Radish privacy policy.

Radish is designed for private grocery receipt review. It does not connect to your bank, sell grocery data, or use receipt data for advertising.

Updated October 7, 2026.

Privacy at a glance

Radish is designed for private grocery receipt review. We do not connect to your bank account, we do not sell grocery data, and receipt data is not used for advertising or cross-app tracking. The table is a summary; the detailed boundaries below control if a summary and a later section differ.

What Radish processes and the control available to you
Data	Purpose	Who processes it	Retention or boundary	Your control
Saved receipts	Receipt history, search, spending views, and household sync.	Your iPhone; Apple iCloud/CloudKit when available.	Saved until you delete them; shared deletions depend on sync and Apple service availability.	Delete one receipt or Delete all receipts.
Receipt photos	Create the editable scan draft you review; from 1.15.0, recover unfinished scans and optionally view saved originals.	Radish’s Cloudflare-hosted service and OpenAI, only after permission. Local originals stay on your iPhone.	Up to four selected photos per request; operational processing can occur even though the request uses `store: false`. From 1.15.0, originals remain on this iPhone only when you choose to retain them; they are excluded from backups and household sync.	Disable Receipt processing; manual entry remains available. Remove saved originals from the receipt.
Community corrections	Suggest a human product name for an opaque receipt row.	Signed read-only dictionaries are downloaded from Radish’s service. Eligible correction votes reach Radish only after a separate opt-in.	A dictionary request identifies the retailer and market but includes no receipt image, item text, purchase amount, household/user ID, or app-installation ID. Submitted correction votes, including accept and reject choices, expire after 400 days; the uploaded fields and service-added retention timestamps are described below.	Community suggestions and Share corrections are independent Settings controls. Sharing is off by default.
Usage analytics	Measure a limited product funnel and, from app version 1.14.2, diagnose household sync reliability.	Radish and its isolated PostHog US Cloud project.	No receipt content or grocery details; builds containing the current privacy correction disable GeoIP enrichment, while earlier historical events may retain provider-derived coarse location.	Disable Usage analytics to stop future capture.
Website analytics and crawler telemetry	Measure cookieless page visits and acquisition performance, and classify likely AI or search crawler requests for public pages.	Radish, DataFast, and Cloudflare as the website host.	The cookieless browser script sets no persistent analytics cookie. It may use session-only browser storage that is cleared when the site session closes. DataFast processes page activity and network and browser metadata, including the IP address and browser user agent, and derives a pseudonymous visitor identifier with a salt that rotates about every 24 hours. A crawler event contains the public hostname and query-free path, crawler User-Agent, Cloudflare-observed source IP when available, and response status. Neither flow contains receipt or app data.	Use Turn off website analytics below. Radish stores only `datafast_ignore` in local storage to remember that choice and clears DataFast session storage. Neither flow is linked to a Radish app account or household.
Purchases	Verify subscription access and protect paid scan limits.	Apple; Radish receives verified entitlement or proof needed for app functionality.	Apple controls billing, refund, tax, and purchase retention under its policies.	Manage or cancel the subscription through Apple.
Security identifiers	Authenticate receipt-service requests, enforce limits, and prevent abuse.	Radish’s service, Cloudflare, and Apple App Attest or DeviceCheck.	Specific records and counters follow the published 5-minute, 48-hour, 60-second, or 180-day boundaries below.	Delete service data where applicable.

Who is responsible for your data

CitrusGate LLC is the controller responsible for the Radish app and website. You can contact the privacy team at privacy@radish.money or by post:

CitrusGate LLC
5441 South Macadam Avenue
STE N
Portland, OR 97239
United States

Why Radish may process data

UK data-protection law requires a lawful basis for each purpose. The basis depends on what you choose to use:

Purpose and lawful basis
Purpose	Lawful basis
Save receipt history and provide subscription access	Performance of the contract to provide Radish.
Send selected receipt photos to OpenAI and create the editable draft you request	Performance of the contract to provide the requested Radish function.
Protect the service, enforce limits, and prevent fraud or abuse	CitrusGate LLC’s legitimate interests in keeping Radish and its users secure.
Measure limited app and website usage	CitrusGate LLC’s legitimate interests in understanding and improving Radish without using receipt content for analytics. You can object through the app and website controls described below.
Share voluntary Community corrections	Your consent. Sharing is off by default, and you can withdraw consent in Settings.

