Privacy Policy

Your account. The email address you register with and the password you choose. Your password is handled by our authentication provider; it is not visible to us and we cannot read it. An account comes to exist in one of four ways:

• Signing up yourself. BundleProof emails you a link to confirm that the address is yours, and your account is created only once you use it. BundleProof can switch this way of signing up on or off.
• An invitation from BundleProof. BundleProof can create a personal invitation link for your email address and send it to you. It works once and expires, and your account is created when you open it and choose a password.
• A sign-up link shared with a group. BundleProof may share one sign-up link with a group of people. If you use it, your account is created as soon as you enter your email address and choose a password; BundleProof does not email you first to confirm the address.
• An invitation to join a household. If someone invites you to join their household, you can create your account from their invitation link. It is created as soon as you enter your email address and choose a password, without an email confirmation, and you join their household.

If you ask to reset your password, BundleProof emails you a link to do that.

Before an account exists. Every way of creating an account starts with a record tied to one email address, so that the account can only be created for that address, and BundleProof keeps the address in that record. A sign-up link you ask for is valid for one hour, an invitation link from BundleProof for up to a week, and the record made when you use a group sign-up link or a household invitation for ten minutes. Once a record has been expired for a day, BundleProof deletes it, and the address in it, the next time it makes a new one.

To prevent abuse, each request for a sign-up link or a password-reset link is also counted, per email address and per IP address, so that too many requests can be refused. Those counts are stored as one-way digests of the addresses, never the addresses themselves, whether or not the email address has an account. They are deleted once they are two days old, the next time anyone asks for one of those emails.

Your household. The household name you enter and, if you invite a partner, the invitation — with your partner's email address, if you choose to add one — and the membership record that connects the two accounts.

Your Vault records. The products your family owns and the details you enter about them — brand, product name, category, model number, serial number, date code, lot number, purchase, delivery and expiration dates, where you bought it, an order or receipt number, whether you have registered it with its manufacturer, and any notes you add.

Information you import or paste. If you import a gift registry, paste a product link, or bring in a list of products, BundleProof reads that text to fill in product fields. Registry text often names the people who bought a gift; BundleProof keeps the product details and discards those names rather than saving them to your Vault.

Proof of purchase you choose to save. If you add a receipt or order confirmation to a product, BundleProof stores that file with the product so you can find it later. It can be a PDF, or a photo or screenshot. This happens only when you pick a file or photo to save, and it is described in its own section below.

Support and feedback. Whatever you choose to include when you email us — your message, your email address, and anything you attach or describe.

Access requests. Before anyone could create an account, BundleProof had a form for asking for access. It no longer takes these requests, and the old link to the form now leads to sign-up. If you used it, we kept the email address you submitted and when you submitted it; asking for access did not create an account. If you would like that record deleted, email us at support@bundleproofapp.com.

Everything in your Vault is information you entered or checked yourself. BundleProof does not collect it from anywhere else, and nothing is saved to your Vault until you choose to save it.

Recall check records. Which official recall notices were flagged as possible matches for your products, and how you reviewed them.

Product status history. A dated record of the status changes you make to a product — checked, removed from use, replaced.

Your acceptance of these documents. When you create an account, we record that you accepted the Terms of Service and acknowledged this policy: the versions shown to you, the date and time, which screen you accepted on, and your account identifier.

Activity records. BundleProof records a small set of events so we can understand whether the app is working as intended. These include account activation, household setup, products being added, milestones such as the first and fifth saved product, a photo scan failing, and possible recall matches being shown. They include the event, date, an internal account reference and, depending on the event, limited details such as product category, how the product was added, a short failure type or reason, or the number of possible recall matches. They do not include product names, brands, serial or lot numbers, date codes, purchase details, receipt text, or uploaded photos. For some of these events BundleProof also sends the BundleProof team a short internal email, which can include your account's email address.

