Privacy
LAST UPDATED 20 OCTOBER 2026
PAYU pays you PAYU tokens for scanning receipts from shops, fast-food chains and cafés. To do that we have to read the receipt, check it has not been used before, and send tokens to your wallet. This page says exactly what that involves.
We do not keep the photograph of a receipt we accept. It exists in memory for the few seconds it takes to read, is sent to our OCR provider to be read, and is gone when the answer comes back. If a receipt is refused, we may keep its photograph for up to 30 days, and never more than 20 at a time, only so someone on our team can see why it was refused and fix our reader. It is then deleted. Either way the photograph leaves our servers to be read, and you should know that before you scan.
WHAT WE COLLECT
| Data | Why |
|---|---|
| Wallet address | It is your account. Everything you earn is tied to it. |
| Telegram account id | One Telegram account opens one wallet, permanently. This is what stops one person opening unlimited accounts. |
| Your phone's device id and model (app only) | Scrambled one way before it is stored; we never keep the raw id. One phone holds one wallet and one free week, which is what stops reinstalling the app for another trial. |
| Country | Sets your currency and which shops we accept. |
| Receipt details | Shop, total, date and time, receipt number, the document's own tax id, and the contents of the QR or barcode. These are what we pay against. |
| A fingerprint of each receipt | So the same receipt cannot be paid twice, by you or by anybody else. Kept permanently. That is the whole point of it. |
| A checksum of the uploaded file | So re-uploading the same file does not cost us another read. It is a number, not the picture. |
| Your IP address | Only to limit how many accounts one network can create. Not stored against your scans. |
| Rejected attempts | The reason a scan failed, so we can see when a rule is wrong. |
WHAT WE DO NOT COLLECT
No name, no email, no postal address, no phone number, no payment card. We never see your card details. The receipt shows only the last four digits your bank already printed on it, and we do not extract them.
We accept groceries, general retail, and the large fast-food and café chains on our list. That includes the drugstore chains that trade as general stores. A CVS, a Boots, a Rossmann sells food, cleaning products and cosmetics alongside its dispensary, and a receipt from one is a shopping receipt. Chains whose business is dispensing prescriptions are not on the list, and neither are fuel, adult retail, gambling or table-service restaurants. The line is drawn at the shop, never at the shopping: we do not record what was in the basket, only the shop, the total, the date and the receipt's own number.
COOKIES AND BROWSER STORAGE
The website sets only the cookies it needs to work, and none that follow you around: payu_session keeps you signed in (7 days), payu_nonce holds the one-time sign-in challenge (10 minutes), payu_locale remembers your language (1 year), and the wallet library remembers which wallet you connected so the page does not flash "disconnected" when you reload it. If you arrive through an invite link, its code waits in your browser's local storage until you sign up. There are no advertising or analytics cookies, which is why there is no cookie banner to click through.
WHO ELSE RECEIVES IT
| Who | What they get |
|---|---|
| Google (Gemini) | The receipt photograph, to read it. This is the one place the image goes. Apart from the refused photos described at the top of this page, nothing is kept afterwards. |
| Telegram | Your Telegram id, to confirm you are in the channel. |
| Neon | Hosts our database, in Frankfurt. |
| Vercel | Hosts the website and runs the code. It also counts page views and measures how fast pages load on your device, for us and without cookies: the page address (with any invite code removed), the site you came from, your country, and your browser and device type. Your IP address is only used to work these out and is not kept, and visits are not linked from one day to the next. |
| BNB Chain | Every reward you withdraw is a public transaction: your wallet address and the amount, permanently, readable by anyone. |
| Exchange rate providers | Nothing about you. We only ask them what a currency is worth. |
HOW LONG WE KEEP IT
Receipt fingerprints are kept permanently. If we deleted them, the same receipt could be scanned again, and the promise that a receipt pays once would be false.
Everything else tied to your account is kept while the account exists. Rate-limit counters expire within minutes; rejected-attempt records within a month.
YOUR RIGHTS
You can ask us what we hold about you, ask us to correct it, or ask us to delete your account. Write to payu@apppayu.com from the wallet you want to act on, or contact us through the Telegram account linked to it, so we can tell it is you.
Two limits we cannot get around, stated up front rather than in a footnote. Withdrawals already made are on a public blockchain and nobody can erase them: not us, not you. And the receipt fingerprints stay even after an account is deleted, because they are what stops a deleted-and-recreated account from scanning the same receipts again. Neither contains your name; both are permanent.
AGE
This service is for adults. Do not use it if you are under 18.
CHANGES
If we change what we collect or who receives it, this page changes and the date at the top changes with it.
CONTACT
PAYU is operated by Hermes Intelligence Labs, Inc., a Delaware corporation, 131 Continental Dr, Suite 305, Newark, DE 19713, United States. It is the company responsible for the data described on this page.