FairScan — Privacy Policy
FairScan is built by Glippin Toys, LLC. We respect your privacy. This page describes what FairScan collects, why, and how you can control it.
Summary
- No sign-up, no email, no password. FairScan signs you in anonymously. We never ask for your name, email, phone, or social login.
- Your photos and bills. The bill photo is uploaded to our storage so our server can read it, and is kept with your scan until you delete the scan. The extracted text is never persisted to our database (privacy-critical: bills contain account numbers, dates of service, etc.).
- Anonymized price data from your scan contributes to community benchmarks — never linked to you.
- No advertising. No third-party trackers.
- Subscriptions processed by Apple, Google, RevenueCat. We never see payment details.
What we collect
| Data | Why | Retention |
|---|---|---|
| Anonymous user ID | Tie your scans, premium status, and family to one identifier | Sign-in record removed when you delete your account |
| Scan image | Uploaded so our server can read the bill for analysis | Until you delete the scan |
| Scan analysis (verdict, line items, summary) | Your scan history | Until you delete or delete account |
| Anonymized price data | Build community price benchmarks | Indefinitely (anonymous) |
| ZIP code (the 5 digits you enter; the first 3 are also stored with each scan) | Medical-bill price lookups against CMS Medicare data | While account exists |
| Basic in-app usage events (e.g. paywall viewed, trial started) | See where the app confuses people or fails, so we can fix it — first-party only, no third-party analytics SDK | |
| Push token (optional) | Send price alerts you opt into | Until you turn off notifications or delete your account |
| Crash reports | Diagnose bugs | Held by Google under Firebase Crashlytics’ own retention period |
What we do not ask for or save
- Names, emails, phone numbers, mailing addresses, government IDs as account details (a bill you photograph may show them, and that photo is saved with your scan)
- The extracted OCR text from your bills (it contains account numbers, medical record IDs, etc. — discarded after analysis)
- Anything from advertising or tracking SDKs (we use none)
The collective price book
FairScan builds an anonymous price dataset from users' scans. Every analyzed bill contributes anonymous price figures (a category-level total and, for medical bills, per-procedure-code amounts — never the raw OCR text, never your user ID) to a nationwide, category-level dataset. Where we have data for a category, those aggregate figures are given to the AI model as one input to the "fair / high / low" verdict for the next person who scans a similar item.
When you delete your account, your future contributions stop and your scan history is removed. Past contributions to the collective price book were de-identified at the moment of contribution and remain in the shared dataset — they were never linkable to you in the first place.
To judge whether a price is fair, FairScan may show the AI model up to five similar scans from other FairScan users: their line-item descriptions, amounts, verdicts and the first 3 digits of their ZIP, never their user ID, photo or extracted text. Your own scan can be shown the same way to other users' analyses until you delete the scan or your account.
If a scan is rated high and you saved a ZIP code, FairScan publishes an anonymous card (category, verdict, the first 3 digits of your ZIP, total and potential savings) to the Community tab, visible to all FairScan users. These cards are not removed when you delete your account.
Third parties
- Firebase — backend, crash reporting, push notifications
- Google Cloud Vision — OCR text extraction (in-flight only, not stored)
- Anthropic (Claude) — analysis.
- RevenueCat — subscription processing
Google Cloud Vision receives your bill photo to read its text. Anthropic receives the extracted text of your bill and, for medical-procedure lookups, your search text and 5-digit ZIP. Google Vertex AI receives up to the first 1,500 characters of the extracted text to find similar scans, and the line items and verdict of saved scans to index them.
Your rights
- Delete your account and scans: Settings → Delete Account. Irreversible, immediate.
- Delete Account does not cancel a subscription (cancel it in your App Store or Google Play settings) and does not remove anonymous aggregates or community cards, or records held by Apple, Google and RevenueCat.
- Delete a single scan: swipe-to-delete in History.
- Disable push notifications: Settings → Notifications.
- Request your data: email support@glippintoys.com
Children
FairScan is not designed for or marketed to children under 13.
Contact
support@glippintoys.com
Glippin Toys, LLC