🔒 ReceiptHubAI Privacy Statement
At Intuidat Ltd, we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Statement explains how ReceiptHubAI handles your data, what information we collect, and most importantly, what we do NOT do with your information.
🛡️ Our Core Privacy Guarantee:
ReceiptHubAI operates entirely on your local machine. Your emails, credentials, API keys, and all personal data NEVER leave your computer and are NEVER transmitted to Intuidat Ltd, third parties, or any external servers (except when you explicitly use OpenAI's API to process emails, which is under your control).
ReceiptHubAI is a desktop application designed with privacy at its core. Unlike cloud-based email services, ReceiptHubAI runs entirely on your computer. This fundamental architecture ensures maximum privacy and control over your data.
🔐 Core Privacy Principles:
- Zero Transmission to Developers: Intuidat Ltd (the developers of ReceiptHubAI) never receives, sees, or has access to your emails, credentials, API keys, or any processed data.
- Local-Only Processing: All email processing, categorization, and data extraction happens on your local machine.
- No Data Collection: We do not collect, track, or analyze your usage patterns, email content, or personal information.
- No Telemetry: ReceiptHubAI does not send diagnostic data, crash reports, or usage statistics to Intuidat Ltd or any third parties.
- Complete User Control: You have full control over all your data - where it's stored, how it's processed, and when it's deleted.
❌ ReceiptHubAI and Intuidat Ltd DO NOT:
- Transmit your emails to any server, including Intuidat Ltd servers
- Store your emails on any external or cloud-based servers
- Access your email credentials - authentication is handled directly between you and your email provider (Gmail/Outlook)
- Share your data with third parties, advertisers, or data brokers
- Collect analytics about your usage or email content
- Track your activity or monitor your behavior
- Send telemetry data to Intuidat Ltd or any analytics services
- Create user profiles or build databases of user information
- Sell your data - we have no data to sell
All data processed by ReceiptHubAI is stored exclusively on your local computer in your user directory:
Data Storage Locations:
Windows:
C:\Users\{YourUsername}\receipthubai\ - Application data and projects (EXE mode)C:\Users\{YourUsername}\ReceiptHubAIProjects\ - Application data and projects (development mode)C:\Users\{YourUsername}\receipthubai\keys\ - Encrypted API keys for EXE mode (see section 6)C:\Users\{YourUsername}\ReceiptHubAIProjects\keys\ - Encrypted API keys for development mode (see section 6)- Project-specific folders contain processed email data, extracts, and attachments
macOS/Linux:
~/.receipthubai/ - Application data and projects~/.receipthubai/keys/ - Encrypted API keys- Project-specific folders contain processed email data, extracts, and attachments
🔒 Local Storage Security:
- All data remains on your machine - it never leaves your computer
- Data is stored in your user directory, protected by your operating system's file permissions
- Sensitive data (API keys) is encrypted using military-grade encryption (see section 6)
- You can delete all data at any time by removing the application directory
⚠️ Important Note: While ReceiptHubAI stores your data locally, you are responsible for:
- Keeping your computer secure with appropriate passwords and security measures
- Using antivirus software and keeping your operating system updated
- Backing up your data if needed (ReceiptHubAI provides backup functionality)
- Being aware that data on your local machine may be accessible to anyone with physical or remote access to your computer
Email Access and Processing:
ReceiptHubAI accesses your emails using secure OAuth2 authentication protocols provided by your email service (Gmail or Outlook). This means:
- No Password Storage: ReceiptHubAI never stores or has access to your email account passwords
- OAuth Tokens: Authentication is handled through secure OAuth tokens stored locally on your machine
- Direct Communication: ReceiptHubAI communicates directly with Gmail/Outlook APIs - Intuidat Ltd is not involved in this process
- Read-Only Access: ReceiptHubAI only requests read-only access to your emails - it cannot modify, delete, or send emails
Email Content Handling:
✅ Email Privacy Guarantee:
- Local Processing Only: Email content is downloaded to your computer and processed locally
- No External Transmission: Email content is never sent to Intuidat Ltd servers
- No Cloud Storage: Emails are not uploaded to any cloud service (except when you explicitly use OpenAI API - see section 7)
- You Control What's Processed: You explicitly select which emails to process
- No Background Monitoring: ReceiptHubAI does not automatically scan or monitor your email accounts
📧 Gmail and Outlook Privacy:
When you authenticate ReceiptHubAI with your Gmail or Outlook account, you grant permissions directly to ReceiptHubAI. Intuidat Ltd is not a party to this authentication. The OAuth tokens are stored locally on your machine and are used only to access your emails when you explicitly request a search or processing operation.