Information Radish stores on your device

Receipt records you scan or enter manually.
Starting with Radish 1.15.0: unfinished scan photos, files sent through Share, and saved original photos only when you choose to retain them.
Receipt line items, categories, totals, dates, and review edits.
Essential or optional marks you apply to item families.
Household identifiers and sync state needed to connect household devices.
Subscription entitlement state received from Apple.
Downloaded community-suggestion dictionaries and, while sharing is enabled, a bounded encrypted queue of unsent eligible correction votes. If outbox removal fails after sharing is disabled, stale votes can remain locally until cleanup succeeds but remain ineligible for upload.

This information is used to show your grocery history, household totals, essential vs optional spending, and eligible community suggestions inside Radish.

Usage analytics

Production app versions that include the Usage analytics setting use Radish's isolated PostHog US Cloud project to measure a limited product funnel. Radish manually sends first open and session, onboarding step and completion, receipt-flow start, scan-or-manual selection, draft readiness or a coarse failure, durable receipt save, paywall and plan selection, verified purchase outcome, and restore outcome.

From app version 1.14.2, the same optional Usage analytics setting also controls limited household sync diagnostics. These report a fixed sync stage, failure or recovery category, and a broad data-size range to help identify reliability problems. They use the same pseudonymous app-installation identifier and analytics controls; they contain no receipt content, amounts, household identifiers, or raw error messages. TestFlight and Internal QA builds do not send these events.

These events can include a random app-installation identifier, app version and build, fixed funnel step, scan-or-manual method, coarse receipt-count bucket, plan or offer, and a coarse outcome. They never include receipt photos or text, store names, items, categories, receipt dates, amounts, household identifiers, Apple transaction data, contact information, or raw error text. PostHog autocapture, screen capture, session replay, surveys, feature flags, error autocapture, push registration and open capture, and person profiles are disabled.

Builds containing the current analytics privacy correction send PostHog’s $geoip_disable: true and $process_person_profile: false controls after Radish’s event allowlist accepts a payload. PostHog still receives network metadata needed to accept the HTTPS request. Earlier builds did not send the GeoIP control, so historical events can retain provider-derived coarse location fields. Upgrading or turning analytics off does not retroactively delete those events.

The random analytics identifier represents one app installation, not a Radish account or a known person; reinstalling can create a new identifier. Radish does not use analytics for ads or cross-app tracking. You can stop future capture under Settings > Usage analytics. Turning it off cancels delivery, clears unsent events, and removes the local analytics identifier; a later opt-in creates a new identifier. It does not recall events already received or aggregate reports already created. Analytics data remains subject to the configured PostHog account controls and applicable contractual or legal requirements; Radish has not promised a shorter product-specific automatic deletion period. To request help with analytics data, email privacy@radish.money.

Receipt processing

Before your first receipt scan, Radish asks for explicit permission to send up to four receipt photos to OpenAI through Radish's receipt-processing service. Receipt scanning is unavailable until you allow it. You can decline or turn scanning off and continue adding receipts manually.

Receipt scanning sends up to four receipt photos, App Attest security metadata, and either an Apple-verified StoreKit subscription proof or a DeviceCheck token through Radish's Cloudflare-hosted processing service. The Apple proof selects and protects the correct free or paid usage limit and is removed before the receipt request is sent to OpenAI. Cloudflare operates the service and protects it from abuse; OpenAI processes the receipt request to create the draft. The request is used to identify receipt line items, prices, dates, totals, store names, and likely categories. You review the draft before saving it.

