Privacy Policy

We may collect the following categories of information:

• Account information: name, username, email address, profile image, authentication identifiers, and account creation details.
• Receipt and ledger information: receipt images or files, store names, purchase dates, product names, quantities, prices, taxes, discounts, refunds, fees, brand information, founding-year estimates, and the results of receipt analysis.
• Financial recordkeeping information: tax-year selections, personal or business classifications, allocation percentages, notes, correction reasons and timestamps, original and corrected values, immutable correction history, and generated reports or evidence packages. The Service is not an archival or tax-retention guarantee.
• Payment and subscription information: Helcim customer and subscription identifiers, plan status, billing period dates, checkout activity, and payment status. Historical processor references remain saved for recordkeeping. We do not store full payment-card numbers or CVVs.
• Optional financial account information: Bank linking, refreshes and transaction matching have been removed. Previously saved account identifiers and transaction details remain in your history. Removing this feature does not revoke earlier grants at the provider; contact support for help with existing access. We do not collect banking passwords, EBT card numbers or PINs.
• Receipt deadline and duplicate protection: New receipts must be submitted within 24 hours of the printed purchase time. Printed store details and purchase date/time remain private evidence for timezone interpretation and duplicate protection. We no longer capture sign-in network states or match receipt locations against IP addresses. Missing or ambiguous printed purchase times block counting. Historical location evidence is retained with saved records; removing the checks does not silently delete that history.
• Usage and technical information: device and browser information, approximate location derived from an IP address, pages viewed, feature interactions, referral information, timestamps, diagnostic logs, and cookie or similar technology data.
• Communications: information you provide when contacting us about privacy, support, or the Service.

We collect information directly from you when you create an account, upload a receipt, subscribe, connect an optional financial account, or contact us. We also collect information automatically through the Service and receive information from service providers such as Clerk and Helcim.

We use personal information to:

• Provide, operate, maintain, and secure the Service.
• Authenticate users and keep account information separated.
• Analyze receipts, calculate your grocery ledger, and provide optional financial recordkeeping and year-end downloads.
• Process subscriptions, trials, payments, and cancellations.
• Apply the 24-hour printed purchase-time deadline and duplicate protection. Preserve historical bank-matched records without new bank links, refreshes or transaction matching.
• Monitor performance, troubleshoot errors, prevent abuse, and improve features.
• Communicate about your account, transactions, security, policy changes, and support requests.
• Comply with law, enforce our terms, and protect users, the public, and our rights.

We use AI-assisted tools to read receipt content, identify products, extract financial line items, and estimate brand or company founding years. Receipt images and related text may be sent to our AI service provider for this purpose. Automated results may be incomplete or inaccurate. You are responsible for comparing them with the original receipt before relying on a ledger or report.

We do not use automated processing to make decisions that produce legal or similarly significant effects about you.

We disclose information only as needed to operate the Service, complete transactions, comply with law, or protect rights. Our principal service providers include:

• Clerk: account authentication, user profiles, email verification, and sessions.
• Helcim: secure card setup, subscriptions, payment processing, and billing management once the replacement billing plan is verified and opened.
• Replit: application hosting, infrastructure, databases, file storage, security logging, and website analytics.
• OpenAI: AI-assisted receipt and product analysis through Replit’s managed AI integration.

We may also disclose information to professional advisers, regulators, law enforcement, or parties to a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate safeguards.

We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising.

We and our service providers use cookies, local storage, and similar technologies to maintain secure sessions, remember preferences, recover unfinished uploads, measure website usage, and understand feature performance. Your browser may let you block or delete these technologies, but essential account and security features may stop working.

The Service uses privacy-focused website analytics provided through Replit’s publishing infrastructure. We use analytics to understand aggregate traffic and important product interactions, not to serve targeted advertising.

We retain information for as long as reasonably necessary to provide the Service, maintain your account, comply with legal and financial obligations, resolve disputes, prevent fraud, and enforce agreements. Retention periods vary by data type.

Receipt and ledger information is generally retained while your account is active. For financial recordkeeping, we preserve the originally captured values alongside an immutable correction history while the record remains in the Service; correcting a record does not overwrite its history. Abandoned uploads may be deleted automatically. Payment processors may retain records under their own legal obligations. Backup copies and logs may remain for a limited period after deletion. We may retain de-identified or aggregated information that can no longer reasonably identify you.

