Private receipt scanner with local OCR and redaction

Why privacy matters in reimbursement prep

Scholarship documents often contain much more than a store total. A single packet can include a child's name, school information, therapy provider details, billing statements, payment-card fragments, bank screenshots, and parent contact data. Families usually need the receipt or invoice details, but they do not always need to expose every other number on the page to get help reviewing the packet.

A privacy-first workflow keeps the document-prep job focused on what a reviewer actually needs: the purchase, the amount, the date, the provider, the student connection, and any category-specific support. That reduces both oversharing and the risk of sending sensitive information through more systems than necessary.

What stays on your device

SunshineClaimBuddy's privacy model starts with local processing. OCR runs on-device, which means receipt images do not need to leave the phone just so the app can read line items, totals, or payment details. The app also stores document images, PDFs, extracted text, compliance notes, and claim history on the device instead of building a cloud document locker around family records.

• Receipt and invoice images stay on the device during OCR.
• Extracted text is checked locally for sensitive patterns before any AI review starts.
• Portal credentials are not stored because families log in to Step Up manually.
• Redacted copies can be created on-device before anything is exported for submission.

What leaves the device, and when

The AI features work from extracted text rather than uploaded receipt images. That is an important boundary. Families can still get document analysis, category suggestions, and packet guidance without sending the original image file to a server for reading. The text-only step is narrower, easier to inspect, and easier to stop when something sensitive should be removed first.

That means the privacy decision is not all-or-nothing. A family can scan the receipt, review the extracted text, block transmission if the local scan flags something sensitive, redact the document, and only then continue with AI help if they want it.

How the redaction workflow should work

A good redaction flow is not just a visual blur. It should permanently cover the sensitive area in the exported image, create a new file that is safe to use downstream, and let the family keep the original copy locally if they still need it for their own records. The goal is to remove exposure, not to cosmetically hide text that could still be recovered later.

In practice, the workflow is most helpful when a document includes enough proof for the reimbursement packet but also includes unrelated card numbers, bank fragments, or extra personal data in the margins. Families can keep the payment proof they need while stripping out the details that do not help the reviewer make a decision.

How privacy choices lead to cleaner packets

Privacy and packet quality are tied together more than they first appear. When extracted text is read locally, when sensitive patterns are flagged before AI review, and when redacted copies are generated intentionally, families end up with documents that are easier to compare across receipts, proof of payment, and category support. That makes mismatched amounts, missing dates, and vague provider details easier to catch before submission.

Cleaner packets also reduce the temptation to upload a giant stack of screenshots just in case. A focused packet with the right fields visible is usually better for privacy and better for review quality than an oversized packet full of unrelated personal data.