Last updated 23 September 2026
PriceSlip tracks the price of things you have already bought and tells you when the price drops, so you can ask the store for the difference. PriceSlip is made and run by MatchReach Technologies LLC, a Washington limited liability company ("MatchReach", "we", "us"), which is responsible for the data described here. This policy explains what we store to do that, who else sees it, and how to remove it.
Some of what we store can reveal health — a line on a receipt, a photo of a box. What that is, who sees it, and the rights Washington's My Health My Data Act gives you over it are in a separate Consumer Health Data Privacy Policy, which the Act requires to stand on its own.
| Account | Your email address, your name if you give one, your password stored only as a bcrypt hash — never in readable form — and when you confirmed you are 18 or older and accepted our Terms of Service. |
| Purchases you track | Product name, store, what you paid, the purchase date, and the product link, so prices can be checked against what you paid. |
| Price history | Prices we observe for those products over time. |
| Receipts | Any receipt image or PDF you upload, and the text read from it. |
| Notifications | A record of alerts sent to you, and your email and push preferences. |
| Devices | A push subscription for each browser or phone you enable alerts on, encrypted at rest. It identifies the device to the push service, nothing more. |
| Connection details | The IP address a request comes from, used to limit abuse such as repeated sign-in attempts. It is held for up to an hour, and written to our server logs only when a request is refused for exceeding a limit. |
| Support messages | What you write to us, your name if you leave one, the address we reply to, which purchase you picked if you chose one, and, when you are signed in, which account it came from. The form also has a tick box for technical details. Tick it and we also keep the email address on your account, which can be a different one from the address we reply to, your notification settings and whether a phone is registered for alerts, when you joined, how many purchases you track, everything we hold about that purchase — its store and link, what you paid and when, the price we last saw for it, when we check it and the alerts it has produced — and the version of PriceSlip you are running with your Android or iOS version, or on the website the browser and operating system you are using, plus the screen or page you sent it from and your time zone. Leave it unticked and we keep none of that. It never includes your password or payment details. |
| Invites | Your own invite code, and — if you joined through someone else's invite link — which account invited you. It is used for one thing: counting how many people you have invited, which decides whether your daily summary email keeps going. We do not tell whoever invited you your name or your email address, and we do not tell you theirs. |
We check the prices of the products you track, send you an alert when one drops enough to be worth claiming, show you your savings, and answer you when you contact support. We do not sell your data, and we do not use it for advertising.
To see how the service is used and whether it is working, we record aggregate usage counts, such as how many alerts went out in a day, which say nothing about you. For each day you use PriceSlip we also keep a pseudonymous activity marker: a code derived from your account that cannot be traced back to you without a secret held on our server. It is deleted after 45 days.
These services handle data for us, each limited to what its job needs:
| Brevo | Sends our email, such as sign-up confirmation and price alerts, and delivers the support requests you send us to our support inbox. |
| Cloudflare | Routes email sent to our addresses, such as support requests, to our inbox at hello@matchreachapp.com. |
| Expo and Google Firebase Cloud Messaging | Deliver push notifications to phones. They receive the notification text and a device identifier. |
| Google Fonts | Supplies the typefaces this website displays. Your browser downloads them from Google, so Google receives your IP address and browser details and can tell that you visited this website. |
| Google Gemini | Identifies a product from text or a photo, only when you use the photo or link-finder features. Google keeps what it receives for up to 55 days to detect abuse. We currently use the free Gemini plan, under which Google may also use what it receives to improve its products and people at Google may read it — that use is not bounded by the 55 days. |
| OpenAI | Reads the items, prices and dates off a receipt you upload, so they can be tracked without typing them in. It receives the receipt image or the text of the PDF. OpenAI does not use data sent through its API to train its models, and deletes it within 30 days unless it must keep it longer by law. |
| Railway | Hosts the application and the database. |
| Vercel | Hosts this website. |
Not everything runs at those services. Price checks run on a computer we own and operate ourselves: it fetches the product pages at the retailers you track, records the prices it finds, and connects directly to our database to do that. The same computer keeps our database backups, described below.
To find a product and its link, we look up barcodes at UPCitemdb and search the websites of Amazon, Best Buy and Target. We also read product pages at the retailers you track. Those retailers see a request for a product page, not who you are.
Traffic runs over HTTPS. Passwords are stored as bcrypt hashes and can never be read back. Push subscriptions are encrypted at rest with AES-256-GCM, because a push subscription is a capability to reach your device. Changing your password signs out every existing session.
We keep your data while your account exists. Deleting your account removes it — the account, the products you tracked, their price history, your notifications, your uploaded receipts and their files, your registered devices, and the support messages you sent, along with the operational records kept about the account, such as queued or recently sent alerts. It is immediate and cannot be undone. Activity markers are not stored against your account, so they are not removed with it; they expire on their own within 45 days.
We back up the database once a day. Each backup is deleted within 14 days of being taken; if our backup server is switched off or asleep at that point, the backup is deleted as soon as the server is running again. The one exception is the most recent backup, which is kept until a newer backup succeeds. So an account can remain in backups taken before it was deleted until those backups are deleted. Backups are used only to recover the service after a failure and to test that recovery works; a test copy is deleted as soon as the test ends. When a backup is restored, we delete again every account whose deletion we have on record. That record holds only the account's internal id and when it was deleted, and a copy of it is kept outside the database, normally updated every hour. If the database itself were lost, accounts deleted since that copy was last updated could be missing from it; we would find them in our server logs and delete them again.
Our hosting provider, Railway, keeps the service's logs. They record events such as sign-ins and account deletions by your account's internal id; logs written before 15 September 2026 can also include your email address. Deleting your account does not remove them; they are deleted when the provider's log retention ends.
Services that handle data for us can keep their own copies for a limited time under their terms: Google keeps what it received for up to 55 days to detect abuse, and Expo keeps the push addresses it has delivered to. Emails you sent to our support inbox, including deletion requests, are not deleted automatically; we delete them when you ask us to.
You can delete your account from Profile & Settings inside the app or the website. If you cannot sign in, request it at matchreachapp.com/priceslip/delete-account: we email the account's address a link to confirm the request, and act on it only once that link is followed, so nobody can have an account deleted just by knowing its email address.
Alerts are the point of the product, so they are on by default. You can turn email or push off in Profile & Settings, and turning push off in a browser or app removes that device only.
PriceSlip is only for adults 18 and over, as our Terms of Service say. We do not knowingly collect data from anyone younger; if you believe someone under 18 has an account, tell us and we will delete it.
MatchReach Technologies LLC · hello@matchreachapp.com
Write to us with questions, or with a request to see or remove your data. If we change this policy, the date at the top changes with it.