Cancelling a pending receipt does not delete it. You can separately request removal of a cancelled receipt from its details page. Eligible removals delete its saved items, financial data, and private attachment. We do not automatically remove receipts that counted years or have reviewed or business financial data or correction history. Receipts under a legal or dispute retention hold cannot be removed through self-service. Bank transaction records and other receipts are not deleted by this action. If removal is denied, contact privacy support for a review; private retention details are not shown in the app. If attachment deletion fails, the receipt stays available so you can retry. Backups and logs may persist for a limited period as described above.

Our retention practices are separate from any period for which a tax authority may require you to keep records. The Service is not an archival or tax-retention guarantee. You are responsible for downloading reports, keeping original receipts and other evidence, and determining the retention period that applies to you.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. These include authenticated access, encrypted network connections, access controls, user-scoped records, and established payment and authentication providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Do not put Social Security numbers, taxpayer-identification numbers, full payment-card or financial-account numbers, bank login credentials, or similarly sensitive details in receipt notes or annotations. The recordkeeping feature does not ask for this information.

Depending on where you live, you may have the right to request access to, correction of, deletion of, or a portable copy of your personal information. You may also have the right to object to or restrict certain processing and to appeal a denied request.

You can update certain profile and subscription details through the Service and request removal of eligible cancelled receipts from their details pages. For other privacy requests, email Privacy@ahcacy.com. We may need to verify your identity before completing a request. Some information may be exempt from deletion or retained where required by law.

California residents may have rights under the California Consumer Privacy Act, as amended, including rights to know, access, correct, delete, and obtain information about categories of personal information collected, sources, purposes, and recipients. California residents also have rights to opt out of sale or sharing and to limit certain uses of sensitive personal information.

We do not sell personal information or share it for cross-context behavioral advertising. We use sensitive financial information only to provide requested features, secure the Service, and meet legal obligations. We will not discriminate against you for exercising applicable privacy rights. You may submit a request at Privacy@ahcacy.com.

The Service is intended only for people who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided personal information, contact us so we can investigate and take appropriate action.

Ahcacy.com is operated from California, United States. Personal information may be processed in the United States and other locations where our service providers operate. Those locations may have data-protection laws different from those where you live.

We may update this Privacy Policy as the Service, our practices, or legal requirements change. We will post the revised policy and update the date above. If a change is material, we may provide additional notice through the Service or by email.

Questions or requests about this Privacy Policy may be sent to:

State flags are bundled with the app; viewing them does not contact an image host. These are the current official designs, including Mississippi’s Magnolia flag (2021), Minnesota’s flag (May 11, 2024) and Utah’s flag (March 9, 2024). The District of Columbia has its own flag. Original SVG images are preserved unchanged. Larger images use local 144×96 PNG display copies, scaled proportionally without cropping. Source pages describe each image’s authorship and reuse terms. Display does not imply government endorsement.

