One photo in, one draft out
Point the camera at the receipt and the app finds the paper in the live frame, corrects the angle and takes a single picture. One scan is one photo: there is no multi-page document mode, because a scan you cannot check on one screen is a scan you will not check.
Before anything leaves the phone the image is reduced to 2000 pixels on its long edge and re-encoded as a JPEG, with the rotation baked into the pixels instead of left in a metadata tag. A camera photo is three to five megabytes of HEIC; what gets uploaded is roughly a tenth of that, and the metadata the camera attached to the original does not travel with it.
Then the part that matters: the image is held in memory for the length of one request while the configured model reads it, and it is never written to a disk, a queue, or an application log. Only the draft you approve remains.
- JPEG, PNG, HEIC, HEIF and WebP all accepted
- Downscaled on the phone, not on a server
- No copy kept once the request ends
Nothing counts until you confirm it
A scan produces a draft, and a draft sits outside everything: your balance, the ledger, Trends, budgets and the cash-flow forecast all ignore it until you confirm it. An unreviewed receipt cannot quietly move a number you are relying on.
Fields the model could not read stay blank and are marked “Could not be read” rather than filled with a plausible guess. A receipt that matches one already in the ledger asks “Already recorded?” instead of silently duplicating it.
- Line items, quantities, taxes, discounts, deposits, tips and refunds kept with the receipt
- Warnings where the paper was unreadable, never invented numbers
- Duplicates caught before confirmation, not discovered after
What your phone keeps, and what it does not
Your session token lives in the iPhone keychain, which the widget and the share sheet deliberately cannot read. They share a folder with the app for the little they need to display; an extension that could authenticate is an extension that could be talked into reaching the server.
Receipts are indexed for Spotlight, so typing a merchant name into your phone’s own search finds the purchase with the app closed. That index holds the merchant, the date, the total and whether the receipt still needs review — not the line items, receipt numbers, addresses or notes. It is private and on-device, it is deleted when you sign out, and switching it off in Settings deletes what is already there instead of merely stopping new entries.