FairScan — Privacy Policy
FairScan is built by Glippin Toys, LLC. We respect your privacy. This page describes what FairScan collects, why, and how you can control it.
Summary
- No account, no email, no password. FairScan signs you in anonymously. We never ask for your name, email, phone, or social login.
- Your photos and bills. Processed in-memory only. The bill image is stored briefly so the analysis result has a thumbnail; the extracted text is never persisted to our database (privacy-critical: bills contain account numbers, dates of service, etc.).
- Anonymized price data from your scan contributes to community benchmarks — never linked to you.
- No advertising. No third-party trackers.
- Subscriptions processed by Apple, Google, RevenueCat. We never see payment details.
What we collect
| Data | Why | Retention |
|---|---|---|
| Anonymous user ID | Tie your scans, premium status, and family to one identifier | Until account deleted |
| Scan image | Display thumbnail in your history | Until you delete the scan or delete your account |
| Scan analysis (verdict, line items, summary) | Your scan history | Until you delete or delete account |
| Anonymized price data (totals only, no line items) | Build community price benchmarks | Indefinitely (anonymous) |
| ZIP code prefix (first 3 digits only) | Region-level price comparisons | While account exists |
| Push token (optional) | Send price alerts you opt into | Until you uninstall |
| Crash reports | Diagnose bugs | 90 days |
What we never collect
- Names, emails, phone numbers, mailing addresses, government IDs
- Your full ZIP (only the 3-digit prefix)
- The extracted OCR text from your bills (it contains account numbers, medical record IDs, etc. — discarded after analysis)
- Anything from advertising or tracking SDKs (we use none)
The collective price book
The most important asset in FairScan isn't any individual scan — it's the proprietary anonymous price dataset that everyone's scans build together. Every analyzed bill contributes a per-line-item, region-tagged price point (totals only — never the raw OCR text, never anything tied to you). That collective dataset is what powers the "fair / high / low" verdict for the next person who scans a similar item.
AI models in FairScan learn from the aggregated collective, not from individual records. The verdict you see is the collective wisdom of every prior anonymous contributor, applied to your specific scan.
When you delete your account, your future contributions stop and your scan history is removed. Past contributions to the collective price book were de-identified at the moment of contribution and remain in the shared dataset — they were never linkable to you in the first place.
Third parties
- Firebase — backend, crash reporting, push notifications
- Google Cloud Vision — OCR text extraction (in-flight only, not stored)
- Google Vertex AI — generates de-identified text embeddings to compare your bill against similar anonymized scans; processes only line-item text, no identity.
- Anthropic (Claude) — analysis. Anthropic's paid API does not train on customer data.
- RevenueCat — subscription processing
Your rights
- Delete account + all data: Settings → Delete Account. Irreversible, immediate. (Apple guideline 5.1.1(v) compliant.)
- Delete a single scan: swipe-to-delete in History.
- Disable push notifications: Settings → Notifications.
- Request your data: email support@glippintoys.com
Children
FairScan is not designed for or marketed to children under 13.
Contact
support@glippintoys.com
Glippin Toys, LLC