• Alabama (AL) — Steve Hall. Public domain. None; original SVG, scaled uncropped for display.
• Alaska (AK) — Benny Benson. Public domain. None; original SVG, scaled uncropped for display.
• Arizona (AZ) — Original: Unknown author Vector: Madden. Public domain. None; original SVG, scaled uncropped for display.
• Arkansas (AR) — Steve Hall / Open Clip Art Library. Public domain. None; original SVG, scaled uncropped for display.
• California (CA) — Original: Donald Graeme Kelley Vectorization: Devin Cook. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Colorado (CO) — Original: Andrew Carlyle Carson Vector: Fleminra. Public domain. None; original SVG, scaled uncropped for display.
• Connecticut (CT) — Jean-Pierre Demailly, xrmap authors, Commons users (SVG). Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Delaware (DE) — xrmap flag collection. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Florida (FL) — Template:Brendon Tiana. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Hawaii (HI) — Dbenbenn. Public domain. None; original SVG, scaled uncropped for display.
• Idaho (ID) — Paul B. Evans, based on a work by the Adjutant General of Idaho and Emma Edwards Green. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Illinois (IL) — Denelson83. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Indiana (IN) — The Indiana state flag was designed by Paul Hadley in 1917. This SVG file was made by Zscout370 with some modifications by HoosierMan1816.. Public domain. None; original SVG, scaled uncropped for display.
• Iowa (IA) — Xrmap flag collection. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Kansas (KS) — Xrmap. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Kentucky (KY) — Commonwealth of Kentucky. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Louisiana (LA) — Curtis Vann, Jr.. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Maine (ME) — Xrmap flag collection. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Maryland (MD) — Michael Wheeler. Public domain. None; original SVG, scaled uncropped for display.
• Massachusetts (MA) — State of Massachusetts. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Michigan (MI) — Xrmap flag collection. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Minnesota (MN) — Original: Minnesota State Emblems Redesign Commission Vector: Jamie Eilat, Undertiago. Public domain. None; original SVG, scaled uncropped for display.
• Mississippi (MS) — Rocky Vaughn, Sue Anna Joe, Dominique Pugh, Clay Moss, Kara Giles, Micah Whitson and the Mississippi Department of Archives and History. Copyrighted free use. None; original SVG, scaled uncropped for display.
• Missouri (MO) — Marie Watkins Oliver. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Montana (MT) — N.a. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Nebraska (NE) — Liamgabby79. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Nevada (NV) — Caleb Moore. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• New Hampshire (NH) — Xrmap flag collection. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• New Jersey (NJ) — author of xrmap, with modifications by Denelson83 and ChrisRuvolo. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• New Mexico (NM) — Open Clip Art Library; subsequent Commons contributors. Public domain. None; original SVG, scaled uncropped for display.
• New York (NY) — State of New York. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• North Carolina (NC) — Xrmap flag collection. Public domain. None; original SVG, scaled uncropped for display.
• North Dakota (ND) — Unknown authorUnknown author. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Ohio (OH) — John Eisenmann. Public domain. None; original SVG, scaled uncropped for display.
• Oklahoma (OK) — xrmap. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Oregon (OR) — User:Denelson83. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Pennsylvania (PA) — Simtropolitan; Jean-Pierre Demailly (old version). Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Rhode Island (RI) — Xrmap flag collection 2.7. Public domain. None; original SVG, scaled uncropped for display.
• South Carolina (SC) — Design by South Carolina General Assembly, SVG by Steve Hall. Public domain. None; original SVG, scaled uncropped for display.
• South Dakota (SD) — xrmap. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Tennessee (TN) — -xfi-. Public domain. None; original SVG, scaled uncropped for display.
• Texas (TX) — Paul B. Joiner. Public domain. None; original SVG, scaled uncropped for display.
• Utah (UT) — The State of Utah. Public domain. None; original SVG, scaled uncropped for display.
• Vermont (VT) — User:SimtropolitanOriginal by User:Denelson83. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Virginia (VA) — LadyofHats with additional editing by 痛 and Patrickneil / Charles Keck. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Washington (WA) — WA Secretary of State. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• West Virginia (WV) — Militaryace, Denelson83. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Wisconsin (WI) — State of Wisconsin / Xrmap flag collection. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Wyoming (WY) — User:Dbenbenn. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• Georgia (GA) — Xrmap flag collection. Public domain. Display copy: rasterized from the unchanged original SVG to a losslessly encoded 144×96 PNG (3× the 48×32 display), with transparent padding and proportional containment; no cropping, recoloring or design edits.
• District of Columbia (DC) — (of code) cs:User:-xfi-. Public domain. None; original SVG, scaled uncropped for display.

New applicants must validate an invitation, verify their phone with Clerk, and complete Didit’s ID document, passive selfie/liveness, and face-matching checks before membership activates. Didit’s verification interface is embedded inside Ahcacy. The server confirms all required results and that the applicant is at least 18; a browser success message alone cannot grant membership. If verification is unavailable or admission is disabled, new-member admission stays closed. Existing members are not re-verified.

Ahcacy requests verification to confirm an applicant’s identity before admission. Didit processes ID images, selfies, document information, and biometric analysis in its hosted flow. Before capture, we present the notices and an affirmative consent acknowledgement. Approval is not a guarantee of one account per person.

Ahcacy stores only necessary account-linked session references, statuses, consent-notice version and timing, attempt limits, invitation-reservation timing, and minimal delivery metadata. Ahcacy does not store ID images, selfies, biometric templates, extracted document fields, or full decision payloads. These data and hosted verification URLs are not sent to our analytics or application logs.

