Privacy Policy
Refunto Privacy Policy
Last updated: July 5, 2026
Effective date: July 5, 2026
This Privacy Policy explains how Refunto (“Refunto”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects your personal information when you use the Refunto mobile application and related services (the “App”).
By creating an account or using the App, you agree to this Privacy Policy. If you do not agree, please do not use the App.
For questions about this policy, contact us at privacy@refunto.com.
1. Who We Are
Data controller:
Refunto
Email: privacy@refunto.com
Website: https://refunto.com
If you are in the European Economic Area (EEA), UK, or Switzerland, Refunto is the controller of your personal data for the purposes described in this policy.
2. Information We Collect
2.1 Information You Provide
When you use Refunto, you may provide:
- Account information: email address, display name, and user ID
- Authentication data: email/password credentials, or sign-in via Apple or Google
- Refund data: store names, product names, amounts, purchase dates, refund deadlines, notes, tracking numbers, and other details you enter
- Receipt photos (Premium): images you upload from your camera or photo library
- Preferences: currency, language, theme, timezone, and notification/reminder settings
All refund and deadline information is entered by you. We do not verify it with retailers.
2.2 Information Collected Automatically
We may automatically collect:
- Device and app data: device platform (iOS/Android), app version, and push notification token (to send reminders)
- Subscription data: subscription status, plan type, and transaction identifiers (processed by Apple, Google, and RevenueCat)
- Usage analytics: anonymized or aggregated app usage events (e.g. feature usage, sign-up, refund actions) via Firebase Analytics when enabled
- Crash and error data: technical diagnostics and crash reports via Firebase Crashlytics when enabled
- Service logs: timestamps and technical records needed to operate and secure the App
We do not use the App to track your activity on other websites or apps for advertising.
2.3 Receipt Scanning (Premium Feature)
If you use receipt scanning, your receipt image is sent securely to our backend (Supabase Edge Function) for automated text extraction to help pre-fill refund fields. Extracted data is shown to you for review before saving. You are responsible for verifying all scanned information before relying on it.
Receipt images are stored in secure cloud storage linked to your account.
2.4 Information We Do Not Collect
We do not:
- Sell your personal information
- Use advertising identifiers for targeted ads
- Collect precise GPS location for tracking purposes
- Access your contacts, messages, or unrelated photos without your action
- Process refunds or communicate with retailers on your behalf
3. How We Use Your Information
We use your information only to:
- Provide and operate the App
- Store, sync, and display your refund data across your devices
- Send push notifications and scheduled reminders based on deadlines you enter
- Manage your account, authentication, and security
- Process and manage Premium subscriptions
- Store receipt photos and run receipt scanning (Premium)
- Improve reliability, fix bugs, and analyze anonymized usage
- Respond to support requests and legal obligations
- Send important service notices (e.g. policy or security updates)
We do not use your data for third-party advertising or marketing lists.
4. Reminders and Notifications — Important Limitations
Refunto is a reminder and tracking tool only. Reminders are generated from information you provide. We do not guarantee that reminders will be correct, timely, or delivered.
We are not responsible for:
- Missed reminders (including reminders not received, delayed, or not shown)
- Wrong reminders (including reminders based on incorrect dates, amounts, store names, or other data you entered)
- Incorrect reminder timing caused by timezone settings, device clock issues, or scheduling errors
- Notification failures caused by device settings (notifications disabled, Do Not Disturb, Focus modes, battery optimization)
- Failures of third-party notification services (Apple Push Notification Service, Firebase Cloud Messaging, Expo)
- Network outages, server downtime, app updates, or uninstallation
- Changes to retailer refund policies after you enter a deadline
Reminder delivery is provided on a “best effort” basis only. You remain solely responsible for verifying refund deadlines with retailers and taking action before deadlines expire.
Nothing in this Privacy Policy limits the reminder and liability disclaimers in our Terms of Service.
5. Legal Bases for Processing (EEA/UK Users)
Where GDPR applies, we process personal data based on:
- Contract: to provide the App and your account
- Consent: where required (e.g. push notifications, optional features)
- Legitimate interests: security, fraud prevention, service improvement, and analytics in anonymized form
- Legal obligation: where required by law
You may withdraw consent where processing is consent-based by adjusting App settings or deleting your account.
