1. Who is responsible
The data controller for your account and household data is the Operator of PennyKept (trading as PennyKept, an independently operated sole proprietorship), reachable at hello@pennykept.com. Registered details are available on request.
When you buy a membership, our reseller and Merchant of Record, Paddle, collects your name, email address, country and postcode and your payment details as an independent data controller under the Paddle Buyer Privacy Notice (https://www.paddle.com/privacy-buyers). We never receive your full card details. Paddle shares with us only what is needed to fulfil your order and support you: your name, email, country and the plan you bought.
2. What we collect and why
Account data: your email address, a display name you choose, and sign-in events. Purpose: to run your account and keep it secure. Legal basis: performance of our contract with you.
Household data: products, quantities, dates, prices, shopping lists, savings records, and the receipt or packaging photos you choose to upload. Purpose: the Service itself. Legal basis: contract. Receipts can reveal sensitive things about a household; they are stored in private storage, readable only by members of that household with a role that permits it, and are never used for advertising or profiling.
Usage analytics: we record page views and a small set of in-app events (for example "receipt confirmed") with the page path, a coarse device type and a country derived from your IP address. We do not store IP addresses, do not use cookies for this, and the visitor identifier is rebuilt from a daily-changing hash so it cannot follow you across days. Product identifiers are removed before storage. Legal basis: our legitimate interest in operating and improving the Service. We honour the "Do Not Track" and "Global Privacy Control" browser signals.
Marketing: we send product news only if you opt in (in the app or at checkout). Every marketing email has an unsubscribe link. Transactional emails (sign-up confirmation, invitations, receipts, trial and renewal notices) are sent regardless because the Service needs them.
3. Who processes it for us
Supabase (database, authentication, private file storage; United States, East region). Netlify (website and server code). Resend (transactional email). Paddle (payments, as independent controller, above). Google (Gemini API) reads receipt images you choose to scan, solely to extract the text; images are not used to train models and are not retained by Google after processing under its API terms. Each processor acts under a data processing agreement.
The Operator is established outside the EU, UK and US. Where personal data of EU or UK residents is transferred, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum with each processor, and on equivalent safeguards for our own access, which is limited to support you request. The Service is not yet offered in the EU or UK; see section 7.
4. How long we keep it
Account and household data: for as long as your account exists. Receipt images: until you delete them or your account; you can delete any receipt from the app. Analytics: 13 months, then aggregated. Backups: up to 30 days after deletion. When you delete your account, personal data is removed within 30 days except where a record of a purchase must be kept for tax or legal reasons (Paddle keeps the invoice).
5. Sharing
Inside a household, members see household data according to their role; "limited" members never see prices or receipts. We do not sell personal data and do not share it with advertisers. We disclose data only to the processors above, to Paddle for billing, or where required by law.
6. Your rights
You can access and export everything (Settings > Your data), correct anything in the app, delete receipts, and delete your account. Depending on where you live you also have rights to restriction, objection, portability and to lodge a complaint with your supervisory authority; write to hello@pennykept.com and we respond within 30 days. For data Paddle holds about your purchase, contact privacy@paddle.com.
7. Where the Service is offered
PennyKept is currently offered to households in the United States, Canada and Australia. Residents of the EU, EEA, UK and Switzerland can join the waiting list; we will onboard them once our EU and UK representatives are appointed and this policy has been updated with their details.
8. Children
The Service is for people aged 16 and over. Child profiles inside a household are names chosen by the parent, with no login and no data collected from the child.
9. Cookies and local storage
We use a session cookie only to keep you signed in, and browser local storage to make the app open instantly and work with a weak connection. We set no advertising or third-party tracking cookies. Paddle's checkout sets its own cookies, described in its Buyer Privacy Notice.
10. Security
All traffic is encrypted; data is isolated per household by database-level row security; private files are served only through short-lived signed links; secrets never reach the browser. No system is perfectly secure; if we learn of a breach affecting you we will tell you without undue delay.
11. Changes
We post changes here and, for material changes, notify you in the app or by email. Last updated 12 October 2026.