improve Ripn

We use what we learn from scanning to make Ripn read receipts better. Here is exactly what that means.

What we do, as part of running Ripn:

• Measure how accurately Ripn reads receipts, for example how often an item or price had to be corrected.
• Look at a receipt you report to us, or one you send to support, to fix the problem.
• Improve the instructions and rules Ripn uses to read receipts and sort items, using line-item text from which we have removed your account identifier, names, card and loyalty numbers, and anything else that directly identifies you. Only a small number of authorized people can see this data, and we delete it after 12 months.
• Create anonymized statistics, such as the average price of a product across many receipts in a region and month. Anonymized statistics combine data from many people, follow rules that prevent them from being traced back to anyone (for example a minimum number of people behind each figure), and can't reasonably be used to identify you. We may use them in Ripn and may publish or share them.

What we don't do without asking you first:

• Use your receipts or receipt photos to train or fine-tune an AI model.
• Have a person look at your receipt photos, except when you ask us to, when you report a problem with a receipt, or when we must for security or legal reasons.
• Sell your receipts, or share them or other data that could identify you, except as described in section 7.

If you are in the European Union, the United Kingdom or Brazil, you can object to the improvement uses in this section by writing to team@ripn.app.

6. Households

If you create or join a household, your receipts, the items on them, your receipt photos and your spending become visible to every other member, and theirs become visible to you. The name of the person who scanned each receipt is shown next to it. Members can also receive notifications about the household, such as when someone adds a receipt, and monthly summaries that compare members' spending and waste.

Receipts stay with the household so its totals stay correct. If you leave or are removed, the receipts you scanned while you were a member stay visible to the remaining members, and you no longer have access to them. If you join a household, the receipts already in your account move into it.

You stay in control of what identifies you:

• If you leave or are removed, you can ask us at team@ripn.app to delete the photos of the receipts you scanned and remove your name from them.
• If you delete your account, every receipt you scanned is deleted with its photo and its items, including the ones in a household you share or used to share. If you own a household that still has other members, the member who joined first becomes its owner.

Joining is always your choice. You can leave at any time in Settings, under Household, and the household's owner can remove members at any time. Please only invite people you trust with your grocery data.

7. Who we share information with

We don't sell your personal information. We share it only as described here.

Service providers. These companies process information on our behalf, under contracts that require them to protect it and to use it only to provide their service to us:

Other companies that receive information for their own services. Their own privacy policies apply:

• Apple and Google, when you sign in with them, when you buy a subscription through the App Store or Google Play (they handle the payment and refunds), and when they deliver push notifications.
• Google (Firebase Analytics and Google Ads), which receives the advertising measurement events described in section 9, only if you allow it, and Google Analytics data from our website (section 10). We have turned off ads personalization for this data.
• TikTok (TikTok for Business), which receives the advertising measurement events described in section 9, only if you allow it, so we can count which of our TikTok ads lead to installs.

Your household. As described in section 6.

When you ask us to. For example, when you share a spending card to another app, it goes wherever you send it.

For legal reasons. When we believe in good faith that the law requires it, such as a valid court order, or to protect the rights, safety and property of our users, the public or MN8.

If our business changes. If MN8 is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred to the party involved, which will remain bound by this Policy or one that is just as protective. Where the law requires it, we will notify you first.

8. International transfers

MN8 is based in Canada, and most of our providers store or process information in the United States, with some processing in other countries (see section 7). When your information is outside your province or country, it can be accessed by the courts, law enforcement and national security authorities of those countries.

We protect transferred information with contracts that require the same level of protection as this Policy. Before communicating personal information outside Quebec, we assess the privacy risks, as Quebec law requires. For transfers from the European Union and the United Kingdom, we rely on the European Commission's Standard Contractual Clauses and the UK equivalents, or on the EU-US Data Privacy Framework where the provider is certified. For transfers from Brazil, we rely on the standard contractual clauses approved by Brazil's National Data Protection Agency (ANPD). Our international transfer notice in Portuguese is at ripn.app/pt/transferencias. You can ask us for a copy of the relevant safeguards at team@ripn.app.

9. Analytics, advertising measurement and your choices

Product analytics (PostHog). We record usage events, such as which screens you open and when a scan starts, finishes or fails, linked to your account identifier but not to your name or email. We use them to understand how Ripn is used and to find problems.

• In Canada, the European Economic Area, the United Kingdom and Switzerland, product analytics stay off until you turn them on.
• Everywhere else, product analytics are on, and you can turn them off at any time in Settings, under Privacy.

Advertising measurement (Google Firebase Analytics, Google Ads and TikTok). When we run ads, we want to know which ones lead people to install Ripn and subscribe. Only if you allow it, Ripn sends Google and TikTok a small number of events (such as opening Ripn for the first time, saving a first receipt, starting a trial or subscribing, with the price and currency) and your device's advertising ID. We don't send them your name, email or receipts, and we have turned off ads personalization for the data Google receives. On iPhone, we ask through Apple's tracking permission prompt. On Android, we ask in the app. You can change your mind at any time in Settings, under Privacy, and you can reset or delete your advertising ID in your device settings.

