KVITT privacy policy

Who is responsible

KVITT is a Bruket product operated by William Wigertz Wåhlström in Sweden. Contact william@bruket.co about personal data, your account, or this policy. This policy covers the KVITT app and its backend; the general Bruket website policy is separate.

Guest mode and your account

Manual purchases and pending receipt photos can be stored on your device. Guest entries are not uploaded until you sign in; receipt photos also require your permission for cloud processing. Removing the app can remove unsynced data. Local storage is not an encrypted personal vault.

When you create an account, Supabase processes your email address, authentication credentials and session information. KVITT stores your account identifier, saved purchases, receipt images, extracted text, dates, amounts, merchants, product categories, corrections, consent setting and subscription status so you can use the service across sessions. Account and saved-purchase processing is necessary to provide the service you request.

Optional cloud processing and AI

Before cloud scanning starts, the app asks for explicit consent. Receipt images are read by AI models that run on Cloudflare Workers AI, and product descriptions and merchant names can be categorised the same way, including from manual entries while this setting is enabled. Your account details are not part of these requests, and Cloudflare does not use this content to train models. Generic product labels and the categories assigned to them may be kept without any link to your account, so the same label does not need to be categorised again.

You can switch off cloud processing in account settings at any time. This stops new cloud scans and AI classification; manual entry remains available without it. Already completed processing cannot be undone by switching it off, and saved receipts remain until you delete them. Avoid uploading receipts containing someone else’s details or information you do not want these providers to process.

Infrastructure and subscriptions

Cloudflare runs the KVITT service, stores receipt images and database backups in Cloudflare R2 and delivers account emails. Supabase stores your login and saved purchases in its Stockholm region. RevenueCat receives your app account identifier and subscription transaction information to check access. Apple or Google processes store payments; KVITT does not receive your full payment-card details.

Providers may process data outside Sweden or the EEA, for example when Cloudflare handles a request elsewhere in its network. Their service agreements and applicable transfer safeguards govern that processing. KVITT does not sell your purchase data or include advertising trackers.

Reliability and security

Sentry receives technical error reports, app/device information and a pseudonymous account identifier to diagnose failures. Request bodies and default personal information are excluded from error reporting, and authentication/search URL parameters are stripped. Limited service logs and request-rate counters help prevent abuse. This processing supports our legitimate interests in operating a secure, reliable service.

Retention and deletion

Successful receipts and saved purchases stay on your account until you delete them or the account. Failed or abandoned upload records and their unshared images are eligible for automatic removal after seven days; cleanup runs daily. A shared image is preserved while another saved record needs it.

Account deletion removes KVITT purchase data, source images, associated processing records and the Supabase account, and requests removal of the RevenueCat customer record. Daily database backups keep earlier data for up to 14 days before they are deleted; restored data must be checked against completed account deletions before use. Apple, Google and other providers may retain records they are independently required to keep. Deleting your KVITT account does not cancel a store subscription.

Support correspondence is retained only while needed to handle the request and any applicable legal obligation. Removing cloud data does not remove exports or copies you saved outside KVITT.

Your rights and choices

Contact william@bruket.co to request access, correction, deletion, restriction, portability or to object to processing based on legitimate interests. You can withdraw optional cloud-processing consent in the app. We may need proportionate proof that a request concerns your account; never email a password or payment-card details.

You can complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or your local supervisory authority. We will update this page when the service changes and ask again before materially expanding consent-based processing.