Privacy
What Tratobor does with your data, in plain words. If anything here reads as evasive, that's our fault — write to us and we'll fix the wording.
Last updated October 20, 2026
The short version
- • Your receipts, expenses and cards are yours — kept for you, shown to nobody else.
- • Receipt photos and screenshots are read on our own server and not kept: a photo is handled in memory, a PDF sits in a temporary file only while it is being read.
- • Spreadsheets are parsed in your browser and thrown away — we don't keep the file.
- • Without an account (guest mode) a receipt photo is read the same way and not kept, and your receipts and spending stay on your device only; a random device marker, which doesn't identify you, counts the free photos.
- • Your records are stored on our own server in Finland, in the European Union. On the way there, requests pass through Cloudflare's network — details below.
- • No advertising trackers. Visitor statistics on the website (Google Analytics) run only if you consent; the mobile app has none.
- • Separately, we keep our own usage statistics — no cookies, no third-party service, none of your receipts or amounts; you can switch them off under “Our own usage statistics” below.
- • We don't sell your data and don't hand it to ad networks. Ever.
- • One button in Account deletes the account and everything it kept in sync; backup copies catch up within 60 days.
- • Pharmacy receipt lines (medicine names) are kept only with your separate, optional explicit consent; without it a pharmacy receipt is saved as a total.
Who is responsible
Tratobor (tratobor.com) is run by Andrei Kramarenko, an independent developer, who is responsible for your personal data (the “controller” under the EU General Data Protection Regulation, GDPR). There is no company behind it and no team with access to your numbers. For any question about your data or to use your rights, email kramarenych@gmail.com or use the contact form at the bottom of this page. Common questions — a sign-in email that never arrived, a receipt read wrong, deleting everything — are answered on the support page. The rules of using the service and buying Plus are in the Terms of Use.
What we collect
Mostly what you bring yourself:
- Your email address — to sign you in. There is no password: we send a link and a code, and that's the whole account.
- What you put into the app — expenses, receipts and their line items, the cards you describe for cashback, categories and settings. If you are signed in, these are synced to your account so the same data shows up on your other devices.
- Receipt photos, PDF receipts and screenshots of your bank's cashback categories, when you send them to be read — only for the moment of reading (see below). No account is needed.
- Plus, if you buy it in the app: whether it is active and until when. The payment itself stays with the app store.
- Your answers and tips about shops in “My discounts”, if you press the button — described in their own section below.
- A thumbs up or down under a blog article, if you vote: the vote, plus a hashed marker so it counts once (see Cookies).
- A “Spotted a mistake?” message under a blog article, if you send one: your account's email address and the message. You can only send it signed in and after ticking the consent box. It is emailed to the author, never published on the site and not stored in our database (we keep only a note that a message was sent, for the daily limit). We use it to fix the article and, if needed, reply to you. You can withdraw consent through the form below.
- A message through the contact form: your message, and a name and reply-to email if you choose to give them.
- Technical data that any website receives: IP address, time, the address requested and the browser — in server logs. If a page breaks, the browser sends an error report: the error, the page address without its query and a rough browser version — no IP address, no cookies, no account.
- Nothing else. No phone number, no postal address, no bank credentials, no advertising identifiers. We never connect to your bank and never ask for its login.
Why we use it and on what legal basis
- • Your account and sign-in (email, sign-in code) — to provide the service you asked for: contract, Art. 6(1)(b) GDPR.
- • Keeping and syncing your records between your devices — contract.
- • Reading receipt photos, PDFs and cashback screenshots — contract.
- • Keeping the lines of pharmacy receipts, which may reveal health information — your explicit consent, Art. 9(2)(a), given separately on the health-information consent; you can withdraw it under Account at any time.
- • Plus in the app — confirming the purchase and switching Plus on and off — contract.
- • Sign-in emails and, if you tick it in Plus, the weekly email — contract.
- • Android beta test — the Google email you enter on the beta page, to give you Plus for testing and check you're in the testers group (Google Groups and Google Play run under Google's terms) — contract.
- • Answering the contact form — our legitimate interest in replying to you: legitimate interests, Art. 6(1)(f).
- • “Spotted a mistake?” — your consent, Art. 6(1)(a); you can withdraw it at any time.
- • Answers and tips about shops, votes under articles — keeping the discount database accurate and counting one vote per person: legitimate interests.
- • Security: server logs, the anti-abuse check on forms and votes, rate limits — keeping the service safe from abuse: legitimate interests.
