Privacy notice

Access and use. Gmail read-only permission covers messages and settings across the authorized mailbox—not just receipts. The receipt workflow reads mailbox identity, message-history identifiers and sender metadata, including metadata for unrelated messages discovered through history. It downloads complete messages from configured receipt senders and extracts supported receipt HTML. Raw messages can contain attachments and payment-source details; attachment parts are excluded from receipt parsing.

Storage. Raw email is processed in memory rather than saved by the inspected receipt importer. Retained records include structured receipt proofs, recipient, amount, currency, dates, status, transaction reference, memo, Gmail and owner/property/booking identifiers, processing outcomes and integrity hashes. Memos may contain guest names.

Current versus planned processing. The original desktop implementation processes receipts locally, uses Google for Gmail/OAuth, and stores receipt journals and ledger records on the dashboard machine. Planned Cloudflare receipt processing would run on Cloudflare Workers, with structured journals/events in D1 and sanitized proofs in private object storage. This cloud receipt capability is not represented as active.

Access and logs. Administrators access operational records; authorized owners receive summaries scoped to their corresponding records. Application status/audit records include processing states, identifiers, reasons, counts and timestamps. Revoking Gmail access does not delete existing receipt records or any separately retained exports or backups

Retention and control. The inspected implementation has no automatic record expiry or self-service deletion. Removing Google access prevents further authorized Gmail access but does not delete retained receipt, journal or ledger records. Contact brettlarkllc@gmail.com for deletion review; this is not a promise of an implemented deletion function or deadline.