Email Account Credentials:
ReceiptHubAI uses OAuth2 for secure authentication with Gmail and Outlook. Here's what this means for your privacy:
🔐 Credential Security:
- No Password Storage: ReceiptHubAI never sees, stores, or has access to your email account passwords
- OAuth Tokens: Instead of passwords, ReceiptHubAI uses OAuth tokens that you grant through your email provider's secure authentication process
- Token Storage: OAuth tokens are stored locally in your application data directory, encrypted by your operating system's security features
- Token Expiration: OAuth tokens expire periodically and must be refreshed - this is handled automatically when you re-authenticate
- Revocable Access: You can revoke ReceiptHubAI's access at any time through your Gmail/Outlook account settings
⚠️ Authentication Security:
While ReceiptHubAI stores OAuth tokens locally, you should:
- Keep your computer secure with a strong password or biometric authentication
- Enable full-disk encryption on your computer if handling sensitive information
- Be cautious when sharing your computer with others
- Regularly review which applications have access to your email accounts through your email provider's security settings
No Credential Sharing:
Intuidat Ltd and ReceiptHubAI DO NOT:
- Share your OAuth tokens with third parties
- Transmit authentication credentials over the internet (except during the OAuth flow, which is handled by Gmail/Outlook)
- Store credentials on external servers
- Have access to your credentials for any purpose other than accessing your emails when you explicitly request it
ReceiptHubAI requires an OpenAI API key to process emails using AI. Your API key is one of the most sensitive pieces of information, and we've implemented military-grade encryption to protect it.
Military-Grade Encryption System:
🔐 Encryption Features:
- 256-bit AES Encryption: Your API key is encrypted using industry-standard AES-256 encryption
- PBKDF2 Key Derivation: Uses 100,000 iterations of PBKDF2 for brute-force protection
- Machine-Specific Encryption: Encryption keys are derived from your computer's unique hardware characteristics
- One-Way Encryption: Once encrypted and stored, your API key cannot be retrieved in plain text - not even by you
How API Key Storage Works:
When you store your OpenAI API key:
- You enter your API key into ReceiptHubAI
- The key is immediately encrypted using a key derived from your computer's unique hardware fingerprint
- The encrypted key is stored in a secure binary file:
~/.receipthubai/keys/encrypted_keys.dat
- The original plain-text key is immediately discarded from memory
⚠️ CRITICAL: API Keys Cannot Be Retrieved
Once your OpenAI API key is encrypted and stored:
- It cannot be retrieved in plain text - not even by you, the user
- Intuidat Ltd cannot retrieve it - even developers cannot access your key
- No recovery mechanism exists - this is intentional for security
- If you forget your key, you must obtain a new one from OpenAI
This is a security feature, not a limitation. By making keys unrecoverable, we ensure that even if someone gains access to your encrypted key file, they cannot decrypt it without your original key and your specific computer's hardware fingerprint.
Machine-Specific Encryption:
The encryption key is derived from your computer's unique characteristics:
- Windows: Uses Windows Product ID and hardware information
- macOS/Linux: Uses hostname and system architecture
This means:
- Your encrypted API key can only be decrypted on the same computer where it was encrypted
- If you move to a new computer, you'll need to re-enter your API key
- Keys cannot be transferred between computers - this prevents key theft
API Key Verification:
Since keys cannot be retrieved, ReceiptHubAI uses a verification system:
- When you want to verify your stored key, you enter it again
- ReceiptHubAI encrypts your input and compares it to the stored encrypted version
- This is the only way to check if a key matches - by re-encrypting and comparing
💡 Best Practice:
Store your OpenAI API key in a secure password manager before entering it into ReceiptHubAI. Once stored in ReceiptHubAI, you won't be able to retrieve it if you forget it.