- • Error reports — finding and fixing bugs: legitimate interests.
- • Our own usage statistics — improving the service: legitimate interests; you can switch them off.
- • Google Analytics on the website — your consent, given in the cookie banner.
Where we rely on legitimate interests, you can object — see Your rights.
Where your data is stored and who processes it
Your records live on our own servers in Helsinki, Finland, inside the European Union — not a third-party analytics platform, not a data broker. Each row is tied to your account and readable only with your own sign-in token: other people signed in to Tratobor cannot see it.
A copy also lives in your browser, on the device you use, so the app keeps working offline. Clearing site data in the browser wipes that copy; signing in again pulls your data back from the account.
These providers process data for us, each only for its own job:
- • Hetzner Online GmbH — the data centre in Helsinki, Finland, where our servers stand: the website itself, the database and sign-in, text recognition, statistics, error reports, the contact form relay and server backups.
- • Resend, Inc. (USA) — delivers our emails and so sees your address and the message. Sign-in emails come signed “Tratobor” from noreply@palabralexi.com, a sending address shared by the same developer's apps.
- • Cloudflare, Inc. (USA) — the Turnstile anti-abuse check on forms and guest votes, our domain names (DNS), storage of encrypted backup copies (R2), and delivery of the website through its network (CDN): pages, sign-in, syncing, photos and screenshots pass through it on the way to our server in Finland, and it may keep copies of public files (scripts, images); nothing from your account is stored there.
- • OVH Hosting Inc. (OVHcloud), Canada (Beauharnois, Quebec) — storage of encryptedbackup copies and a standby server that can take over if our main server fails. This is a transfer outside the EU: Canada is recognised by the European Commission as providing an adequate level of data protection (adequacy decision 2002/2/EC), so no extra safeguards are needed.
- • Google — messages from the contact form and “Spotted a mistake?” arrive in the developer's Gmail inbox; Google Analytics runs only if you consent.
- • Apple or Google, and RevenueCat, Inc. (USA) — only if you buy Plus in the app. The store takes the payment; RevenueCat confirms the subscription to us using your account's ID. We never see your card details.
Where a provider processes data outside the EU (in the USA), the transfer is covered by the EU Standard Contractual Clauses in that provider's data processing terms.
Receipt photos
A photo you take is sent to our server, read there, and dropped as soon as the request ends. The image is handled in memory — we keep no album of your receipts. A PDF receipt is written to a temporary file only while it is being read and is deleted straight away. What stays is the text we got out of it: store, date, line items and prices, and only because that's the point of the app. You can read photos and PDFs without an account: the monthly count then follows a random device marker and your network address, neither of which is written to a database; once you sign in, it follows your account.
Reading a photo is not magic: lines get misread and prices get mangled. Check what came out and fix what's off.
Pharmacy receipts and health information
Medicine names on a pharmacy receipt can reveal something about your health — a special category of data under Article 9 GDPR. Since October 7, 2026 we keep them only with your separate, optional explicit consent, given by a tick in the receipt form when a pharmacy receipt is recognised, or under Account, where you can also withdraw it.
Without that consent a pharmacy receipt photo is read on our server in memory only, to find the total, date and store; the medicine names are dropped right there — they aren't sent to your device and aren't stored. The receipt is saved with its total, date and store; medicine-like lines on other receipts aren't kept either. Withdrawing consent erases the lines of pharmacy receipts already saved; the totals stay.
Spreadsheets
A CSV, TSV or Excel file you import is parsed into rows and then discarded — the file itself never leaves your browser. Only the expenses you chose to import stay, the same way a manually typed expense would.
How photos and screenshots are read
Receipt photos and screenshots of your bank's cashback categories are read by our own text recognition (OCR) on our own server in Finland. Nothing is sent to an outside AI provider, and your data is not used to train anything. The image is turned into lines of text and then dropped; for a screenshot only the categories and percentages you confirm are kept.
There are no written AI tips in Tratobor: they were removed on 18 September 2026. Every number you see — categories, prices, inflation, matching receipts to expenses — is worked out by code in your own browser, and your expense rows are not sent anywhere.
Answers about shops and their discounts
In “My discounts” Tratobor tells you which chain has a loyalty card or a discount, and asks: “is that right?”. Here something travels from you to us not to work out your own numbers, but to make the database better for everyone. So here it is in detail.
