Privacy
LAST UPDATED 15 AUGUST 2026
PAYU pays you PAYU tokens for scanning grocery receipts. To do that we have to read the receipt, check it has not been used before, and send tokens to your wallet. This page says exactly what that involves.
We never store your receipt photograph. It exists in memory for the few seconds it takes to read, is sent to our OCR provider to be read, and is gone when the answer comes back — nothing is written to disk, to storage or to our database. But it does leave our servers to be read, and you should know that before you scan.
WHAT WE COLLECT
| Data | Why |
|---|---|
| Wallet address | It is your account. Everything you earn is tied to it. |
| Telegram account id | One Telegram account opens one wallet, permanently. This is what stops one person opening unlimited accounts. |
| Country | Sets your currency and which shops we accept. |
| Receipt details | Shop, total, date and time, receipt number, the document's own tax id, and the contents of the QR or barcode. These are what we pay against. |
| A fingerprint of each receipt | So the same receipt cannot be paid twice, by you or by anybody else. Kept permanently — that is the whole point of it. |
| A checksum of the uploaded file | So re-uploading the same file does not cost us another read. It is a number, not the picture. |
| Your IP address | Only to limit how many accounts one network can create. Not stored against your scans. |
| Rejected attempts | The reason a scan failed, so we can see when a rule is wrong. |
WHAT WE DO NOT COLLECT
No name, no email, no postal address, no phone number, no payment card. We never see your card details — the receipt shows only the last four digits your bank already printed on it, and we do not extract them.
We accept groceries and general retail only. Pharmacy, fuel, adult retail, gambling and restaurants are excluded from the shop list. That is partly an abuse rule and partly a privacy one: a pharmacy receipt can imply a health condition, and we would rather not hold that at all than hold it carefully.
WHO ELSE RECEIVES IT
| Who | What they get |
|---|---|
| Google (Gemini) | The receipt photograph, to read it. This is the one place the image goes. We keep nothing afterwards. |
| Telegram | Your Telegram id, to confirm you are in the channel. |
| Neon | Hosts our database, in Frankfurt. |
| Vercel | Hosts the website and runs the code. |
| BNB Chain | Every reward you withdraw is a public transaction: your wallet address and the amount, permanently, readable by anyone. |
| Exchange rate providers | Nothing about you. We only ask them what a currency is worth. |
HOW LONG WE KEEP IT
Receipt fingerprints are kept permanently. If we deleted them, the same receipt could be scanned again, and the promise that a receipt pays once would be false.
Everything else tied to your account is kept while the account exists. Rate-limit counters expire within minutes; rejected-attempt records within a month.
YOUR RIGHTS
You can ask us what we hold about you, ask us to correct it, or ask us to delete your account. Write to payu@apppayu.com from the wallet you want to act on, or contact us through the Telegram account linked to it, so we can tell it is you.
Two limits we cannot get around, stated up front rather than in a footnote. Withdrawals already made are on a public blockchain and nobody can erase them — not us, not you. And the receipt fingerprints stay even after an account is deleted, because they are what stops a deleted-and-recreated account from scanning the same receipts again. Neither contains your name; both are permanent.
AGE
This service is for adults. Do not use it if you are under 18.
CHANGES
If we change what we collect or who receives it, this page changes and the date at the top changes with it.