Expra

Effective: 2026-05-02 · Last updated: 2026-08-24

Expra ("we", "our") is published by OOTSSU. This policy describes what data Expra collects, why, and how to remove it.

What we collect

• Account identity (Apple Sign In sub, Google sub, or email hash) — stored on Supabase to enable account management and cross-device sync.
• Expense records (vendor name, amount, date, category, notes) — entered manually or extracted by AI scan. Stored encrypted on Supabase.
• Receipt images — when you use AI scan, the image is sent to our expra-scan Edge Function for text extraction and deleted immediately after. Original images are never stored on our servers.
• Camera & photo library access — used only when you photograph a receipt or select an image from your gallery. Access is granted only with your permission; images are cleared from app memory after scanning.
• Subscription status — verified via RevenueCat. Payment details are handled by the Apple App Store and are never stored on our servers.

Cloud transmission

Only the receipt image is sent to our expra-scan Edge Function during an AI scan. It is used solely to extract text via Anthropic's Claude API and is deleted from our servers immediately after extraction; we never store the original image. On Anthropic's side, request inputs and outputs are deleted within 30 days under its standard commercial API terms — we do not hold a zero-data-retention agreement. No GPS, contacts, or other personal data is transmitted.

How we use your data

• Account authentication and cross-device data sync
• AI receipt categorization and monthly expense reports
• Subscription management and Pro feature access

Third-party processors

We do not sell or share your data for advertising or marketing. We work with the following processors to run the service:

• Supabase — database and authentication (supabase.com)
• Anthropic (Claude) — AI receipt text extraction (anthropic.com)
• RevenueCat — subscription management (revenuecat.com)

Account deletion

Tapping Settings → Account → Delete Account calls our expra.delete_account() RPC, which immediately and irreversibly removes every record tied to your account from Supabase — receipts, categories, and account info. There is no grace period and no restore. The local SwiftData store on your device is also wiped in the same action.

Tracking

Expra does not track you across other apps or websites. The App Tracking Transparency prompt may appear because our subscription provider (RevenueCat) links to the IDFA at the SDK level; we do not use it for tracking.

Children

Expra is not directed to children under 13. We do not knowingly collect data from children under 13.

Contact

ootssu@ootssu.com