Privacy Policy

1. Overview

This policy explains what data the Hipzap wallet and receipt bookkeeping features collect, where it is stored, and the choices you have. It covers the wallet product only.

2. What we collect

We collect only what the features need to work:

• Membership cards — brand name, card number or barcode, and an optional photo of the card.
• Receipt images — photos you take to record an expense, which are sent to an AI service to extract details.
• Expense records — amounts, categories, dates, and any notes you add.
• Preferences — your chosen language and currency.
• Account — if you bind one, your email address (used for verification codes and account recovery).

3. Where your data is stored

As a guest, your cards, expense records, and preferences are stored on your device (local storage) or in your Telegram cloud storage, which is tied to your Telegram account and synced by Telegram — not by us. We do not hold this data on our servers.

Once you bind an email address, your cards and expense records are stored on our servers so they can sync across your devices.

4. Third-party services

We share the minimum necessary with a small number of providers:

• Google Gemini — receipt images you scan are processed to extract merchant, amount, and date.
• Email provider — used to send verification codes and account notifications when you bind an email.

5. How we use your data

We use your data solely to provide the wallet and bookkeeping features — to store and display your cards, extract and categorise expenses, sync bound accounts across devices, and secure your account. We do not sell your data or use it for advertising.

6. Your rights

You are in control of your data:

• Delete your account — from your account settings. Deletion soft-deletes and anonymises your data (GDPR Article 17).
• Access and correct — view and edit your cards and expense records at any time in the app.
• Guest data — clearing the app or your Telegram cloud storage removes guest data from that surface.

7. Data retention

Bound-account data is kept until you delete it or close your account. Guest data lives only on your device or in your Telegram cloud storage for as long as you keep it there.

8. Children

The Service is not directed at children under 13, and we do not knowingly collect their data.

9. Changes

We may update this policy as the Service evolves. Material changes will be reflected by the “last updated” date above.