6. How We Store and Protect Your Data
Your data is stored using industry-standard cloud infrastructure, including:
- Supabase (PostgreSQL): account, refund, and preference data
- Supabase Storage: receipt photos
- Expo Secure Store / secure device storage: session tokens on your device
Security measures include:
- Encryption in transit (HTTPS/TLS)
- Encryption at rest (via our cloud providers)
- Row Level Security (RLS) so your data is accessible only to your account
- Access controls and monitoring for administrative access
No method of transmission or storage is 100% secure. We cannot guarantee absolute security.
7. Data Retention
- We retain your data while your account is active and as needed to provide the App
- If you delete your account, we delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business records (e.g. billing records handled by Apple/Google/RevenueCat)
- Anonymized analytics may be retained longer and cannot reasonably identify you
8. Third-Party Services
We use trusted service providers to operate the App. They process data only as needed to provide their services to us:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, auth, storage, edge functions | Account, refund data, photos, tokens |
| RevenueCat | Subscription management | User ID, subscription status, transaction IDs |
| Apple / Google | Sign-in, app distribution, billing | OAuth/account identifiers, purchase records |
| Expo / Firebase | Push notifications | Push token, notification content |
| Firebase (Google) | Analytics and crash reporting (when enabled) | App usage events, crash diagnostics |
| OpenAI (via our backend) | Receipt text extraction (Premium scan) | Receipt image sent for processing |
Each provider has its own privacy policy. We encourage you to review them:
- Supabase: https://supabase.com/privacy
- RevenueCat: https://www.revenuecat.com/privacy
- Google/Firebase: https://firebase.google.com/support/privacy
- Expo: https://expo.dev/privacy
- Apple: https://www.apple.com/privacy/
- OpenAI: https://openai.com/policies/privacy-policy
We do not sell or rent your personal information to third parties.
We may disclose information if required by law, court order, or to protect rights, safety, and security.
9. International Data Transfers
Your data may be processed in countries outside your country of residence, including the United States and EU data centers used by our providers.
Where required, we rely on appropriate safeguards such as Standard Contractual Clauses and provider compliance programs.
10. Your Privacy Rights
Depending on your location, you may have the right to:
- Access your personal data
- Correct inaccurate data (directly in the App or by contacting us)
- Export your data (in-app export or by email request)
- Delete your account and associated data
- Restrict or object to certain processing
- Withdraw consent where processing is consent-based
- Lodge a complaint with your local data protection authority (EEA/UK)
How to exercise your rights
- In the App: Profile → Terms & Privacy → Export Data; Profile → Security Settings → Delete Account
- By email: privacy@refunto.com
- Subject examples: “Data Access Request”, “Data Export Request”, “Delete My Account”
We respond within 30 days, or as required by applicable law.
We will not discriminate against you for exercising your privacy rights.
11. California Privacy Rights (CCPA/CPRA)
If you are a California resident:
- We collect the categories of personal information described in Sections 2 and 3
- We use this information for the business purposes described above
- We do not sell or share personal information for cross-context behavioral advertising
- You have the right to know, delete, and correct personal information, and to limit use of sensitive personal information where applicable
To submit a request: privacy@refunto.com
12. Children’s Privacy
Refunto is not intended for children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children.
If you believe a child has provided us data, contact privacy@refunto.com and we will delete it promptly.
13. Cookies and Tracking (Website)
The Refunto mobile app does not use advertising cookies.
Our website (refunto.com) may use minimal functional cookies required to operate the site. We do not use the website for cross-app advertising tracking.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by:
- Updating the “Last updated” date on this page
- In-app notice and/or email where appropriate
Continued use of the App after changes take effect means you accept the updated policy.
15. Contact Us
Privacy inquiries: privacy@refunto.com
General support: support@refunto.com
Website: https://refunto.com
Privacy Summary
| Topic | Summary |
|---|---|
| What we collect | Account info, refund data you enter, optional receipt photos, device push token, subscription status, anonymized usage/crash data |
| Why we collect it | To run the App, send reminders, sync data, manage subscriptions, improve reliability |
| Who we share with | Service providers only (Supabase, RevenueCat, Apple/Google, Expo/Firebase, OpenAI for receipt scan) |
| What we don’t do | Sell data, run ads, track you outside the App, process refunds for you |
| Reminders | Best effort only — we are not responsible for wrong or missed reminders |
| Your rights | Access, export, correct, delete — contact privacy@refunto.com |