Effective October 15, 2026
Egg Money is made by its two founders, in St. Louis, Missouri. Our company is being formed; once it is, this policy will name it. This policy covers the Egg Money app and the website at geteggmoney.com.
The short version
- The app reads photos of your grocery receipts and shows what store brands saved you.
- To read a photo we send it to Anthropic, the company that makes the AI model Claude. The app asks for your agreement first.
- We keep your email address, your ZIP code, your receipts and what was read from them.
- We show no ads. We do not track you across other apps or websites.
- The app does not connect to your bank, and it does not hold, move or invest money.
- You can delete a receipt, or your whole account, at any time. Deleting your account removes your account, your receipts and your photos.
What we collect
When you create an account
- Your email address. Each time you sign in, we send a six-digit code to it. There is no password. While the test is by invitation, we send a code only to an address we have invited or that already has an account. Once an address has an account, it is sent codes until the account is deleted, even if we remove its invitation.
- Your ZIP code. It decides which store's prices your purchases are compared with, and it is recorded with each receipt it was used for. You can change it once every 90 days.
When you scan a receipt
- The photos you take or choose, up to four for each receipt.
- What is read from them: the store and its location, the date and time, the items as printed, their prices and quantities, and the totals.
- Any corrections you make to what was read, and your answer when the app asks whether two receipts are the same one.
A receipt can also show things we do not need, such as the last digits of a payment card or a loyalty number. We instruct the reader not to record these, and we do not use them. They are still visible in the photo itself, which is stored and is sent for reading.
Records the service keeps about your account
- An account number that the service gives your account.
- When you agreed to have receipts read by AI, which wording you agreed to, and when you withdrew that agreement, if you did. Each receipt also records which wording was in force when its photos were sent.
- A record of each sign-in code we send you, with your email address. A code works for 10 minutes; its record is kept for 48 hours.
- Each failed attempt to sign in, kept as a scrambled code made from your email address, for 48 hours.
- Your signed-in sessions. A session lasts 90 days, and its record is kept for 30 days after it ends or you sign out.
- When you started each receipt and each upload of photos, kept for 48 hours to apply the daily limit on receipts.
If someone asks for a code for an address we have not invited, we send nothing. The service keeps that address, with a code nobody can use, for an hour or two, so that it answers every address in the same way.
If you apply to be a tester on our website
We collect what you enter in the form:
- your first name, your email address, and a mobile number if you give one;
- your ZIP code;
- which phone you use, and your Google Account email if you use Android;
- the grocery store you shop at most, as you name it, how often you shop there, whether you take a paper receipt, and whether you buy mostly store brands or name brands;
- who you shop for, and your age range;
- whether you have an investment or retirement account, if you choose to say;
- whether you know either of us;
- whether you would do the closer test;
- your confirmation that you are 18 or older and have read this policy, and which version of the policy it was.
We also record when you applied, and whether the test is a fit for you. We use all of this to choose testers and to contact you about the test.
We keep an application for 180 days and then delete it automatically. You can ask us to delete it sooner. If you later make an account in the app with the same email address, deleting that account deletes the application too.
We also note which of our links brought you to the form, from a short code in the link. We do not record the page you came from, or anything else about how you arrived.
If the test is not a fit for you, for example because you live outside the area, we keep only your first name, email address and ZIP code, the reason, the link code if your link had one, which version of this policy you saw, and when you applied, so that we can write to you if the test widens. We do not keep your other answers.
If two applications arrive for the same email address, the first one stands and its answers are not changed. A later, different one is only flagged for us to look at.
For each application the server also makes two scrambled codes: one from the internet address it came from, and one from that address and the email address together. We use them only to limit how often one source can apply, and delete them after 48 hours. We keep the codes, not the internet address itself.
The website sets no cookies and loads nothing from other companies. For the visit only, your browser holds the link code, and, once your application has gone through, your first name, so that the next page can greet you. That page clears both, and they are gone when you close the tab.
The form sends nothing to the email address entered. Any message after that is one we write ourselves: an invitation to the test, or a note that it is not for you yet. If you get one and did not apply, tell us at [email protected] and we will delete the application.
If you email us to join the test
While the sign-up form is closed, you can ask to join the test by writing to [email protected] with your first name and ZIP code. We keep your email address and what you write as an application: we use it only to choose testers and to write to you about the test, and we delete it after 180 days, or sooner if you ask.
