Privacy policy

Last updated 13 November 2026

Crumple is an app for keeping receipts, bills and parking tickets. It is run by Crumple, Sweden ("we"). We are the controller of the personal data described here. This policy says what we store, why, for how long, who helps us process it, and what your rights are.

What we store

• Your email address, to create your account and send you sign-in codes.
• Your name, only if you choose to add it.
• Your currency and other app settings.
• Receipts and documents you add: the images and PDFs, the text your phone reads from them (text recognition runs on the phone), and the details extracted from them (shop, date, amounts, VAT, line items, payment method, and for bills and fines the recipient, account numbers, payment reference and due date), plus anything you add yourself, such as categories, tags and notes.
• Signed-in devices: the device name the app reports and when it was last used, so you can stay signed in.
• Technical logs: IP address and request details in server logs, and crash reports, to keep the service secure and working. A crash report from the app holds the error, the phone model and the system and app versions; it never contains your email address or what is on your receipts.

Each time the app starts, it asks Expo's update service whether a newer version of the app's own code is available. That request carries the platform (iOS or Android), the app version, a random identifier for this installation and, like any request, your IP address; it carries nothing about you or your receipts.

Due-date reminders are scheduled on your phone; we do not send push notifications. We do not collect your phone's location, contacts or advertising identifiers, we do not show ads, and we do not sell or share your data for marketing. If you turn on Face ID or fingerprint lock, it is handled entirely by your phone; we never see biometric data.

Why we use it

• To provide the service you asked for: store your documents, read them, let you search and export them (legal basis: performance of our contract with you, GDPR article 6(1)(b)).
• To keep the service secure, prevent abuse and fix errors (legal basis: our legitimate interest in running a safe and working service, article 6(1)(f)).

Your documents are not used to train AI models, by us or by our processors.

How long we keep it

We keep your account and documents until you delete them. A receipt you delete is removed straight away, apart from a marker kept for up to 30 days so your other devices learn it was deleted. When you delete your account, all of your data is deleted from our servers at once (the stored images and PDFs within minutes); copies in backups are overwritten within 30 days. Sign-in codes are deleted after use or within a day. An export you make is kept for a day so you can download it, then deleted. Server logs are kept in files of a fixed, small size that are overwritten automatically as new entries arrive. Crash reports are deleted by Sentry after at most 90 days.

Who processes it for us

We use these processors, each bound by a data processing agreement:

• Google (Gemini API) reads the images and text of the documents you add, to extract their details. It also turns a short summary of each document (shop, category, items, total) into a search index entry, and reads the search questions you type, so you can find documents by describing them. We use the paid service, under which Google does not use the content to train its models.
• Cloudflare (R2 storage) stores your images and PDFs, in its EU jurisdiction.
• Our hosting provider runs our servers and database in the EU.
• Our email provider delivers sign-in codes to your email address.
• Sentry receives crash and error reports from our servers and from the app, which can include technical details of the request that failed.
• Expo (650 Industries) delivers updates of the app's code, as described above.

Where it is stored

Your account and documents are stored in the European Union. Several processors are companies based in the United States (Google, Cloudflare, Sentry, Expo and our email provider), and some processing, such as reading a document with Gemini or an update check, can take place outside the EU/EEA. Where data is transferred outside the EU/EEA, it is protected by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Your rights

Under the GDPR you can ask for access to your data, a copy of it in a portable format, correction, deletion, restriction of processing, and you can object to processing based on legitimate interest. Most of this you can do yourself in the app: edit any receipt, export your receipts, and delete your account. For anything else, email us. You also have the right to complain to your data protection authority.

Deleting your account

In the app, go to Settings and tap Delete account. This deletes your account and every receipt, file and setting at once. If you cannot use the app, see how to delete your account.

Children

Crumple is not intended for children under 16.

Changes

If we change this policy in a way that matters, we tell you in the app before the change applies.

Contact

Crumple, Sweden. Email support@crumplethis.com.