It is sent only when you press the button, and only this:
- • the answer itself — “right” or “not right” — and what it is about: the match with an organisation, or its discount;
- • the organisation's id in our database and the merchant line as the till printed it (that is a shopfront name, not your data);
- • if you chose to correct us — the name you suggested, a percentage and a short note you wrote yourself;
- • the place selected in the section, and the date — the day only, no hour or minute;
- • a random browser marker, there for one purpose: so the same answer pressed twenty times stays one vote. It is not an account and not a person, and it is not tied to your email or your records.
What is not in that traffic: the amounts and dates of your purchases, the contents of receipts, your email address or account id — you can answer without signing in at all. Names of people from your transfers are never sent: a line like “transfer to J. Smith” is treated as personal spending and never asked about, and your note saying so stays in the browser. The server accepts exactly the fields listed above and silently drops everything else — it does not “clean up extras”, it takes only what is allowed.
“Know a discount here?” is different: one tip is enough to add a programme to the database, marked as “from a user, not checked yet”, so you need to be signed in. A tip carries the shop, the place, the discount you describe and its percentage. Text with links, phone numbers, email addresses or people's names is refused. Our server keeps only a salted hash of your account ID with the tip — to keep the daily limit and one vote per person — never your email.
Answers and tips go to our server in Finland and are pooled weekly: a correction becomes a candidate for a human to check once three independent people say the same, and a single answer changes nothing. The public database of organisations keeps the chain's name and the terms of its discount — and nothing about who told us.
Matching a receipt to a chain happens in your browser: the database of chains is downloaded to you, not your merchant lines uploaded to us. Part of that base comes from OpenStreetMap and is used under the ODbL licence — you will see the © OpenStreetMap contributors notice in the section itself.
Emails
We email you only when there is a reason: the sign-in code you asked for, and a reply if you wrote to us. A weekly “Your discounts and cashback” email is part of Plus; it is not being sent on tratobor.com yet, and when it is, it goes only to Plus subscribers who tick it in Plus — untick it there at any time. No newsletters, no advertising. Our emails are delivered by Resend; messages you send through the forms arrive in the developer's Gmail inbox, and replies come from there.
Your email address also reaches our own usage statistics for a moment when you are signed in — see that section: only a hash is stored.
Our own usage statistics
To understand which features are useful and where people get stuck, we keep our own statistics — with no third-party service and no cookies. The site reports the actions themselves to our own server in the EU (Finland): the site was opened, the first receipt or expense was added, a receipt photo was read, a card was saved, a Plus note was shown, a purchase was started. Each event carries the platform (website, app), the section of the site, the address of the page where the visit started (without parameters or ids), where the first visit came from (the referring site's name and campaign tags, never the full address) and the week of the first visit.
With each event our server is passed for a moment your IP address and browser details and, if you are signed in, your account ID and email — to filter out robots and fake traffic (against lists of hosting-provider networks) and to leave out our own and test visits. Only hashes are stored: a guest is told apart only within a single day, by a hash of the IP address and browser mixed with a random value that changes daily and is then deleted — it cannot be turned back into an address or used to recognize you the next day; for a signed-in user an irreversible hash is stored instead of the account ID. The IP address, browser details and email themselves are not saved. Shops, items, amounts, categories, bank or card names (other than the entry page address) and anything you type are never in these statistics.
Purchases reach the statistics from our server as a fact — paid, renewed, ended — without amounts or payment details. Sign-ups are counted the same way: every 15 minutes our server notes new accounts and the platform of the first sign-in (website, iOS, Android, judged by the browser details of that sign-in), without the email or account identifier, so a sign-up is counted even when the device sends no events. We rely on our legitimate interest in improving the service (Art. 6(1)(f) GDPR).
Events are kept for 13 months and are not shared with anyone; after that only totals remain (how many visits, sign-ups and purchases there were). In the apps from the App Store and Google Play these statistics are collected only if that is stated in the app's privacy details on its store page. You can opt out here — after that nothing is sent from this browser:
What we never do
We don't sell your data, don't share it with ad networks or data brokers, and don't use it for scoring, credit checks or any decision about you. Tratobor is a calculator for your own spending, not a financial advisor.
We don't make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you. Categories, cashback picks, price changes and discount hints are information for you, not decisions about you.
How long we keep it
- • Your account and records — for as long as the account exists.
- • After you delete the account — gone from the live database at once, and from backup copies within 60 days: backups are kept on our server for 14 days, encrypted in Cloudflare R2 and at OVHcloud in Canada for up to 60 days and on the developer's computer for 30 days (the standby server in Canada catches up within the same 60 days), and are only used to recover from a failure.
