TillSave

DRAFT FOR REVIEW — this is a plain-English working draft. It has not yet had legal review and items marked [TBC] must be confirmed before launch.

Privacy policy

Last updated: 12 July 2026 (draft)

TillSave turns photographs of your supermarket receipts into spending insight, meal plans, price comparisons and shopping lists. Receipts say a lot about a household — what you eat, who lives with you, roughly what you earn. We treat that data accordingly. This policy explains what we collect, why, and what control you have, under UK GDPR and the Data Protection Act 2018.

Who we are

TillSave is operated by [legal entity name, company number and registered address — TBC]. For anything in this policy, contact [privacy contact email — TBC].

What we collect

  • Account details. Your email address and sign-in method (email, Apple or Google).
  • Receipt photos. Used once, to read the receipt. Originals are automatically deleted after 30 days at the latest.
  • Structured shopping data. The items, prices, stores, dates and loyalty savings read from your receipts. This is what powers the app.
  • Household profile. What you tell us for meal planning: number of adults and children, dietary notes, days between shops, and which loyalty schemes you hold.
  • Subscription status. Whether you have an active trial or subscription, synced from the App Store or Google Play via RevenueCat. We never see your card details.

What we deliberately do not collect or keep

  • Payment card numbers and loyalty card numbers. Fragments printed on receipts are stripped out at the moment the receipt is read and are never stored.
  • Bank account access. TillSave never connects to your bank.
  • Advertising or tracking data. The app ships with no advertising or third-party analytics trackers.

Why we use your data (lawful basis)

We process your data to provide the service you signed up for — the lawful basis is performance of a contract. Anything beyond that (for example, a product update email you can opt out of) relies on consent, asked for separately and withdrawable at any time. We do not sell your data, and we do not share it for advertising.

Who processes data on our behalf

  • Amazon Web Services hosts our infrastructure and storage, in [UK/EU region — confirm before launch].
  • Anthropic processes receipt images and shopping data to read receipts and generate meal plans, as a processor under contract.
  • RevenueCat manages subscription entitlements alongside Apple and Google billing.

All processors act under data-processing agreements. A full list is available on request.

How long we keep things

  • Receipt photos: deleted automatically after 30 days at the latest.
  • Structured shopping data and your profile: kept while your account exists, deleted when you delete your account.
  • Anonymised price observations (a price seen for a product at a store, with nothing identifying you) may be retained to keep price comparisons accurate.

Your rights

You can, at any time and free of charge:

  • Export your data as a file from Settings, whether or not you subscribe.
  • Delete your account and all your data from Settings — one tap, no email required.
  • Ask us to correct anything, object to processing, or request a copy of what we hold.
  • Complain to the Information Commissioner’s Office at ico.org.uk if you think we have got something wrong.

Security

Data is encrypted in transit and at rest. Receipt images live in private storage accessible only through short-lived signed links. Access inside the system is scoped so that your household’s data is only ever readable by you.

Changes to this policy

If we change this policy in a way that matters, we will tell you in the app before the change takes effect. The latest version always lives at this address.