Privacy Policy

Refund Raptor, Inc. (“Refund Raptor™”, “we”, “us”, “our”) operates a receipt-scanning, return-window tracking, and claim-drafting service delivered through the Refund Raptor mobile app (iOS and Android) and the website at refundraptor.com. This Privacy Policy explains what personal information we collect, how we use and share it, how long we retain it, and the choices and rights you have.

This policy applies to the Refund Raptor app, the website, and any Refund Raptor-branded feature that links to it (for example, email forwarding, push notifications, in-app subscriptions, and the optional Refund Wrapped year-in-review experience). It does not cover third-party products or services you reach through links we provide — those services operate under their own privacy policies.

Refund Raptor, Inc. is the data controller for personal information processed through the service. For data-protection notices we accept service of process at the legal email below; a current physical mailing address is available on request to legal@refundraptor.com.

We collect information in the categories below. Many features are optional and only activate when you turn them on (for example, store proximity reminders or email forwarding).

• Account data: email address, sign-in provider identifier (for example Apple, Google, or email link), authentication tokens, and account metadata such as creation date and sign-in events.
• Receipt data: receipt images you capture or upload, OCR-derived text, merchant names, totals, subtotals, taxes, line items, return-window estimates, price-adjustment signals, edits or corrections you make, and claim message drafts.
• Device and app data: app version, operating system, device model class, language, region, crash and diagnostic logs, and product analytics events when you have analytics enabled (for example usage events via PostHog).
• Notifications data: push notification tokens issued by Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM), and your notification preferences (return-window alerts, store reminders, and similar).
• Optional location data: if you enable store proximity reminders, we process foreground or approximate device location solely to trigger reminders near supported stores. We do not build advertising profiles from location and we do not sell location data.
• Optional email forwarding: content of emails you choose to forward to a Refund Raptor forwarding address, limited to the confirmations you send us. You control what to forward.
• Subscription and billing data: if you purchase Rex Pro, the app store processes your payment; we receive the resulting entitlement status, transaction identifier, product identifier, and renewal or cancellation state via RevenueCat. We do not see your card number.
• Referral program data: your Refund Raptor referral code, your total referral count, qualified-referral count, and reward-grant timestamps. We use this to credit Rex Pro when referrals qualify.
• Support and correction data: messages you send support, screenshots or receipts you attach, and corrections you submit to improve OCR or policy accuracy.
• Marketing website logs: basic server, CDN, and hosting logs (such as IP address, user agent, referrer, and request time) from our hosting provider, used for security and reliability.

We use the categories above to: (a) scan, parse, and structure your receipts; (b) calculate return and price-adjustment timelines; (c) generate claim message drafts for you to review and send yourself; (d) sync your data across devices where you sign in; (e) send notifications and reminders you configure; (f) operate optional features you turn on (store reminders, email forwarding, referrals); (g) provision and enforce subscription entitlements; (h) maintain security, prevent abuse, investigate incidents; and (i) measure, debug, and improve reliability and performance.

We process claim drafts and the content of forwarded emails only to provide the feature you asked for — not to build advertising profiles, not to sell, and not to train general-purpose AI models on your personal content.

Refund Raptor uses on-device optical character recognition (OCR) first where the operating system supports it. When on-device confidence is low, the image is difficult (thermal paper, low light, folded receipts, wrapped lines), or a second pass is required to confirm a total or a date, the receipt image and extracted text may be sent to our servers for a higher-accuracy pass. That pass uses commercial document-intelligence services under contracts that restrict use of your content to providing the service to us.

When you ask Refund Raptor to draft a claim message, the merchant name, item description, dates, and the short context you supply may be sent to a commercial large-language-model provider for the sole purpose of producing your draft. Drafts are returned to your device for you to review, edit, and send yourself. We do not sell your receipt data. We do not use your personal receipt content, your messages, or your account history to train public, general-purpose AI models. Anonymized, aggregated metrics (for example, overall OCR accuracy rates by retailer category) may be used internally to improve the parser.

The marketing website uses a minimal set of cookies or local storage required for basic operation, security, and hosting analytics from our infrastructure vendor. We do not run third-party advertising cookies on this site for cross-context behavioral profiling. If that ever changes, we will update this section and, where required, obtain consent before non-essential cookies load.

The mobile app itself does not use web cookies. It stores preferences and cache on-device using the operating system’s standard storage APIs.

Because the marketing site does not run cross-site tracking, there is currently no separate “sale” or “share” signal for us to honor. Where the Global Privacy Control (GPC) signal is transmitted by your browser, we treat it as an opt-out of any future cross-context behavioral sharing consistent with California law. We do not currently respond differently to the older Do Not Track header.

If you are a resident of California or another U.S. state with comprehensive privacy legislation, you may have rights to know, access, delete, correct, port, appeal, or opt out of “sale” or “sharing” of personal information as those terms are defined by law.

We do not sell your personal information for money. We do not share personal information for cross-context behavioral advertising as “sale” or “share” under the CPRA. Certain analytics or infrastructure processing may fall under “business purposes” as defined by California law; we limit that use to operating, securing, and improving the service.