Your permission is stored in Radish's local app settings, is not shared with a household partner, and can be changed under Settings > Receipt processing. Turning receipt scanning off prevents future uploads; it cannot recall a request that was already sent. After you save a receipt, Radish retains the confirmed receipt record, items, amounts, categories, and household choices. In Radish 1.15.0 and later, original photos are also retained on this iPhone only if you enable “Keep receipt photos on this iPhone”; you can remove them from the saved receipt. Earlier versions do not retain original photos after saving.

Community suggestions and shared corrections

Community suggestions are a read-only feature that is on by default. Radish downloads signed dictionaries for canonical retailers and markets found in saved receipt history or the current review. Each request identifies its retailer and market but includes no receipt image, row or item text, prices, totals, household or user ID, or app-installation ID. Cloudflare still receives source-network metadata needed to serve the HTTPS request. Dictionary download is independent of correction sharing.

Share corrections is a separate explicit opt-in and is off by default. After you confirm a reviewed receipt, an eligible correction vote can contain only the canonical retailer and market, normalized eligible receipt text, proposed product name and category, accept-or-reject verdict, and a per-key HMAC dedupe tag. The uploaded correction has no receipt photo, price, purchase or receipt date, total, household or user ID, or Essential/Optional choice. After the service validates and stores a submission, it adds update and expiry timestamps needed to upsert the current vote and enforce its 400-day retention period.

App Attest uses the app-installation identity to authenticate and rate-limit the request and to prevent one installation from presenting different household-secret tags for the same correction key. The security gate stores a 400-day binding addressed by the hashed installation ID and correction-key hash; it contains the first validated per-key HMAC tag and timestamps, but no raw receipt row. The validated correction sent to the collector contains the original household-secret tag but no installation identity. That per-key tag lets the service count one current vote for the same correction key from a household without providing a reusable household identifier across unrelated rows.

Correction votes and installation/key security bindings expire after 400 days. Changing households does not rebind an existing installation/key record; the affected queued batch is dropped rather than retried. Signed service-data deletion removes the installation-side binding but cannot recall a submitted vote already stored by the separate collector, including a reject verdict. Turning sharing off immediately makes unsent votes ineligible for upload; Radish then removes the encrypted local outbox. If file removal has to be retried, sharing stays disabled and stale votes cannot be sent. It cannot recall a correction request already sent to the service. Turning Community suggestions off stops future dictionary downloads; it does not change the independent sharing choice.

Deletion and disable controls

Radish has separate controls because saved receipt history, receipt-service security records, analytics, and Apple purchases are different data layers. Deleting saved receipts can synchronize that change through iCloud when available, but timing and convergence on another phone are not guaranteed. No one action silently claims to erase every layer.

What each action changes—and what it leaves alone
Action	What it changes	What it does not change
Delete receipt	Removes that saved receipt and its items from Spending; in a shared household, the deletion can sync to connected iPhones.	Does not delete receipt-service security records, analytics events, Apple purchase records, or a provider request already sent.
Delete all receipts	Removes all saved receipts and their items from Spending; shared deletion can sync when available.	Does not remove saved item choices or store names, receipt-service records, analytics, or Apple purchase records.
Delete service data	Turns Share corrections off, clears or fail-closes the encrypted local outbox, then after signed confirmation removes this installation’s receipt-service identifier, App Attest records, correction-key security bindings, outstanding challenges, detailed counters, and legacy indexes.	Does not delete saved or iCloud receipts, change scan permission, delete analytics, remove shared subscription-family or aggregate counters early, recall an OpenAI request, or recall a submitted correction vote already stored by the separate collector, including a reject verdict.
Disable Usage analytics	Stops future capture, cancels delivery, clears unsent events, and removes the local analytics identifier.	Does not recall received events, historical provider-derived fields, or aggregate reports.
Disable Receipt processing	Prevents future receipt-photo uploads; manual entry remains available.	Does not recall a request already sent, delete service security records, or delete saved receipts.
Disable Share corrections	Immediately makes unsent votes ineligible for upload, then removes the encrypted local outbox.	Does not recall a correction request already sent or disable read-only community suggestions. If file removal must be retried, sharing stays disabled and stale votes cannot be sent.
Disable Community suggestions	Stops future signed dictionary downloads.	Does not remove submitted server votes, including reject verdicts, or change the independent correction-sharing choice.
Leave household or stop sharing	Stops future household changes from syncing.	Does not erase receipts already stored on either iPhone; Radish cannot erase the other phone’s copies.
Delete the app or iCloud data	Apple’s device and iCloud controls can remove local app data or Apple-hosted copies and can make recovery unavailable.	Does not automatically delete Apple purchase history, analytics already received, an earlier provider request, or receipt-service records. Delete service data before removing the app if you want the signed in-app deletion path.
Cancel subscription	Stops future renewal according to Apple’s subscription rules.	Does not delete receipts, iCloud data, analytics, or receipt-service security records.