Session recordings. We do not record your screen.

Notifications. Ripn schedules expiry reminders and check-ins on your device. Notifications from our servers, such as household activity, monthly summaries and trial reminders, use your push token. You can turn notifications off in Settings, under Notifications, or in your device settings.

10. Our website and cookies

On ripn.app, we collect:

• what you send through the support form (your email, the topic, your message and your browser's user agent);
• your email address, the link that brought you there and your browser's user agent if you join a waitlist;
• analytics about visits, through Google Analytics, which uses cookies and similar technologies to record pages viewed, clicks, the referring site and device information.

In Canada, the European Economic Area, the United Kingdom and Switzerland, website analytics only run after you accept them in our cookie notice. You can change your choice at any time from the "Cookie settings" link at the bottom of every page. Strictly necessary cookies, such as the one that remembers your cookie choice, don't need consent.

11. Your rights and how to use them

Depending on where you live, you have some or all of these rights:

• Access. Ask what personal information we hold about you, how we use it, who can see it and how long we keep it, and get a copy.
• Correction. Fix information that is wrong or incomplete. You can edit most of your data directly in Ripn.
• Portability. Get the information you gave us in a structured, commonly used format. You can export your receipts and items as a spreadsheet in Settings, under Your data, or ask us for a full copy.
• Deletion. Delete your account and its data in Settings, under Account, or request it at ripn.app/delete-account.
• Withdraw consent. Turn off AI receipt reading, analytics, advertising measurement, notifications or marketing emails at any time. Withdrawing doesn't affect what we did before.
• Object or restrict. In the European Union, the United Kingdom and Brazil, object to processing based on legitimate interests or ask us to restrict processing.
• De-indexing and cessation of dissemination. In Quebec, ask us to stop disseminating your information or to de-index any link to it, where the law allows.
• Information about automated processing. Ask how automated results about you were produced.
• Complain. Contact a privacy regulator (section 16). We'd appreciate the chance to fix things first.

To make a request, write to team@ripn.app from the email on your account, or use ripn.app/delete-account for deletion. We may need to confirm your identity before acting. We answer within 30 days, or sooner where your local law requires it. If we can't do what you ask, we'll tell you why and how to complain. Using your rights is free, and we won't treat you differently for using them.

Emails. Every marketing email has an unsubscribe link, and we act on it within 10 business days. Unsubscribing doesn't affect your account. We'll still send service emails about your account, security and subscription.

12. How long we keep information

We may keep information longer if the law requires it, or to resolve a dispute or enforce our Terms, and only for as long as needed. Anonymized statistics (section 5) can't reasonably identify anyone and may be kept.

13. How we protect information

We use administrative, technical and physical safeguards suited to the sensitivity of the information. These include encryption in transit, encryption at rest by our hosting providers, database rules that limit each account's data to that account and its household, private storage with short-lived links for receipt photos, and access to personal information limited to people who need it. No system is perfectly secure. If a confidentiality incident creates a risk of serious harm, we will notify you and the regulators as the law requires, and we keep a register of incidents.

14. Children

Ripn is not intended for children. You must be at least 16 to use it. We don't knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, write to team@ripn.app and we will delete it.

15. Changes to this Policy

We'll update this Policy when our practices change. We'll change the date at the top, and for important changes we'll tell you in the app or by email before they take effect. Where a change requires your consent, we'll ask for it. Earlier versions are available on request.

16. Contact and regulators

MN8 Technologies Inc., Attention: Privacy Officer
390 Grosvenor Avenue, Westmount, Quebec H3Z 2M2, Canada
team@ripn.app

If you're not satisfied with our answer, you can contact your privacy regulator, for example:

• Quebec: Commission d'accès à l'information du Québec (cai.gouv.qc.ca)
• Canada: Office of the Privacy Commissioner of Canada (priv.gc.ca)
• European Union: the data protection authority in your country, such as the CNIL in France (cnil.fr) or the CNPD in Portugal (cnpd.pt)
• United Kingdom: Information Commissioner's Office (ico.org.uk)
• Brazil: Agência Nacional de Proteção de Dados (gov.br/anpd)

17. Additional information for some regions

United States. We don't sell personal information. The advertising measurement described in section 9 may count as "sharing" for targeted advertising under some state laws. It only runs if you allow it, and you can turn it off at any time in Settings, under Privacy. If your state gives you privacy rights (for example California, Colorado, Connecticut, Virginia or Texas), you can use the rights in section 11 by writing to team@ripn.app, and you can appeal a refusal by replying to our answer. We don't use receipt data to infer health conditions or other sensitive characteristics about you.

Brazil. You have the rights listed in article 18 of the LGPD: confirmation that we process your data; access; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data or data processed against the law; portability; deletion of data processed with your consent; information about the public and private entities we share data with; information about the possibility of not giving consent and what happens if you don't; and revocation of consent.