Plain-language receipt data flow

Your receipts. Clear choices about your data.

You choose whether to allow receipt photos to be processed by OpenAI. Review the result before saving. Your saved history is encrypted, and you can export or delete your records. No bank connection, ads, or selling grocery data.

Updated October 7, 2026.

Manual entry availableNo bank connectionYou control sharing

Read the short answers Read the full Privacy Policy

The short version

Five things to know.

Do you connect to my bank?: No. You choose which receipts to add.
Who sees a receipt photo?: Only after your permission, selected photos pass through Radish’s service to OpenAI for recognition. Manual entry needs no photo upload.
What is saved?: Reviewed purchase details are encrypted before storage or iCloud sync. From 1.15.0, you can optionally keep original photos on this iPhone; they stay out of backups and household sync.
Can I delete it?: Yes. Receipts, receipt-service data, and analytics have separate controls. Deleting one does not delete every other layer.
Does the website measure visits?: Yes, with DataFast cookieless analytics. See the details and opt out.

How a scan and manual entry use data

Two starting paths

Manual entry and photo scanning meet at review—not at upload.

Manual path

Type the receipt → review → save

You enter the store, date, total, and items. No receipt photo is sent through the receipt-processing service. A saved record can still be stored locally and synced as part of the sealed household snapshot through iCloud.

Scan path

Allow scanning → selected photos → draft → review → save

After explicit permission, up to four selected photos pass through Radish’s Cloudflare-hosted service to OpenAI. OpenAI returns proposed receipt details. You review and edit the draft before saving it.

Radish processing selected receipt photos after receipt-processing permission.

Radish sends Apple security and access proofs to its service for authentication and usage-limit decisions. The Apple proof is removed before the receipt request goes to OpenAI. After you save, Radish retains the confirmed receipt record. From 1.15.0, original photos are retained locally only when you choose; unfinished photos and shared imports expire after seven days. Provider-side operational processing can still occur under the boundaries below.

Where your saved household history lives

After review

The saved household record is a separate data layer.

Confirmed store, date, total, item, category, and household-choice data is saved locally through Radish’s privacy core. When iCloud and CloudKit are available, Radish also pushes a sealed household snapshot to the current Apple ID’s private CloudKit zone, or to the shared zone for an invited second phone.

Solo household

The sealed snapshot can use the current Apple ID’s private CloudKit database when iCloud is available.

Two-iPhone household

An explicit QR invite can share the grocery snapshot with one other supported iPhone through CloudKit’s shared database.

Recovery check

The app can verify that its recovery key is readable from iCloud Keychain and that the current sealed snapshot survives a CloudKit save-and-fetch round trip.

Service dependency

Local and iCloud operations still depend on device state, keys, network access, and Apple service availability; they are not a perpetual-storage promise.

What each deletion and sharing control does

Data → purpose → control

Use the control for the layer you actually intend to change.

Current product, website, security, and purchase layers
Layer	Processor	Purpose	Primary control
Selected receipt photos	Radish service, Cloudflare, OpenAI	Create an editable draft	Decline or disable receipt processing; use manual entry
Saved receipt records	iPhone; Apple iCloud/CloudKit when available	History and supported household sync	Delete one receipt or Delete all receipts
Receipt-service security records	Radish service, Cloudflare, Apple App Attest or DeviceCheck	Authentication, limits, and abuse prevention	Delete service data for the current installation
App usage analytics	Radish and PostHog US Cloud	Measure a narrow product funnel	Disable Usage analytics to stop future capture
Website browser analytics	Radish, DataFast, Cloudflare	Measure page visits and acquisition performance without a persistent analytics cookie	Turn off website analytics
Public-page crawler telemetry	Radish, DataFast, Cloudflare	Classify likely search and AI crawler requests	No app-account control; this public-request telemetry is not linked to a Radish app account or household
Purchase and entitlement	Apple and Radish entitlement checks	Billing and continued access	Apple subscription, restore, and refund controls

Deletion boundary: deleting saved receipts can synchronize through iCloud when available, but another phone may not converge immediately. That action does not silently claim to erase provider operations, analytics already received, or Apple purchase history in other layers.