Retention and deletion

Starting with Radish 1.15.0, unfinished scan photos and files sent through Share expire after seven days and are removed when Radish or its extension next checks them. You can discard pending files earlier. Optional saved originals remain on this iPhone until removed from the receipt, or until cleanup after their saved receipt is deleted. These files use iOS file protection and are excluded from device backups and household/iCloud sync. The Share extension makes no network upload; recognition still requires receipt-processing permission.

Radish's receipt proxy does not write receipt request bodies to its storage and sends OpenAI Responses API requests with store: false, which prevents application-state storage for those responses. OpenAI’s default abuse-monitoring logs may still retain customer content and related metadata for up to 30 days, unless a longer period is required by law. Short-lived operational processing or retention may still occur for reliability, security, abuse prevention, debugging, or legal obligations. Radish does not claim zero operational retention.

One-time App Attest challenges expire after 5 minutes. Detailed per-install and pseudonymous subscription-family usage counters expire at the start of the relevant UTC day plus 48 hours. The raw StoreKit proof and DeviceCheck token are not persisted by Radish's processing service. The installation identifier, App Attest public-key state, and assertion counter expire after 180 days without a successful signed request unless you remove them sooner.

Under Settings > Receipt processing, Delete service data sends an App-Attest-signed request that removes this installation's identifier, App Attest records, outstanding challenges, detailed usage counters, and legacy indexes from Radish's processing service. It does not change your receipt-scanning permission, delete saved receipts or iCloud household history, or recall a request already sent to OpenAI.

After confirmed deletion, a minimal hashed deletion receipt remains for up to 48 hours so a lost response can be retried safely and same-day quotas cannot be reset. It retains the current UTC day plus integer extraction-request and, when applicable, correction request/vote quota watermarks. It contains no raw installation identifier, key identifier, public key, page count, receipt data, or correction content. A subscription-family counter is shared by all installations using that subscription, is not removed by one installation, and expires on the same schedule. Apple maintains DeviceCheck fraud-prevention bits. A pseudonymous principal placed on Radish's exact blocklist remains until Radish removes that block. Service-wide aggregate counters contain no installation identifier and expire on schedule. Cloudflare-managed abuse-prevention counters use 60-second decision windows and cannot be individually removed by Radish.

Community correction votes expire after 400 days. Disabling Share corrections immediately makes unsent votes ineligible and Radish then removes the encrypted local outbox. It cannot recall a correction request already sent to the service.

The in-app action can authenticate only the current installation. If the app or its App Attest key is removed first, the inactive security record expires after 180 days. You can delete saved receipts separately in the app; iCloud deletion and sync timing may depend on Apple iCloud availability.

Security identifiers

Receipt-scanning and opted-in correction-sharing requests use Apple App Attest to authenticate the app request and a stable per-install identifier for server-side identity and rate limiting. For correction sharing, that identity is not forwarded to the correction collector. StoreKit or DeviceCheck security proofs establish subscription or device state for fraud-prevention and usage-limit decisions. Radish derives only a keyed pseudonymous subscription-family identifier for paid limits. Quota and blocklist decisions can target one exact installation or subscription principal without blocking a shared IP address. Separate public challenge-flood rate limits can still apply to a source network. These service security identifiers are not repurposed for advertising, analytics, or cross-app tracking; usage analytics uses a separate random app-installation identifier described above. Cloudflare terminates HTTPS and receives source-network information as part of operating the service. The Worker hashes the source-network address before using it as a managed rate-limit key; the raw address is not written to Radish's Durable Object.