Technical logs. The platforms that host BundleProof keep ordinary operational records of requests made to the service, such as time, request path, and general technical information about the connection. These are generated by our hosting and database providers as part of running the service and are used to keep it working and secure.

BundleProof has a feature that can read the text on a product label or receipt from a photo to help fill in a product. It is not switched on: BundleProof does not offer it today, and no photo is sent to Google. The rest of this section describes what happens when the feature is switched on and you use it. If we switch it on, this policy will be updated first.

When you use a photo to help fill in a product, the photo is sent to Google Cloud Vision, a Google service that reads the text in an image. That is the only way the text on a label or receipt can be turned into details BundleProof can fill in for you. The photo does leave your device to make this work.

The text that Cloud Vision reads is then sent to the Gemini Developer API, another Google service, which sorts it into fields like brand, model number, or purchase date. Gemini receives that text and its layout — not the original photo.

For receipt photos, before that text is sent on for sorting, BundleProof tries to remove or hide lines a product record does not need — such as card and payment details, authorization or transaction codes, loyalty or member numbers, email addresses and phone numbers. This reduces what is shared, but it is not a guarantee that every sensitive line is caught or that a receipt has been made anonymous: it works on the text as it was read, so an unusual receipt layout or an imperfect reading may slip through.

BundleProof does not keep the original photo. It is used to read the text and is not stored as part of your saved product record. Choosing a photo here never saves it: a receipt photo is kept only if you add it to a product as proof of purchase, as described below. Google handles what it receives under its own terms for those services.

Whatever is read from a photo is a suggestion, not a verified fact. Some details may not be filled in at all — BundleProof leaves a field blank rather than guessing when the photo does not clearly support it. You review what was filled in on the normal product form, you can change anything, and nothing is saved until you choose to save it. You can also choose to enter the details manually instead.

In the BundleProof iOS app, you can scan the barcode on a product's box or label with your iPhone's camera. The barcode is read by the iPhone itself: the camera picture is not sent to BundleProof or to any other service, and the number that is read is shown to you for reference rather than saved to your Vault.

BundleProof can give your household a private email address you can forward a purchase receipt to, so the products on it can be added to your Vault without typing them in. This section describes what happens when you use it.

The address is long and random, and it is yours to share or not. Anyone who knows it can send mail to it, which is why you can replace it at any time from your dashboard — the old address stops working immediately.

Mail sent to that address is delivered by Mailgun, which receives the message and passes it straight to BundleProof over a signed request. Mailgun handles what it receives under its own terms for that service. BundleProof never asks Mailgun for a stored copy of a message; it only reads what arrives on that request.

Mailgun has told us in writing that on the plan BundleProof uses, message retention is set to zero days — meaning Mailgun does not keep the email itself, its headers or its body as stored content. They have also told us that while a message is being handed to BundleProof, Mailgun may hold it temporarily in order to try again if our endpoint is briefly unavailable. Mailgun describes that hold as part of delivering the mail rather than as retention being switched on. They did not give us a figure for how long it can last, and we have not verified one, so this policy does not state one.

BundleProof reads the text of the email looking for durable baby gear — car seats, strollers, cribs and the like — and ignores the rest. What it keeps is deliberately small: a product name, a brand and category if it could tell, a quantity, and a note about anything it was unsure of. It also keeps which retailer the mail came from, worked out from the sending domain, and how many attachments there were.

Attachments are not opened. If a receipt arrives as a PDF or an image attachment, BundleProof counts it and tells you it was not read. It does not open, store, or forward the attachment, and it does not follow any link in the message.

What BundleProof does not keep from a forwarded receipt: the message itself, the subject line, the sender or recipient names and addresses, any postal address or phone number, the order or tracking number, the payment details, the prices and the total. None of that is written to your account.

Nothing found this way becomes a product on its own. The suggestions wait for you to look at them, you choose which ones to add and can correct them first, and only what you tick is saved. If you never act on a forwarded receipt, BundleProof removes the waiting suggestions about thirty days later. You can also discard one yourself at any time.

