A receipt is personal. We treat it that way.

Who we are

Bagged is made by Dupi Technology Ltd, which is the data controller for everything described on this page. Questions, requests and complaints all go to founders@dupi.co.uk.

This site

This website has no accounts, no sign-in and no tracking cookies. It sets no cookies of its own.

It uses Vercel Analytics, which counts page views without cookies and without building a profile of you. It records things like the page, the country and the type of device, not who you are.

The receipt shown on the site is an example. It is not anybody's real shopping.

The app: what it collects

An email address or an Apple sign-in, so your history is yours and survives a new phone.

The photograph of each receipt, whether you take it in the app or choose one you had already taken. Choosing one asks for permission separately, and the app receives only the picture you pick: it cannot see the rest of your photos.

The line items read from that photograph: the product name as printed, the quantity, the price, and the processing classification worked out from the name.

When something in the app goes wrong, a diagnostic record: what failed, which version of the app it was, and whether it was an iPhone or an Android. It is attached to your account so that a report can be matched to a problem you write in about, it is deleted after 90 days, and it is stripped of anything from your shopping before it leaves the phone. Prices, product names, quantities and email addresses are removed by pattern rather than by hand, because the thing most likely to leak is an error message quoting the line it could not read.

If you subscribe, a record of the subscription: whether it is active, when it renews, and which plan it is. Payment itself is handled entirely by Apple, so we never see your card, your billing address or your name.

That is the whole list. There is no address book access, no location, no advertising identifier and no third-party analytics inside the app. Diagnostics go to our own database, not to a crash reporting company.

Why, and on what legal basis

The photograph is processed to extract the lines. That is the only reason it is uploaded.

The line items are what the product is: they produce your figure, the item that contributed most to it, and the comparison between one shop and the next. Without them there is no product.

The lawful basis for all of it is performance of a contract, which is to say that you asked for an app that reads your receipts and this is what reading them requires. Analytics on this website relies on legitimate interests, and is limited to counting visits.

Diagnostic records rely on legitimate interests too: knowing that the app broke, and on which version, is how it gets fixed. They are not used to work out anything about you, and they carry nothing about your shopping.

The subscription record is performance of a contract as well. Knowing whether you are subscribed is how the app knows what to show you, and it is the only thing it is used for.

The hash kept after deletion, described below, relies on legitimate interests: preventing a free allowance from being claimed repeatedly is a recognised one, and a hash that cannot be reversed and is attached to nothing is the least we could keep and still do it.

Never sold, never shared

Your receipts and your line items are not sold, rented, licensed or shared with anybody for their own purposes. Not with advertisers, not with data brokers, not with retailers, not with insurers, and not with anyone building a shopping dataset.

There is no advertising in the app, so there is nothing to target and nobody buying the means to target it.

The only companies that touch your data are the three suppliers listed below, and they act on our instructions rather than their own.

Who else sees it

Supabase hosts the database and file storage, in the European Union (Ireland).

Anthropic processes each receipt photograph to read the lines from it. The image is sent for that purpose only and is not used to train models. This processing takes place outside the United Kingdom, and that transfer is covered by the data protection terms in our agreement with them.

RevenueCat records and checks your subscription, so that the app knows whether it is active without having to ask Apple every time you open it. It receives the purchase record from Apple and an identifier for your account. It does not receive your email address, your receipt photographs, or anything read from them. This processing takes place outside the United Kingdom, and that transfer is covered by the data protection terms in our agreement with them.

That is the whole list. No analytics SDK inside the app, no advertising networks, no social trackers.

How long it is kept

Receipt photographs are kept for 12 months from the day you upload them, and are then deleted. They are kept that long for one reason: the parser improves, and being able to re-read your old receipts with a better version is worth more to you than deleting the image the moment it has been read once.

Parsed line items are kept for as long as your account exists. They are the history, and the product is a comparison over time, so deleting them on a schedule would delete the thing you came for.

Diagnostic records are deleted after 90 days. That is long enough to tell whether a release made something worse, and short enough that they never become a history of anything.

The subscription record is kept for as long as your account exists, because it is what says whether you are subscribed. Apple keeps its own record of the purchase, which is between you and Apple and is governed by their terms rather than ours.

You can delete an individual receipt whenever you like, and both the photograph and its line items go immediately.

If you delete your account, everything attached to it goes with it, diagnostics included: the receipts, the photographs, the line items, the answers you gave when you signed up, and the subscription record.

One thing does not go, and only if you had already used your free reading. We keep a one-way hash of the address you signed in with, and nothing else at all. A hash is a scrambled fingerprint: it cannot be turned back into your address, we cannot use it to contact you, and it is attached to no other information. Its only purpose is to stop the free reading being claimed over and over by deleting an account and starting again, which costs us real money each time. If you had not used your free reading, nothing is kept.

Your rights

You can ask for a copy of your data, ask for it to be corrected, ask for all of it to be deleted, or object to how it is being handled, and we will do it.

Email founders@dupi.co.uk. If you are in the UK and unhappy with how we have handled a request, you can complain to the Information Commissioner's Office at ico.org.uk.

Children

The app is not aimed at children and is not designed for people under 13.

Changes to this page

If any of this changes in a way that affects what happens to data already collected, you will be told in the app before the change takes effect rather than after it.

This page was last updated on 13 August 2026.