Household sync

When iCloud and CloudKit are available, Radish syncs a sealed household snapshot to the household's private CloudKit zone, including for a solo household. A partner joins through an explicit QR invite. Radish does not give another person access without that invite flow.

When iCloud Keychain is available, Radish stores a recovery copy of the random household encryption key there. The working copy remains device-only. After a reinstall, Radish downloads and verifies an existing CloudKit household snapshot before it can upload local state. The Data & iCloud check saves the current sealed snapshot and reads it back from CloudKit before reporting that recovery is ready.

Apple may process iCloud and CloudKit data according to Apple's terms and privacy policies.

Editable drafts, not significant automated decisions

Receipt recognition creates an editable draft. You review and can change the store, date, items, categories, and amounts before saving. Radish does not use receipt recognition to make a solely automated decision that produces legal or similarly significant effects about you.

Purchases

Radish subscriptions are processed by Apple through the App Store. Apple may process purchase, payment, refund, tax, and subscription information according to Apple's own policies. Radish receives the entitlement information needed to unlock the app.

Processing outside the United Kingdom

Apple, Cloudflare, OpenAI, PostHog, DataFast, and other service providers may process data outside the United Kingdom. Where UK law treats that processing as a restricted transfer, CitrusGate LLC relies on an applicable UK adequacy regulation or puts an appropriate contractual safeguard in place, such as the UK International Data Transfer Agreement or UK Addendum. You may request information about the applicable safeguard at privacy@radish.money.

Website privacy

This website uses the DataFast cookieless browser script to measure page visits and acquisition performance. It sets no persistent analytics cookie. DataFast may use session-only browser storage that is cleared when the site session closes. DataFast processes page activity and network and browser metadata, including the IP address and browser user agent, and derives a pseudonymous visitor identifier with a salt that rotates about every 24 hours. Radish does not use DataFast for advertising or cross-app tracking, and the browser script receives no Radish app account, app-installation, receipt, or household identifier. Diagnostic goals record fixed page and action names for App Store clicks, the illustrative receipt example, and completed calculator estimates. Calculator ages, table choices, and amounts are not sent.

Cookieless website analytics is on. It sets no persistent analytics cookie.

Turning it off stores only datafast_ignore in this browser to remember the objection, stops future DataFast browser events, and clears DataFast session storage. You can turn it on again here at any time.

This website also uses server-side DataFast Bot traffic tracking for likely AI assistant, search-indexing, and model-training crawler requests. For those likely crawler requests, Radish sends only the requested hostname and path without query parameters, the complete crawler User-Agent, the Cloudflare-observed source IP when available, and the HTTP response status. It does not forward the crawler request’s cookies, authorization headers, request body, referrer, or other request headers to DataFast. DataFast classifies the crawler and records IP-verification confidence. Crawler fetches do not prove that Radish was cited, indexed, ranked, or used for model training.

App Store links on Radish acquisition pages use fixed page-level Apple campaign and provider tokens so App Store Connect can report aggregate product-page views, first-time downloads, usage, sales, and subscriptions for that page intent. The fixed token is not derived from visitor-supplied query, UTM, or referrer values. These links include no Radish user, app-installation, receipt, or household identifier. Radish does not join Apple campaign reporting to PostHog installation events or use it as per-person attribution. Apple applies its own attribution windows, reporting thresholds, and privacy policies. Hosting, security, and analytics providers may process standard request logs needed to operate, measure, and protect the site.

Your UK data-protection rights

Depending on the circumstances, you may ask for a copy of your personal data, correction, deletion, restriction, portability, or object to processing. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.

Send a request to privacy@radish.money. CitrusGate LLC may need to verify your identity and will normally respond within one month. You may also complain to the UK Information Commissioner’s Office through its data-protection complaint service.

Contact

Questions and privacy requests can be sent to privacy@radish.money or by post to CitrusGate LLC, 5441 South Macadam Avenue, STE N, Portland, OR 97239, United States.