Privacy policy
Last updated: 7 September 2026 · Versão em português
What IziCost is
IziCost reads your shopping receipts, keeps your spending private to you, and pools anonymous prices so everyone can find where things are cheapest.
What stays private
Your receipts, their photos, your line items, totals, budgets, shopping lists and watched items belong to your account only. Other users can never read them. The database enforces this, not just the app.
What is shared, and how
When a receipt is saved, each product line becomes one anonymous price point: product, shop, city, price, date. No user id, no receipt id, no other item from the same basket — we hold nothing that links a community price to the person who reported it, and neither does anyone else. A price from a receipt is shown once enough different people have reported it; that number is set for the country and rises as more people join. While IziCost is starting out it is low, so in a very small shop with very few contributors a price could in principle be guessed at by someone who already knew who shops there. Prices a shop publishes itself are public information and are always shown.
What we collect about you
An email address if you create an account (optional: the app works as a guest under a random account id). Your city only if you choose one. When you ask for shops near you, your coordinates are sent to our server to work out which shops those are, and are not kept afterwards. When you are the first person to record a shop, the shop’s own coordinates are saved against that shop — that is a fact about the shop, not about you, and it is not linked to your account. Your location is never stored as a history of where you have been.
When you write to us
Send feedback (Me → Send feedback) sends us your words, the app version, the phone system and the screen you were on, plus any pictures you attach. Nothing from your receipts goes with it. When the app hits a problem it could not handle — a receipt it failed to read, for example — it also files a short note with the same details and the error message, so we learn about faults instead of leaving you stuck. Pictures you attach are private: only you and the operator can open them, and they go when you delete your account.
Prices that come from shops, not from people
Some prices in the app are not reported by anyone: they are collected every morning from prices the shops themselves publish in public — an online shop’s own price list, or a promotion leaflet. They are marked “Online price†or “Promotionâ€, a promotion disappears the day it ends, and no personal data of any kind is involved in collecting them. A photograph of a price label on the shelf, taken by an approved contributor, also becomes a public price: it is the shop’s own printed price, not anybody’s shopping.
Who processes data for us
Supabase hosts the database and photo storage. Anthropic provides the AI model that reads receipt and shelf photos; photos are sent to it only to extract the printed text and are not used to train models. When you dictate a shopping list, the phone’s own speech recogniser turns what you say into text; on some Android phones that happens on Google’s servers rather than on the phone. We only ever receive the text. No other third party receives data.
How long we keep it
Your personal data stays until you delete a receipt or your account, then it is gone from the live app. Because losing everyone’s receipts to an accident would be worse, we keep safety copies of the database: a small number of recent copies, plus offline copies kept by the operator. A deleted account can therefore linger in those copies for a few weeks until they are overwritten, and they are never used for anything but putting data back after a failure. Anonymous community price points, which cannot be linked to you, are kept indefinitely because they are the shared price history.
What we never do
We never sell, rent or share personal data. Advertisers see nothing about you: adverts run inside the app and we count only how many times an advert was shown or tapped, without knowing by whom.
The operator
The people who run IziCost can technically access the database, like any app operator. We commit to never look at individual receipts, to use administrative access only through the maintenance scripts kept in the code repository, and to log every administrative change.
AI reading of receipts and shelf photos
Photos are sent to our server function and read by an AI model to extract the printed text. Shelf photos are deleted from storage as soon as they are read. Receipt photos stay attached to your receipt so you can see them; delete a receipt and its photo goes too.
Your rights
Export everything you own at any time (Me → Export my data). Delete your account and everything it owns at any time (Me → Delete my account), or see how to delete your account. Both work without asking anyone.
Security
All traffic is encrypted. Secrets never live in the app. Every table is protected by row-level rules, every server function checks who is calling, and abuse is rate-limited. No system is unbreakable; we review IziCost like an attacker would before every release.