Privacy policy

Short version: we read the photo you take, we write the rows you accept to your Google Sheet, and we keep only what running your account and credits needs. We do not sell your data, we do not use it for ads, and we do not use it to train AI models.

Google user data we receive

• Your Google account id and email address. We use them to identify your account, to send the emails you ask for, and to check admin access on our server.
• A Google OAuth refresh token. It is the key that lets zippp write to the sheet you connect, and it is encrypted on our servers.
• The spreadsheet id and tab names of the sheet you connect, plus its first row. We read the first row to map your columns.
• With the Drive file permission, only files zippp created or you picked here: we read the file id and name to find your [zippp] sheet.

We do not read your data rows and we do not browse your Drive.

How we use it, per permission

• spreadsheets: write the rows you accept, and the header row when zippp creates the sheet. Read the first row and the tab names only.
• drive.file: find or create your [zippp] spreadsheet, so you do not have to paste a link.
• userinfo.email: identify you, keep sessions separate, send account emails, and decide admin access on the server.

We do not use Google user data for advertising or profiling, and we do not use it to train AI models.

What never goes to an AI provider

The photo you take is not Google user data, and the two paths stay apart in code:

• The photo goes to Baidu AI Studio (PaddleOCR) to read text, then to DeepSeek to structure it. Gemini is the backup if those fail.
• Those providers receive only that one photo, or the text read from it. They never receive your Google account data, your sheet contents, your spreadsheet id, or your Drive files.
• The read path does not load your Google token at all.

Who we share data with

We do not sell your data, and we do not share it with advertisers or data brokers. We share it only with the providers that run zippp, and only as far as each one needs it:

• Google. The Sheets and Drive calls described above.
• Vercel. Hosting and server logs.
• Upstash. Encrypted storage for your account record, token, sheet setup, and credit ledger.
• Mailtrap. Sends the emails you ask for, to the address on your account.
• Telegram. Admin alerts with order number, email, and amount. No sheet contents.
• Paddle and Kasera Pay. Payments. They do not receive Google user data.

If the law requires disclosure, we disclose and we tell you unless we are barred from telling you. If zippp changes operator through a sale or merger, records move with it under this policy.

How we protect it

• TLS for every request and every API call.
• OAuth tokens are encrypted at rest with AES-256-GCM, using a key held only in server environment variables. Tokens never reach your browser.
• Least privilege: three permissions, spreadsheets, drive.file, and your email address. No Gmail, no full Drive, no contacts.
• Admin pages check the signed-in email on the server and return 404 for anyone else.
• Analytics record page views and basic device information. Text you type, receipt values, and sheet contents are not sent.
• Production records are reachable only by the operator.

Limited Use

zippp's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we store

• Your Google account id and email.
• Your Google OAuth tokens, encrypted at rest. The permissions above say what each one allows.
• Your sheet setup: spreadsheet id, tab names, column map, staff names, outlets.
• Your credit ledger: top ups, spends, refunds, referral rewards, and payment order records.
• Extraction logs: timings and which provider answered. No receipt values and no images.
• Correction counts when you accept a card: a short one-way hash of your user id, which fields you edited, and whether they were flagged. No values and no images.

What we do not store

• Receipt photos. The image is processed and dropped. It lives in your browser only until the rows are sent.
• Receipt rows. They go to your Google Sheet and nowhere else.
• Card numbers or wallet credentials. Payments are handled by the payment provider.

Optional photo donation

If a photo cannot be read, zippp may offer to save it to help improve reading. This happens only if you tap yes. The image and the failure reason are stored in the operator's Google Drive, in the folder [zippp] donations, with no link to your account or your sheet. You can ask us to delete it.

Hosting and payments

zippp runs on Vercel. Account records are stored in Upstash Redis. Indonesian top ups go through Kasera Pay (QRIS), with a manual GoPay transfer as a fallback. International top ups go through Paddle. Payments reach neither our servers nor our database as card or account numbers. Admin alerts go through Telegram and contain order number, email, and amount. Vercel Analytics and PostHog record page views and basic device information.

Cookies

A session cookie keeps you signed in. A region cookie remembers which language and currency you saw. A referral cookie remembers an invite code for 30 days. No advertising cookies.

Deleting your data

Sign out in Settings: the stored token and your sheet setup are deleted from our servers at once. To remove zippp's access at Google as well, remove it at Google permissions. To delete your account record and the credit ledger, email us from the Google address on the account (see the contact page). Rows in your sheet are yours and are never deleted by zippp.

Changes

We update this page when something changes and show the date at the top.

Contact

Aldan Arkara. See contact.