ReceiptWala — Privacy Policy

Effective date: 2026-10-04 Last updated: 2026-10-04

1. Who we are

ReceiptWala is operated by Neobplan, a company incorporated under the laws of the Republic of Korea ("ReceiptWala", "we", "us"). ReceiptWala is a receipt and expense management app for Android, published for users in India. This Privacy Policy explains what personal data we process, why, where it is stored, and the choices and rights you have. It is written to meet the transparency obligations of India's Digital Personal Data Protection Act, 2023 (DPDP Act).

By installing or using ReceiptWala you agree to this Policy. If you do not agree, please do not use the app.

2. Our core privacy principle

Your receipts stay on your device. ReceiptWala is local-first: you can capture, scan, organise and review receipts fully without creating an account. Receipt images, the text extracted from them by on-device OCR, and the GST fields we parse (GSTIN, HSN code, tax rate, totals) are stored only in the app's local database on your device.

We never upload your receipt images or their contents to ReceiptWala servers. The only place a copy of your receipts can leave your device is your own Google Drive, and only if you explicitly turn on backup (see §4.2).

3. When you can use the app without giving us any data

If you never sign in and never enable Drive backup, ReceiptWala does not transmit any personal data to us or to third parties, other than crash diagnostics (§4.5). Account, backup, and subscription features are optional.

4. What data we process, and where

4.1 On-device data (not transmitted to us)

Receipt images you capture or import.
OCR text and extracted fields (merchant, date, amount, GSTIN, HSN, tax rate, category).
Your in-app settings and monthly usage counters.

This data is held in the app's local storage and is removed when you delete the receipts or uninstall the app.

4.2 Backup to your own Google Drive (optional)

If you enable backup, ReceiptWala writes copies of your receipts (JSON + images) into a ReceiptWala-Backups folder in your Google Drive account. We request the narrow, per-file drive.file scope, which allows the app to see and manage only the files it creates. We cannot see the rest of your Drive. These files are governed by Google's privacy terms and are under your control.

ReceiptWala's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4.3 Account data (only if you sign in)

If you create an account (phone OTP, Google Sign-In, or email/password), we process:

Authentication identifiers — email address, phone number, and a Firebase user ID (UID), handled by Firebase Authentication.
Profile record — your name, email address and phone number as provided by the sign-in method you chose (each only if that method supplies it), the sign-in method, app locale, account creation time, the time you last used the app while signed in, and the timestamps at which you accepted this Policy and the Terms of Service. Stored in Cloud Firestore in the asia-south2 (Delhi, India) region.

4.4 Subscription data (only if you purchase Premium)

If you buy a Premium subscription, Google Play processes the payment. You can buy and use Premium without an account: the app reads your entitlement from Google Play on your device. If you are signed in, we also process the purchase token and subscription status to verify the purchase server-side, and store the product, purchase token, status and expiry time in Cloud Firestore (asia-south2). We do not receive or store your card or payment-instrument details.

4.5 Crash diagnostics

To keep the app stable we collect crash reports through Firebase Crashlytics. Crash reports are not linked to your account or to your receipts — the app explicitly clears the Crashlytics user identifier. They do contain technical information such as the device model, operating system version, a Crashlytics installation identifier, and the state of the app at the time of the crash. We operate no advertising or analytics pipeline of any kind.

4.6 Device permissions

Camera — to photograph receipts. Images are processed on-device.
Network / Wi-Fi state — for sign-in, Drive backup, and subscriptions.
Notifications — for backup status messages.

5. Why we process this data

Purpose	Data used
Provide core receipt scanning and storage	On-device data (§4.1)
Optional cloud backup and restore	Drive data (§4.2)
Create and operate your account	Account data (§4.3)
Deliver and verify Premium subscriptions	Subscription data (§4.4)
Keep the app stable	Crash diagnostics (§4.5)

We rely on your consent (collected in-app before sign-in) and on the necessity of processing to provide the features you request.

6. Third-party services

Google / Firebase — Authentication, Firestore, Cloud Functions, Crashlytics, Google Play Billing, and Google Drive API.

These providers process data under their own privacy terms. We do not sell your personal data, and we do not share it for advertising.

7. Cross-border transfer

Your profile, consent, and subscription records are stored in India (Cloud Firestore in asia-south2 / Delhi; Cloud Functions in asia-south1 / Mumbai). Receipt images and their contents are never transmitted to us (§2), so they form no part of any transfer.

Firebase Authentication does not support region selection. Your authentication identifiers (email, phone number, UID) are therefore stored on Google's global infrastructure, which may be located outside India. We process them only to provide the sign-in service you request. By creating an account you acknowledge this transfer.

8. Your rights under the DPDP Act

You may:

Access your data — view your stored receipts and account data in the app.
Correct your data — edit receipt fields and profile information in the app.
Erase your data — delete individual receipts at any time, or delete your account, after which the records we hold are deleted immediately and in no case later than 30 days (see the account deletion page).
Port your data — export your receipts as CSV or PDF from within the app. If you use Drive backup, your receipts are also stored in your own Google Drive as JSON files and images that you can open directly.
Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity. Write to cowboy75@neo-b.net.
Withdraw consent and raise a grievance — see §13.

9. Data retention

On-device data is retained until you delete it or uninstall the app.
Account, consent, and subscription records are retained while your account is active.
If an account is inactive (no sign-in) for 2 years, we send an email warning and delete the associated data 30 days later.
On account deletion, the records we hold are deleted immediately and in no case later than 30 days.

10. Children

ReceiptWala is intended for adults and is not directed at anyone below the age of eighteen, which is the age at which a person ceases to be a child under the DPDP Act. We do not knowingly process the personal data of a child, and we operate no tracking, behavioural monitoring, or advertising of any kind. If we learn that we hold a child's data without verifiable consent from a parent or lawful guardian, we delete that data and the associated account promptly. Write to cowboy75@neo-b.net if you believe a child has created an account.

11. Security

Data in transit is encrypted using TLS. Server-side data is protected by Firebase access controls. On-device data is protected by Android's app sandbox. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

12. If a personal data breach occurs

If we become aware of a breach of your personal data, we will notify you without delay, with a plain-language description of what happened, the data affected, the steps you can take, and how to contact us. We will also report the breach to the Data Protection Board of India within the timelines required by the DPDP Act and the rules made under it.

13. Contact and grievance redressal

For privacy questions, to exercise your rights, or to raise a grievance under the DPDP Act, contact our Grievance Officer:

Grievance Officer (DPDP Act): cowboy75@neo-b.net
General support: support@neo-b.net

We acknowledge grievances within 3 working days and aim to resolve them within 30 days. If you are not satisfied with our response, or if we do not respond within that period, you may lodge a complaint with the Data Protection Board of India.

14. Changes to this Policy

We may update this Policy. Material changes will be notified in the app or by email. The "Last updated" date above reflects the current version.

15. Languages

This Policy is published in English. On request to support@neo-b.net we will provide it in any language specified in the Eighth Schedule to the Constitution of India.