Live consent and retention settings were approved on October 6, 2026. Didit’s saved verification-session retention setting is one calendar month, not a fixed 30-day period. Biometric templates are set to Delete with session, and face search is disabled. New-member admission opens only after production readiness checks pass and verification is enabled. Didit’s separate operational audit logs may be retained for 365 days. Provider obligations or holds may affect deletion. Didit’s retention and deletion practices are described in its Verification Privacy Notice and End User Terms for Identity Verification. Ahcacy does not promise automatic deletion of all Didit records.

Expired invitation reservations are released and delivery-deduplication records are removed after 30 days. Minimal session and consent references and bounded attempt history remain for admission security and privacy-request handling until reviewed for deletion; they are not erased just to allow another attempt after a decline.

For verification review, retention information, or a privacy/deletion request, email Privacy@ahcacy.com. We review applicable retention obligations and coordinate provider-side requests where appropriate. Provider resubmission is handled in the Didit console; we do not offer a manual admission bypass.

Ahcacy has prepared an optional Premium file storage feature that is off by default and will only be activated after owner approval. When active, files you upload are stored with Cloudflare R2, separately from receipts and receipt evidence. Storage is 50 GB total (decimal gigabytes) with a per-file limit shown in the app; space does not reset monthly, does not accumulate, and files are not deleted automatically each month.

Shares are links or exact-username grants that you can revoke. An optional link password limits access but is not end-to-end encryption, and files are not scanned for malware. If Premium ends, your files are retained so you can still list, download, and delete them while admitted; existing shares are suspended and new uploads and shares are unavailable. Renewed qualifying Premium restores still-active shares; revoked shares stay revoked. We do not automatically erase files because a subscription expires. Files is included in Premium with no separate storage charge.

Private Premium member email is prepared but disabled. Before activation, we will confirm provider suitability, receiving routes, retention and the owner-approved service policy. Preparing this feature does not change your Clerk sign-in or verification address.

If activated, Ahcacy will process and store mailbox addresses, sender and recipient addresses, plain-text messages, read state and delivery metadata to operate private mail. Resend would process outgoing and incoming messages on our behalf. This is not end-to-end encrypted mail. We do not send message content or correspondent addresses to application analytics or include them in application logs.

Only plain-text content is displayed; HTML, remote images and attachments are not displayed or downloaded. Resend may still receive and retain the original message, including unsupported attachments, under its own settings and obligations. Removing a local message does not remove provider copies, backups, sender copies or messages already received by others. Minimal anti-replay and address-ownership records remain after local deletion. We do not promise automatic mailbox erasure when an account is deleted.

The proposed launch policy retains messages but suspends mail access when qualifying Premium ends. Approved username changes would change the primary address while former addresses remain reserved to the same original member and are never recycled. These policies require confirmation before activation. Privacy and deletion requests remain available through privacy support.

Passport is an Ahcacy membership document, not a government passport, travel credential, proof of legal name or verified identity. It is private by default. It stores an account-bound member number and issue date; it does not collect a date of birth or government document details.

If you explicitly enable sharing, anyone with your bearer link can read the exact name, claimed username, available owned Ahcacy member email (if any), member number and issue date shown in the confirmation preview without signing in. Your sign-in email, inbox and authentication-provider records are never part of Passport. Sharing a member email does not guarantee delivery.

Sharing uses a consented snapshot. Observed changes to its profile fields, loss of admission or qualifying Premium, or uncertain eligibility disable public visibility and require fresh confirmation. Rejoining Premium does not restore a link that was invalidated. Replacing or revoking a link blocks future access to that link, but cannot erase screenshots or copies already taken. A private issued record is retained after revocation or Premium loss. We do not promise automated account erasure; contact privacy support for retention or deletion review.

When enabled, username search is available only to signed-in, admitted members. Every admitted member with one valid current claimed username is searchable without an individual opt-in.

Other admitted members can find a current claimed username by searching at least two characters. Only the username is shown. We do not show or search names, phone numbers, email addresses, verification details, balances, membership tiers, Passport contents or other records, and there is no public or browse-all listing.

Username discovery does not grant access to Passport sharing, Files or messaging. A conversation request is a separate action, and the recipient chooses whether to accept. A username already seen or copied by another member cannot be recalled.