Privacy Policy

POP Over has three kinds of users: account holders (business owners and bookkeepers who sign up), crew members (people who send receipts using a crew link, without an account), and visitors to our website.

For receipts and crew information, we act as a service provider to the business that holds the account: we process that information on its behalf and at its direction. If you're a crew member with a question about your receipts, you can ask the business you work for, or contact us directly.

From account holders: your name, email address, business names, the email address receipts should be sent to, and your password. Passwords are handled by Google Firebase Authentication and stored only as a secure hash — we never see them.

From crew members: the name you type, the receipt photo you take, the job or reason you add, and the time you sent it. Your phone also keeps a random identifier and the crew links you've used, so your receipt history and business list show up on that phone. That identifier isn't tied to your real identity, and we store it only as a one-way hash.

Receipts themselves can include whatever is printed on them — for example a store name, items, prices and the last digits of a card. Please don't use POP Over for documents that aren't receipts or invoices.

Payments: Stripe collects card details directly. We never receive or store card numbers — only your subscription status and billing history.

Technical information: to keep the app reliable we record basic events such as a camera error or a failed upload, with the device type, screen size and connection type. These never include receipt images or receipt content, and they're deleted automatically after 30 days. To stop abuse, we also keep a short-lived count of submissions per crew link and per network, using a one-way hash of the IP address rather than the address itself.

• To turn crew photos into clean PDFs and email them to the address you choose.
• To store receipts so you can search, open and download them from your dashboard.
• To run your account: sign-in, password reset, bookkeeper invitations.
• To bill your subscription through Stripe.
• To keep the service secure, prevent abuse and fix problems.
• To answer you when you contact support, and to send important account notices.

We don't sell personal information, we don't use receipts for advertising, and we don't use receipts to train AI models.

Finding a receipt's edges and straightening the photo is done by software running in your browser, on your own device. The photo isn't sent to us or to any outside AI service for that step. Only the finished receipt is uploaded.

• The account holder for the business, and a bookkeeper they choose to invite.
• Each crew member can see the receipts they sent, on the phone they sent them from.
• A small number of authorized POP Over personnel, only when needed to provide support you've asked for, keep the service secure, or meet a legal obligation. This access is recorded in audit logs.
• The service providers listed below, only to run POP Over for you.

• Google Cloud / Firebase — hosting, database, file storage, sign-in.
• Stripe — subscription billing and payments.
• Resend — sending emails, including receipt emails and account notices.

Each one processes data only to provide its service to us, under its own security and privacy commitments. We'll update this list if it changes.

We may also share information if the law requires it (for example, a valid court order), to protect the safety or rights of our users or the public, or as part of a merger or sale of the business — in which case this policy continues to apply to your data.

We keep receipts and account information for as long as your account is open, so your records are there when you need them. When you delete a business in Settings, its receipts, photos, PDFs, crew records and report links are deleted right away. To close your whole account, email [email protected] and we'll delete it within 30 days.

We may keep limited billing records longer where tax or accounting law requires it. Security and audit logs are kept for a limited time and then deleted automatically.

• See and download your receipts any time from the dashboard.
• Correct your account details in the app, or by emailing us.
• Delete a business yourself, or ask us to delete your whole account.
• Ask for a copy of the personal information we hold about you.

Email [email protected] for anything you can't do in the app. We'll confirm it's really you before acting, and reply within 30 days. Depending on where you live, you may have additional rights under your state's privacy law; we'll honor those that apply to us.

We don't use advertising or cross-site tracking cookies. POP Over stores a small amount of information in your browser to keep you signed in and, on crew phones, to remember your name and the businesses you send to.

Data is encrypted in transit and at rest, access is checked on every request, and two-step sign-in is available. No system is perfectly secure, but if we learn of an incident affecting your information we'll notify you as the law requires. Details: How your receipts are protected.

POP Over is a business tool for adults. It isn't meant for anyone under 18, and we don't knowingly collect information from children.

If we change this policy, we'll update the date at the top. For significant changes, we'll email account holders before they take effect.

POP Over · [email protected]