You can add a receipt or order confirmation to a product you have saved — a PDF, or a photo or screenshot — so you can find it again later. It is part of BundleProof Premium, and this section describes what happens when you use it.

A document or photo is stored only when you choose it and add it to a product yourself. BundleProof stores that file with the product, together with a label taken from the file's name, its size, and when you saved it. It can be a PDF, or a JPEG or PNG image, of up to 10 MB.

If you add a photo or screenshot, BundleProof prepares it on your device before anything is uploaded. It makes a new copy of the picture, turned the right way up, without the details a phone or camera stores inside a photo — such as where it was taken, when it was taken, and which device took it. Only that copy is uploaded and stored; the original photo is not uploaded. If a photo can't be prepared this way, nothing is uploaded, and a document you already saved stays as it was. The picture itself is kept as it appears, so anything else that was in view when you took it is kept too.

The file is stored privately. It has no public address, it is not shared with other households, and only people in your household who can manage its products can open it. Each time it is opened, BundleProof creates a link to it that works for about a minute.

BundleProof checks that the file really is a PDF, JPEG or PNG, but it does not read what the document or picture says. In this version it is not scanned for text, it is not sent to Google or to any other service to be read, and it is not used to decide whether a warranty applies or is valid. It is kept for you to find and open.

It stays until you remove it, delete the product, or delete your account. When any of those happens, BundleProof deletes the document's record straight away and then deletes the file itself from storage through the same automatic cleanup that handles every other deletion. Replacing a document removes the one it replaces the same way.

This is separate from the two features above. A photo used to help fill in a product is still not kept, even when it is a photo of a receipt, and a PDF or image attached to a forwarded email is still not opened or stored. Neither becomes a saved document — only a file or photo you add to a product as proof of purchase does.

We use the information described above to:

• operate BundleProof — keep your Vault, compare the product details you saved against official recall notices, show your product status history, and share a household with a partner you invite;
• create and secure your account, sign you in, send the emails your account needs — the link that confirms your email address, and any password-reset link you ask for — and keep records of your acceptance of these documents;
• provide BundleProof Premium to a household that buys it, including any warranty reminder emails you turn on and, for a membership bought on the web, the confirmation and renewal reminder emails described in the Terms of Service;
• answer you when you contact support — if you email us about a problem, we may look at your account to help;
• understand whether BundleProof is working as intended and improve it, using the activity records described above;
• keep the service running, diagnose problems, prevent abuse, and meet legal obligations.

We do not sell your information, and we do not use it for advertising or for third-party behavioral analytics.

This tool helps organize recall information and product records. Recall matches may be incomplete or approximate. Always verify product model numbers, date codes, lot numbers, and recall details using the official recall source. BundleProof does not guarantee that all recalls or hazards will be detected.

BundleProof re-checks the products you have saved against the recall notices it has recorded — automatically once a day, and whenever you run a check yourself. Those notices come from the U.S. Consumer Product Safety Commission (CPSC). The recall catalog behind those checks is reviewed and recorded manually, so it will not contain every recall, and BundleProof does not send you recall alerts: possible matches appear in the app for you to review. Continue to rely on official manufacturer and government sources for safety-critical decisions.

BundleProof checks CPSC recalls only. Car seats are regulated by the National Highway Traffic Safety Administration (NHTSA), and BundleProof does not check NHTSA recalls, so check car seat recalls with NHTSA or the car seat's manufacturer.

Checking your products does not send your product details to any recall agency. BundleProof reads the CPSC's public recall data to build its catalog ahead of time, and the comparison happens inside BundleProof.

BundleProof Premium can email you before a product's estimated warranty coverage date, where it can work that date out from the manufacturer's published warranty and the dates you saved. It is off unless you turn it on, product by product. These reminders are about the dates you saved; they are not recall alerts.

Turning it on applies to you alone: the emails go to the address on your account, and nobody else in your household is signed up by your choice. There are at most three for a product — 60, 30 and 7 days before the estimated date — and none after it. Turning it off, losing the ability to manage that product, or leaving the household stops them and removes the ones still waiting.