After Delete all receipts

Saved receipts and Spending items are removed, and the shared deletion can sync through iCloud when available. Another phone may not converge immediately. Saved store names and item-family choices remain; separate service, analytics, provider, and Apple layers are unchanged.

After Delete service data

A minimal hashed deletion receipt can remain for up to 48 hours. Shared subscription-family counters and service-wide aggregate counters expire on their schedules; Apple DeviceCheck bits and an exact abuse blocklist have separate boundaries.

If the app key is removed first

The current installation can no longer sign the in-app deletion request. Its inactive receipt-service security record expires after 180 days without a successful signed request.

After disabling a future flow

Disabling receipt processing cannot recall a request already sent. Disabling Usage analytics clears unsent events but cannot recall received events, historical provider-derived fields, or aggregate reports.

See the data controls in Settings

Radish Settings showing My household, receipt processing, Data export, and optional Community corrections.

App analytics and website measurement

App and website are different

Website measurement does not receive the app’s receipt or household record.

App analytics

Radish manually sends allowlisted coarse funnel events to PostHog. Those events exclude receipt photos and text, stores, items, categories, dates, amounts, household identifiers, Apple transaction data, contacts, and raw error text. The random identifier represents an app installation, not a known person.

Website measurement

The website uses DataFast cookieless analytics and sets no persistent analytics cookie. DataFast may use session-only storage and derives a pseudonymous visitor identifier with a salt that rotates about every 24 hours. Separate server-side telemetry forwards a query-free public hostname/path, crawler User-Agent, source IP when available, and status for likely crawler requests. Neither flow receives a Radish app account, installation, receipt, or household identifier.

App Store links use a fixed page-level campaign token. The token is not built from a visitor’s query, UTM, or referrer, and Apple campaign reports are not joined to PostHog app-installation events.

Limits and complete privacy terms

Claims Radish does not make

Precise privacy language matters more than an absolute slogan.

Using store: false asks OpenAI not to store the receipt request, but Radish does not claim that providers perform no short-lived operational processing or retention.
Disabling future scanning does not recall a provider request already sent.
Deleting service data does not delete saved or iCloud receipts, earlier analytics, Apple purchases, or another phone’s copies.
CloudKit and iCloud Keychain support synchronization and recovery boundaries; they are not a promise that Apple services will always be available.
Radish has no ads and does not sell grocery data, but it still discloses narrowly scoped app, website, security, cloud, and purchase processing.

Radish never requests bank credentials or imports bank transactions. Receipt-photo processing, iCloud sync, analytics, security checks, and Apple billing are separate services. This is a plain-language product explainer; the Radish Privacy Policy is the controlling disclosure if wording differs.

Receipt data and privacy FAQ

Can I use Radish without uploading receipt photos?

Yes. Decline or disable receipt processing and add receipts manually. Photo scanning is unavailable until you explicitly allow it.

Who processes receipt photos?

Selected receipt photos pass through Radish’s Cloudflare-hosted processing service to OpenAI to create an editable draft. Security proofs are removed before the receipt request is sent to OpenAI.

Does Radish keep the original receipt photos after I save?

In Radish 1.15.0 and later, only if you choose to keep them on this iPhone. Saved originals can be removed from the receipt and are excluded from backups and household sync. Earlier versions retain the reviewed record without the original photos. Provider operational-retention boundaries still apply.

Does deleting a saved receipt delete every related data layer?

No. The saved-receipt deletion can sync through iCloud when available, but another phone may not converge immediately. Delete all receipts leaves saved store names and item-family choices. Receipt-service records, analytics already received, Apple purchase records, and a provider request already sent have separate controls and retention boundaries.

Does the Radish website use analytics?

Yes. The website uses DataFast cookieless analytics with no persistent analytics cookie. It is separate from the app and receives no Radish app account, installation, receipt, or household identifier. Separate server-side telemetry covers likely crawler requests.

Does Radish sell grocery data or show ads?

No. Radish has no ads and does not sell grocery data. Limited app analytics, cookieless website analytics, and server-side crawler telemetry have separate, disclosed boundaries and are not cross-app advertising tracking.

Radish for iPhone

Try a receipt with clear choices about your data.

Save your first 3 receipts free. A subscription is required for continued use.

Try your first receipt free