- • Photos, PDFs and screenshots — only while they are being read.
- • Technical logs (IP address, time, request) — web server logs and error reports are kept for 14 days. The sign-in log (time, IP address and email address of sign-in events) is kept for security: a daily cleanup removes events older than 90 days. Copies in backups follow the backup retention period described above. You can ask us to delete your entries.
- • Our own usage statistics — 13 months, then only totals with no identifiers.
- • Beta-test Google email — until the Android beta test ends.
- • Plus trial — only a salted hash of your email address (it can't be turned back into the address and isn't linked to your account) and the trial date, kept for 12 months, also after you delete your account, to prevent repeated free trials; legal basis: our legitimate interest (GDPR Art. 6(1)(f)).
- • Contact form and “Spotted a mistake?” messages — in the developer's inbox for as long as needed to answer; we delete them on request.
- • Answers and tips about shops — while they are useful for the database; they hold no email and no account ID.
- • Your cookie choice — 12 months; the guest vote marker — 1 year.
Deleting your account
Open Account and press delete account. The account and everything synced to it are removed from the live database at once; the backup copies described above roll over within 60 days, and we don't restore anything from them for a deleted account. The button next to it, erase data on this device, wipes the local copy on the device you are holding.
Your rights (GDPR)
You have the right to:
- • access your data and get a copy of it;
- • correct it — most of it you can edit in the app yourself;
- • erase it — Account → delete account does it in one step, or ask us;
- • take it with you (portability) — the list of receipts and expenses downloads the expenses of a chosen period as CSV; for a full copy, write to us and we'll send it in a machine-readable form (JSON or CSV);
- • restrict processing — ask us to pause using your data while a question about it is being settled;
- • object to processing based on our legitimate interests — for our own usage statistics, the button in that section does it at once;
- • withdraw consent at any time — Google Analytics through “Cookie settings”, “Spotted a mistake?” through the form below, health information in pharmacy receipts under Account → Pharmacy receipts; this doesn't affect what was done before;
- • complain to the data protection authority of the EU/EEA country where you live or work, or where you think the breach happened; outside the EU, see Other countries.
How to ask: email kramarenych@gmail.com from the address of your account (so we can be sure it's you), or use the form below. We answer within one month (30 days), free of charge. Under the GDPR Tratobor does not need a data protection officer: it is one person and its processing does not reach the threshold. For countries whose laws ask for a named contact, see Other countries.
Other countries: UK, Canada, Australia, Singapore, Malaysia, the Philippines
The rights described above apply to everyone, wherever you live. The laws of some countries add their own rules and name their own regulator. This section covers the United Kingdom, Canada (including Quebec), Australia, Singapore, Malaysia and the Philippines; the European Union is covered above.
What is the same everywhere
- • Who to contact. Tratobor is run by one person, Andrei Kramarenko. He is also the person responsible for protecting your personal information — the privacy officer; in Quebec, the person in charge of the protection of personal information; in Singapore, Malaysia and the Philippines, the data protection officer. Email kramarenych@gmail.com. There is no office or representative in these countries.
- • Where your data goes. Our servers are in Finland (Hetzner); encrypted backups and a standby server are in Canada (OVHcloud, Beauharnois, Quebec); emails, in-app purchase confirmations and, only with your consent, Google Analytics are handled by providers in the USA; the website reaches you through Cloudflare's worldwide network. Your information is therefore stored and processed outside your country, and courts, law enforcement or security agencies of those countries may be able to access it under their laws. The providers are listed in “Where your data is stored” above.
- • Health information. Medicine names from pharmacy receipts are health information, which these laws treat as sensitive. We keep them only with your separate, optional express consent (health consent), which you can withdraw under Account → Pharmacy receipts; without it a pharmacy receipt is saved as a total.
- • Copies, corrections and deletion. Ask from the email address of your account, so we can make sure it is you. We answer within 30 days, free of charge; if we cannot do what you ask, we say why and how to complain. To delete your account yourself: Account → delete account. To get a copy: the list of receipts and expenses downloads the expenses of a chosen period as CSV; for a full copy, write to us and we'll send it in a machine-readable form (JSON or CSV).
- • Using Tratobor without giving your name. We never ask for your real name. Guest mode works without an account: receipts and spending then stay on your device.
- • Data breaches. If a security breach involving your data is likely to cause you serious harm, we will tell you by email and report it to the regulator wherever the law of your country requires it, within the time that law sets.
