Security & Data Practices at Taxr

Taxr handles your business expenses, so you deserve to know exactly how your data is treated — in plain language, not legal fog. This page is the short, honest version. The formal documents are the Privacy Policy and Deletion Policy.

The short version

• Your data travels encrypted, is stored in managed cloud infrastructure, and is never sold.
• Receipt images are processed by an AI model under API terms that do not allow your data to be used for model training.
• We never ask for your bank login. Ever.
• Everything exports to Excel or PDF at any time — your records are yours.
• Deleting your account deletes your data.

How your data flows

Capture. You photograph a receipt (or upload a PDF). The image travels to our servers over an encrypted connection (HTTPS/TLS).

Extraction. The image is processed via the OpenAI API to extract the vendor, date, total, and tax. Under OpenAI’s API terms, data sent through the API is not used to train their models. The extraction lands on a review screen in your app — you see and can correct what the AI read before it becomes a record.

Storage. Receipt images and records are stored in managed cloud infrastructure (Amazon S3 for images, with our application database on managed hosting). Access is restricted to your authenticated account — and, only if you explicitly invite them, your accountant through the accountant portal.

Export. Your complete records — categorized expenses with receipt images — export to Excel and PDF whenever you want. If Taxr disappeared tomorrow, your records wouldn’t.

What we never do

• No bank logins. Taxr works from receipts you choose to scan. We never ask you to connect a bank account, and we never see your banking credentials.
• No selling data. Your expense data is not sold, rented, or shared with advertisers. Our revenue is subscriptions — you are the customer, not the product.
• No payment card handling. Subscriptions are processed entirely by Apple’s App Store and Google Play. Your card details never touch our servers.
• No silent sharing with accountants. An accountant sees your records only after you accept or send an explicit invitation, and you can disconnect at any time.

Account deletion

Deleting your account removes your receipts, records, and personal data from our systems, as described in the Deletion Policy. Export your records first if you want to keep them — deletion is designed to be real, not a soft-hide.

Data retention and tax rules

Tax authorities generally require you to keep business records for several years (five years in Australia and the UK; at least three in the US). Taxr keeps your records available for as long as your account exists, so meeting those retention duties is automatic rather than a filing-cabinet problem. When you leave, take your export with you.

Questions or reports

Found a security issue, or want more detail before trusting us with your records? We’d genuinely rather you ask. Reach us through the contact page — security reports get priority attention.

Last reviewed: August 2026. This page describes our practices in plain language; where it differs from the Privacy Policy, the Privacy Policy governs.