Privacy Policy
Last updated: June 2026
In plain language: we use your receipt only to find gluten-free items you can claim. We don't sell your data. Your doctor's Letter of Medical Necessity is combined with your report inside your browser and is never uploaded to or stored on our servers.
What we collect
- Account info: your name and email (or your Google profile if you sign in with Google).
- Receipts you upload: the image or PDF, and the line items, prices, store, and date we read from it.
- Claims: the reports you generate and whether you've marked them submitted.
- Subscription status: handled by our payment processor; we don't see or store your full card number.
- Basic usage data: to keep the service working and improve our reading accuracy.
What we do NOT do
- We do not sell or rent your personal data.
- We do not store your doctor's letter. It's merged into your PDF locally, in your browser, and only you download it.
- We do not file claims for you. You always submit to your administrator yourself.
Cookies
We use two cookies, both set by us. Neither is an advertising cookie, and we do not use any third-party analytics or tracking scripts.
- A sign-in cookie, so you stay logged in between pages.
- A referral cookie, which records only how you first arrived — for example that you came from a link in a Facebook post. It holds a random identifier, never your name, email, health information, or anything about your receipts. We use it to know which posts are worth writing, and nothing else. It expires after 90 days, and clearing your browser's cookies removes it.
Third parties that process your data
- An AI service (OpenAI) reads the text and items from your receipt image.
- Stripe processes payments.
- Resend sends transactional email (e.g. password resets).
- Google: only if you choose "Sign in with Google."
- Our hosting provider stores the application and your account data.
How long we keep it
- Your account, receipts, and claims stay until you delete them or close your account.
- Generated claim PDFs are automatically deleted from our servers after about 7 days.
Your choices
You can delete your account and everything in it yourself: open your dashboard and use "Delete my account and data." It removes your receipts, receipt images, claims, and profile, and cancels any subscription. You can also remove individual receipts and claims from your dashboard, or email us (see below) and we will do it within 30 days.
Consumer health data
Because the tool identifies items bought for a medically necessary gluten-free diet, some of what we hold counts as consumer health data under Washington, Nevada, and Connecticut law. Our separate Consumer Health Data Privacy Policy lists exactly what that is, who processes it, how long we keep it, and how to delete it.
Security
Passwords are stored hashed, and payment details are handled by Stripe rather than stored by us. No method of transmission or storage is perfectly secure, but we take reasonable steps to protect your information.
Not tax, legal, or medical advice
GF Savings helps you prepare documentation based on IRS Publication 502 guidance. We are not affiliated with or endorsed by the IRS, and nothing here is tax, legal, or medical advice. Consult your administrator, tax professional, or physician for your specific situation.
Contact
Questions or deletion requests: [email protected].