To exercise rights, email privacy@refundraptor.com or use in-app tools for export and account deletion. We will verify your request as permitted by law. If we deny a request, you may appeal by replying to our decision email; we will respond within the timelines required by applicable law.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process personal data on the following legal bases: (a) performance of a contract — to provide the Refund Raptor service you requested; (b) legitimate interests — security, fraud prevention, reliability, and product improvement, balanced against your rights; (c) consent — for optional features such as location-based reminders, push notifications where required, email forwarding, and non-essential analytics; and (d) legal obligations — to comply with applicable law.

You can withdraw consent at any time from the relevant in-app setting or by contacting privacy@refundraptor.com. Withdrawal does not affect the lawfulness of processing before withdrawal.

We disclose personal information only to service providers and subprocessors that help us operate Refund Raptor. We require contractual commitments around confidentiality, security, and limited use. Current categories of subprocessors and what they receive:

• Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging): account identifiers, receipt data, preferences, and push tokens — used to sync and secure your account and deliver notifications.
• Document-intelligence API (currently Google Cloud Vision): receipt images and extracted text — used to produce accurate line items when on-device OCR is not sufficient.
• Large-language-model provider (currently Google Gemini, with OpenAI as fallback): the limited claim-context payload you authorize when you ask the app to draft a message — used solely to return that draft to your device.
• Email delivery and inbound parsing (currently Twilio SendGrid): outbound transactional email when the app sends from a Refund Raptor address on your explicit per-message authorization, and inbound parsing of replies to that address. We do not read or process your other email accounts.
• RevenueCat: anonymous app user identifier, entitlement status, and transaction identifiers — used to manage paid subscription state across devices.
• Apple App Store and Google Play: subscription purchase and platform identifiers — they are the merchant of record for subscription payments.
• Apple Push Notification service and Firebase Cloud Messaging: device push tokens — used to deliver return-window alerts and store reminders you enabled.
• PostHog (product analytics, when enabled): anonymous device identifier, app version, session events — used to debug and improve reliability. You can disable analytics in the app.
• Vercel (marketing website hosting): standard request logs — used for security and uptime.
• Customer support tooling (email or ticket system you contact us through): the content of your message and any attachments you include.

We may disclose information if required by law, legal process, or to protect the rights, safety, and security of our users, the public, or Refund Raptor. Where legally permissible, we will notify affected users of a compelled disclosure.

We process and store information in the United States and other countries where our subprocessors operate. Where a transfer leaves the EEA, UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) and, where applicable, the EU–U.S. Data Privacy Framework.

We retain personal data while your account is active and as needed to provide the service, secure it, comply with law, resolve disputes, and enforce our agreements. Indicative retention windows:

• Account identifiers and preferences: lifetime of the account, plus up to 30 days after deletion to propagate across backups.
• Receipt images and parsed data: lifetime of the account, or until you delete the receipt in-app. After deletion, copies in disaster-recovery backups age out within approximately 35 days.
• Claim message drafts and supporting notes: lifetime of the parent receipt; deleted with the receipt.
• Crash logs and product analytics: up to 13 months, then aggregated or deleted.
• Server logs on the marketing website: up to 30 days for operational logs; longer for security events and billing or audit records as required.
• Subscription billing records: retained by Apple, Google, or RevenueCat per their own policies and applicable tax and consumer-protection law.

You can export your receipts (CSV, JSON, or PDF where offered) from the Data & Export section in the mobile app. You can delete individual receipts, end a subscription from the app store settings, and delete your entire account (including receipts, preferences, and device tokens) from Settings → Danger Zone → Delete Account & Data. You can also email privacy@refundraptor.com for assistance; we aim to complete verified deletion requests within 30 days.

We implement reasonable administrative, technical, and organizational safeguards designed to protect personal data — including encryption in transit (TLS), encryption at rest for cloud storage, principle-of-least-privilege access controls, and audit logging on administrative actions. No method of transmission or storage is completely secure; please protect your device and account credentials and enable device passcode or biometric lock.

Depending on where you live, you may have rights to access, correct, delete, export, restrict or object to certain processing, appeal a decision, or withdraw consent. Many controls are available directly in the app. You can also contact privacy@refundraptor.com. We will not discriminate against you for exercising privacy rights.

Refund Raptor is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children without appropriate consent. If you believe we collected information from a child in error, contact privacy@refundraptor.com and we will take appropriate steps to delete it.

Push notifications are optional. You can turn them off at any time from the in-app Notifications section or the operating system’s Settings. Store proximity reminders require approximate or foreground location access; you can revoke location at any time in device Settings, and Refund Raptor will continue to work without it.

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the effective date. If changes are material, we will provide additional notice as appropriate (including in-app notice where feasible).

Privacy questions and verified data-rights requests: privacy@refundraptor.com

General product support: support@refundraptor.com

Formal legal notices, DMCA, and security disclosures: legal@refundraptor.com

A current physical mailing address for formal service of process is available on written request to legal@refundraptor.com. Refund Raptor™, the Refund Raptor wordmark, and the raptor-head device are trademarks of Refund Raptor, Inc.