- • No selling, no advertising profiles. We do not sell or rent personal information and do not build advertising profiles. Google Analytics on the website runs only if you accept it in the cookie banner; it is off until then.
United Kingdom
The UK GDPR and the Data Protection Act 2018 give you the same rights as described above. Data leaving the UK goes to countries the UK recognises as providing adequate protection (the EU and, for commercial organisations, Canada) or to providers in the USA under the safeguards in their data processing terms. If you are unhappy with how we handled your data, tell us first at kramarenych@gmail.com: we acknowledge a complaint within 30 days and tell you the outcome. You can also complain to the Information Commission (until September 30, 2026 the Information Commissioner's Office, ICO).
Canada and Quebec
We handle your personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, if you live in Quebec, the Act respecting the protection of personal information in the private sector. It is stored mainly outside Canada (see above); our encrypted backups and standby server are in Beauharnois, Quebec. Before storing information outside Quebec we assessed the protection it receives there, and our providers process it under their data processing terms. In Quebec you may also ask for the computerised information you gave us in a structured, commonly used technological format, and ask what information was used if a decision about you were ever made by automated processing alone (we make no such decisions). We do not use technology that identifies, locates or profiles you, except Google Analytics on the website, which is off unless you switch it on in the cookie banner. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information du Québec.
Australia
We apply the Australian Privacy Principles of the Privacy Act 1988. We disclose personal information to overseas recipients — our own servers and the providers listed above — in Finland, Canada and the United States (website traffic also passes through the Cloudflare data centre nearest to you); we choose providers bound to protect it. You can ask to access or correct your information as described above. If you have a complaint, write to us first; we will reply within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC).
Singapore
Under the Personal Data Protection Act 2012 you can ask for access to and correction of your personal data and withdraw your consent at any time (withdrawing consent to the processing we need to run the service means deleting the account). When your data is transferred outside Singapore, our providers process it under data processing terms based on the EU GDPR, a standard at least comparable to the PDPA. Our data protection officer is named above. You can complain to the Personal Data Protection Commission.
Malaysia
We honour the rights given by the Personal Data Protection Act 2010: you can ask for access to and correction of your personal data, withdraw your consent, ask us to stop processing that is likely to cause you damage or distress, and ask us to send your data to another service where that is technically feasible. Your data is transferred outside Malaysia to the countries named above. You can complain to the Personal Data Protection Commissioner.
The Philippines
Under the Data Privacy Act of 2012 you have the right to be informed, to access, to object, to have your data erased or blocked, to correct it, to data portability and to damages, and to file a complaint with the National Privacy Commission. Our data protection officer is named above.
Children
Tratobor is not intended for children under 16. We don't knowingly collect their data; if you believe a child under 16 has given us personal data, write to us and we will delete it.
Security
Everything travels over HTTPS. Tokens don't end up in the address bar or in server logs, access to the server is restricted, rows are readable only with the account's own token, and backup copies outside our server are encrypted.
Changes
A new version is published on this page with its date. If something material changes, it will be stated here plainly.
October 13, 2026: a section on the UK, Canada (including Quebec), Australia, Singapore, Malaysia and the Philippines — contact, where data goes, regulators; the short version no longer says requests pass through a website host in the USA.
October 13, 2026: the website moved from Vercel (USA) to our own server in Finland, delivered through Cloudflare's network; Vercel no longer processes any data.
October 12, 2026: guest mode — receipt photos and screenshots can be read without an account; nothing about a guest is stored on our server.
October 8, 2026: added OVHcloud (Canada, Beauharnois) — encrypted backup copies and a standby server; backups there are kept for up to 60 days.
October 7, 2026: pharmacy receipt lines are kept only with separate explicit consent (Art. 9(2)(a)); without it they are dropped on our server and the receipt is saved as a total.
October 2, 2026: named the controller and a contact email; added the legal basis for each purpose, the list of providers and transfers to the USA, how long we keep data, the rights to restriction and to complain, children and automated decisions. Corrected earlier wording: we do keep backup copies (up to 60 days), requests pass through our website host in the USA, a PDF receipt sits in a temporary file while it is read, and the contact form and our own statistics also see your email.
Tratobor is an independent service, not affiliated with any bank or retailer. The analysis is informational and is not financial advice. Privacy questions go to kramarenych@gmail.com or through the form below; the form is protected from abuse by Cloudflare Turnstile, described in Cloudflare's Turnstile Privacy Addendum.