If we invite you to the test
We add your email address to the list of addresses the service will send a sign-in code to. The list holds a scrambled code made from each address, not the address itself. Your invitation is removed when you delete your account, or when we remove it.
Your internet address
When you ask for a sign-in code, enter one, or send an application on our website, our service reads the internet address the request comes from, to limit how often one address can try. It writes down only a scrambled code made from the address, never the address itself, and deletes that code after 24 hours for sign-in and 48 hours for an application. Its logs can show the first few characters of such a code. The address itself is held only in the running service's memory: at least ten minutes, until the next request to sign in or apply after that, or until the service restarts. For everything else the app does, our service does not read your internet address, and we never use one to work out where you are. The companies that host our service and our website may log it, as hosting companies do.
What stays on your phone
- A key that keeps you signed in, held in your phone's secure storage. On an iPhone it can stay there after the app is deleted; a new copy of the app removes it before it is used.
- Copies of photos the app prepared for upload. They sit in the app's temporary storage until your phone clears it.
What we do not collect
- Bank account or payment card details.
- Your phone's location. The app does not ask for it, and we never use an internet address to work out where you are. The only location information we hold is the ZIP code you type and the store named on each receipt.
- Your contacts, or any photo other than the receipt photos you choose.
How your receipts are read
Reading a receipt photo is done by Claude, an AI model made by Anthropic, another company. Our service sends Anthropic the photos and everything printed on them, and Anthropic sends back a list of what it read. Nothing else about you is sent: not your email address, your ZIP code or your account number.
Before your first receipt, the app asks whether you agree to this. If you do not agree, the app cannot read receipts.
You can withdraw your agreement at any time: in Settings, under "Receipt reading by AI", choose "Withdraw agreement". After that, no new photo is sent. A read already under way cannot be recalled, because the photo has already been sent, but its result is thrown away.
For reading, photos are sent to Anthropic and to nobody else.
Anthropic says it deletes what it receives this way within 30 days, apart from limited exceptions it describes, and that it does not use it to train its models.
What we use it for
- To show you what you saved, item by item and over time.
- To keep our price list current. The prices on your receipts, together with other people's, tell us what products cost.
- To learn what the short item names printed on receipts mean. One of us approves these from a list of printed names. The list shows how many receipts and people showed each name, not who they are, and not your photos.
- To send your sign-in code.
- To prevent abuse, for example by limiting sign-in attempts, how often one internet address can ask for codes or apply, and the number of receipts an account can scan in a day.
- To find out why a receipt was read wrongly, when you ask us for help with it or when receipts are being read wrongly. One of us may look at its photos, and may have them read again by Anthropic's Claude, to compare its reading with the receipt and test how well receipts are read (see "How we protect it").
- To measure whether the app is useful. We count things such as how many people scan a second receipt, worked out from the receipts in each account.
We do not use your information for advertising.
Who else handles it
We do not share it with advertisers.
These companies handle it for us, on our instructions:
- Anthropic, which reads receipt photos.
- Render, which runs our service and its database, in Ohio, in the United States.
- Amazon Web Services, which stores the photos (Amazon S3) and delivers sign-in codes (Amazon SES), from its US East (Ohio) region.
- Cloudflare, which serves this website and forwards email sent to [email protected] to our own mailbox.
Apple and Google deliver the test app, under their own privacy terms:
- On an iPhone the test app comes through Apple's TestFlight. If you send feedback from TestFlight, Apple passes us your comments, any screenshots, and details of your phone, such as its model and system version, with your email address if we invited you by email or you enter it. If the app crashes, Apple can pass us a report of the crash.
- On Android the test app will come through Google Play's closed testing. We give Google the Google Account email you entered on our form, only to add it to the list of people allowed to install the test app. Google Play can pass us reports of crashes, and feedback you send through it.
We use what Apple and Google pass us to find and fix problems in the app.
Our mailbox is a Gmail account, which Google holds under its own terms. Emails we exchange with you are kept there (see "How long we keep it").
We may also disclose information when the law or legal process requires it, for example a valid court order, or when it is needed to protect the safety or rights of our users or others, or to stop fraud or abuse.
If Egg Money or its company is sold or merges with another, your information may pass to the new owner as part of it. We will tell you before it is used under a different policy.