When Data Is Transmitted:
ReceiptHubAI operates locally on your computer, with one exception: when you explicitly process emails using AI, ReceiptHubAI sends email content to OpenAI's API. This is necessary for AI-powered categorization and data extraction.
📡 OpenAI API Transmission:
- Explicit User Action: Data is only sent to OpenAI when you explicitly click "Process Selected" or similar actions
- Direct Communication: ReceiptHubAI communicates directly with OpenAI's API using your API key - Intuidat Ltd is not involved
- Your API Key: You use your own OpenAI API key, which you control through your OpenAI account
- OpenAI's Privacy Policy: When data is sent to OpenAI, it is subject to OpenAI's privacy policy and terms of service
What Data Is Sent to OpenAI:
When processing emails with AI, ReceiptHubAI sends the following to OpenAI's API:
- Email Content: The text content of the email(s) you're processing
- Email Metadata: Subject, sender, date, and other header information
- Processing Instructions: Prompts that tell OpenAI how to categorize and extract data
- Your API Key: Used to authenticate with OpenAI (transmitted securely over HTTPS)
⚠️ Important: OpenAI Privacy Considerations
When you process emails using OpenAI:
- Email content is transmitted to OpenAI's servers for processing
- OpenAI may use this data according to their privacy policy (please review OpenAI's privacy policy)
- OpenAI may store or log API requests (check OpenAI's documentation for current policies)
- You are responsible for understanding OpenAI's data handling practices
- You can review your API usage and any stored data through your OpenAI account
Intuidat Ltd has no control over how OpenAI handles data sent to their API. We recommend reviewing OpenAI's privacy policy at https://openai.com/privacy.
What Is NOT Sent to OpenAI:
✅ Never Transmitted:
- Your email account passwords
- OAuth tokens
- Other API keys (beyond the OpenAI key used for that specific request)
- Your computer's hardware information
- Your personal information (unless it's in the email content itself)
- Data about which emails you search for (only processed emails are sent)
Controlling AI Processing:
You have complete control over when data is sent to OpenAI:
- Processing only happens when you explicitly request it
- You select which specific emails to process
- You can choose not to use AI features at all (though some features require AI processing)
- You can review processed emails before they're sent (though the send happens automatically when you click "Process")
✅ You Own and Control All Your Data:
- Complete Ownership: All data processed by ReceiptHubAI belongs to you
- Local Storage: All data is stored on your computer, under your control
- Delete Anytime: You can delete any or all data at any time
- Export Capabilities: You can export your processed data to Excel or other formats
- No Data Retention: Intuidat Ltd does not retain any of your data - we don't have access to it
- Backup Control: You control if and how you back up your data
Deleting Your Data:
You can delete your ReceiptHubAI data at any time:
- Delete Projects: Remove entire projects through the Project Manager
- Delete Individual Emails: Remove processed emails from within the application
- Delete All Data: Remove the entire
~/.receipthubai/ directory to delete everything
- Uninstall: Uninstalling ReceiptHubAI leaves your data intact - you must manually delete it if desired
Data Portability:
Your data is portable and accessible:
- Processed data can be exported to Excel format
- All data is stored in standard formats (JSON, text files) that can be read by other applications
- You can copy project folders to other locations or computers
- There are no proprietary formats that lock your data into ReceiptHubAI
Email Providers (Gmail, Outlook):
ReceiptHubAI integrates with Gmail and Outlook using their official APIs. When using these services:
- You authenticate directly with Google or Microsoft
- Your email provider's privacy policy applies to their services
- Intuidat Ltd is not a party to your relationship with your email provider
- ReceiptHubAI requests read-only access to your emails
OpenAI API:
As described in section 7, ReceiptHubAI uses OpenAI's API when you process emails with AI. This is the only external service that receives any of your data, and it only happens when you explicitly request AI processing.