How long we keep it
| What | How long |
|---|---|
| Your account, and your record of agreement to AI reading | Until you delete your account |
| Receipts, what was read from them, and their photos | Until you delete the receipt or your account |
| Photos of receipts that were rejected, were duplicates, or could not be read | 30 days after the receipt was last read. The rest of such a receipt stays until you delete it or your account |
| Photos uploaded but never submitted | About a day |
| A sign-in code | It works for 10 minutes. Its record is kept 48 hours, or an hour or two if it was never sent |
| A failed sign-in attempt | 48 hours |
| A signed-in session | It lasts 90 days. Its record is kept 30 days after it ends |
| When you started receipts and uploads | 48 hours |
| The scrambled codes made from an internet address | 24 hours for sign-in, 48 hours for an application |
| An invitation to the test | Until you delete your account, or we remove it |
| Emails we exchange with you | A request to join and our replies: 180 days, like an application. Others: until they are no longer needed for the test, or sooner if you ask. A request to delete your account is kept as the record that we did |
| An application to be a tester | 180 days, then deleted automatically. Sooner if you ask, or if you delete an account made with the same email address |
| Our service's logs | 7 days |
| Backups of our database | 3 days |
Your choices
- See it. Every receipt you have scanned, and what was read from it, is in the app.
- Correct it. You can correct any line the reader got wrong.
- Delete a receipt. This removes the receipt, its photos, what was read from them, and the prices it added to our price list.
- Withdraw your agreement to AI reading. The app stops reading receipts until you agree again.
- Delete your account, in the app (Settings, then "Delete account") or at https://geteggmoney.com/delete-account/.
Deleting your account removes, from our database and our photo storage, your account record and email address, your sessions and sign-in records, your invitation to the test, your tester application if you made it with the same email address, your receipts and everything read from them, your photos, your record of agreement, and the prices your receipts added to our price list. Nothing about you or your purchases is kept there. The same email address can be used again, and starts empty; while the test is by invitation, it needs a new invitation first.
What remains after deletion:
- Printed item names, such as which product a store's abbreviation stands for, once a person has approved or turned one down, or while it is on someone else's receipt too. They are facts about products and name nobody.
- A copy of a receipt's photos and what was read from them, that one of us took to look into a misread (see "How we protect it"), until we delete it: at the latest 30 days after we took it.
- A note of each receipt reading the whole service made, with its time and nothing that identifies anyone, kept for 48 hours to cap how many receipts the service reads in a day.
- The scrambled codes that limit how often one internet address can sign in or apply, which name no account: 24 hours for sign-in, and 48 hours for an application, where one of its two codes is made from your email address together with the internet address.
- Our service's logs. They never hold your email address. They can hold the internal number of your account, for 7 days.
- Our email provider's own records: of the sign-in emails it delivered to your address, and, if a message to your address bounced or was reported as spam, your address on its list of addresses not to send to. They are kept for as long as that provider keeps them.
- Backups of our database, for 3 days.
- The emails we exchanged with you, in our mailbox: deleted when you ask, except a request to delete your account, which we keep as the record that we did.
Deleting your account removes what our service holds. It does not remove anything kept on your own phone.
Depending on where you live, the law may give you further rights over your information, such as to see or correct it. To use any of them, write to us at [email protected].
How we protect it
- Connections between the app and our service are encrypted, and so is our service's connection to its database.
- Photos are stored encrypted, in storage that is closed to the public.
- In the app, a photo is shown only to the signed-in account that uploaded it. There is no web link to a photo.
- The two of us can see a receipt's photos when you ask us for help with that receipt, or to find out why receipts were read wrongly. A copy we take for that, of the photos and what was read from them, is kept on our own computers, shared with nobody except Anthropic for reading it again, and deleted when we are done: at the latest 30 days after we took it.
No way of storing or sending information is perfectly secure. If we learn of a breach that affects your information, we will tell you promptly, as the law requires, and say what we are doing about it.
Children
Egg Money is for adults. It is not meant for anyone under 18, and we do not knowingly collect information from them.
Changes to this policy
If we change this policy, we will post the new version here and change the date at the top. If a change matters to what we do with information we already hold, we will tell you by email or in the app before it applies. If we change what you agreed to about AI reading, the app asks you again before it reads another receipt.
We do not track you across other apps or websites, so the app and the website do nothing different when a browser sends a Do Not Track signal.
Contact
Egg Money's founders, St. Louis, Missouri