No Other Third Parties:
✅ Intuidat Ltd Does Not Use:
- Analytics services (Google Analytics, etc.)
- Crash reporting services
- Usage tracking services
- Advertising networks
- Data brokers or resellers
- Any other third-party services that would receive your data
Intuidat Ltd and ReceiptHubAI implement multiple security measures to protect your privacy:
Technical Security:
- Local-Only Processing: All processing happens on your computer
- Encrypted API Key Storage: Military-grade encryption for sensitive keys
- OAuth2 Authentication: Industry-standard secure authentication
- HTTPS Communication: All external API calls use encrypted HTTPS
- No Network Listening: ReceiptHubAI does not listen for incoming network connections
Architectural Security:
- No Central Servers: There are no ReceiptHubAI or Intuidat Ltd servers that store your data
- No User Accounts: ReceiptHubAI doesn't require user accounts, so there's no user database
- No Cloud Synchronization: Data doesn't sync to the cloud
- Minimal Network Activity: Only necessary API calls to email providers and OpenAI
⚠️ Your Security Responsibilities:
While we've implemented strong security measures, you also play a role:
- Keep your operating system and ReceiptHubAI updated
- Use strong passwords or biometric authentication on your computer
- Enable full-disk encryption if handling sensitive information
- Use antivirus software and keep it updated
- Be cautious about physical access to your computer
- Don't share your computer with untrusted individuals
Under various privacy laws (GDPR, CCPA, etc.), you have rights regarding your personal data. Since ReceiptHubAI operates locally and Intuidat Ltd does not collect or process your personal data, most traditional privacy rights don't apply in the traditional sense. However:
Your Rights with ReceiptHubAI:
✅ You Have the Right To:
- Access: Access all your data stored by ReceiptHubAI (it's all in your local directories)
- Delete: Delete any or all of your data at any time
- Export: Export your processed data to Excel or other formats
- Control: Control which emails are processed and when
- Opt-Out: Choose not to use AI processing features (though some features require AI)
- Revoke Access: Revoke ReceiptHubAI's access to your email accounts through your email provider's settings
- Uninstall: Uninstall ReceiptHubAI at any time
Data Subject Rights (GDPR, etc.):
Since Intuidat Ltd does not collect, store, or process your personal data:
- We don't maintain databases of user information
- We cannot provide copies of data we don't have
- We cannot delete data we don't have
- We cannot restrict processing of data we don't process
If you have concerns about data processed by OpenAI, you should contact OpenAI directly, as they are the data processor for AI processing requests.
Intuidat Ltd may update this Privacy Statement from time to time to reflect changes in ReceiptHubAI's features or to clarify our practices. However, our core commitment to privacy - that your data never leaves your computer and is never shared with Intuidat Ltd or third parties - will not change.
If we make significant changes to this Privacy Statement, we will:
- Make the updated statement available in the application
- Highlight significant changes in application updates
We encourage you to review this Privacy Statement periodically to stay informed about how we protect your privacy.
If you have questions, concerns, or requests regarding this Privacy Statement or ReceiptHubAI's privacy practices, you can contact Intuidat Ltd:
Intuidat Ltd
For privacy inquiries, please use the contact information provided in the application's About dialog or visit the application's support resources.
Note: Since ReceiptHubAI operates entirely on your local machine and Intuidat Ltd does not have access to your data, we may not be able to assist with data-related requests beyond providing guidance on how to access or delete your locally stored data.
🛡️ Summary: Your Privacy is Our Priority
ReceiptHubAI is designed with privacy at its core. Your emails, credentials, API keys, and all personal data remain on your computer and are never transmitted to Intuidat Ltd, third parties, or any external servers (except when you explicitly use OpenAI's API). You have complete control over your data, and we have no access to it.
If you have any questions or concerns about privacy, please review this statement or contact Intuidat Ltd.
⬆ Back to Top
Last Updated: January 2024
ReceiptHubAI by Intuidat Ltd