A reminder contains the product's name, its manufacturer, the estimated date, a link back to that product in BundleProof, and the manufacturer's own warranty page where we have verified one. It does not contain a proof of purchase you saved or a link to one, an order number, a serial or model number, or a price. The date is an estimate rather than a decision about your coverage: only the manufacturer can say what its warranty covers.

If you buy BundleProof Premium on the web, Stripe handles the payment; if you buy it in the BundleProof iOS app, Apple does. Your card or other payment method goes to them, not to us: BundleProof does not receive, see or store full payment-card details from either of them.

To connect a purchase to your household, BundleProof gives Stripe your account's email address and an internal reference to your household, and gives Apple a random reference it creates for the purchase. What BundleProof keeps is what it needs to know whether your household has a membership: an identifier for the subscription, which provider it came from, its status, and the dates of the period you have paid for. Where a payment fails or is refunded, we record that the membership changed state — not the reason, and not anything about the card. We also keep a log of the messages Stripe and Apple send us about payments — each message's identifier and type, the subscription it refers to, and what we did with it — so that no message is acted on twice.

We use that information to give your household the features it is entitled to, to answer you if you contact us about a membership, to keep a record of changes to the membership, and to prevent duplicate or fraudulent purchases. A membership belongs to the household, so other people in your household can see that it is active and when it renews; they cannot see payment details, because we do not have any. Stripe and Apple keep their own records of a purchase under their own policies.

When you subscribe to Premium on the web, we keep a record that you agreed to its automatic renewal: Stripe's references for the checkout, the subscription and the customer, which version of the renewal terms you were shown, a fingerprint of those words, and when you agreed. We also keep a record of the confirmation and renewal reminder emails a web membership is owed — which subscription and renewal each is for, and whether it was sent — so that none is sent twice. Neither record includes your name, email address or card details. As California's automatic-renewal law requires, we keep the record of your agreement for at least three years, or one year after your membership ends if that is later, including after you delete your account.

BundleProof uses cookies for one purpose: keeping you signed in. These are set by our authentication provider and are necessary for the service to work. There are no advertising cookies, no tracking pixels, and no third-party analytics scripts, which is why you are not asked to make a cookie choice.

BundleProof may also keep a small amount of information in your own browser's local storage — for example, products you entered before you had an account, so they can be offered for import once you sign in. That information stays in your browser until it is imported or you clear it, and clearing your browser data removes it.

BundleProof relies on established service providers to run. Each one processes information for the purposes above, as part of the service it provides to BundleProof, and handles it under its own terms for that service:

• Vercel — hosts and serves the BundleProof application.
• Supabase — provides the database that stores your account, household, and Vault records, the sign-in service that manages your account and password, and the private file storage that holds any proof of purchase you choose to save.
• Google Workspace — BundleProof's email. It sends, through the Gmail API, the emails your account needs — the link that confirms your email address and any password-reset link you ask for — the confirmation and renewal reminder emails for Premium bought on the web, and any warranty reminder emails you have turned on. It also carries BundleProof's internal emails about account activity, and it is where email you send to our support address arrives.
• Mailgun — receives mail sent to your household's private forwarding address, on the receipt-forwarding path described above, and only if you use it. Mailgun handles what it receives under its own terms for that service.
• GitHub — runs BundleProof's scheduled jobs on GitHub Actions, including the daily recall check. While a job runs it reads what it needs from our database — for the recall check, the product details it compares — and the logs GitHub keeps of each run record counts and errors rather than the contents of your Vault. Where they are in use, the same scheduled jobs send the warranty reminders that are due and remove deleted proof-of-purchase files from storage.
• Stripe — processes payment if you buy BundleProof Premium on the web. Stripe collects and holds your card details; BundleProof never sees or stores them. What we receive back is a subscription identifier, whether it is active, and when the paid period ends.
• Apple — processes payment if you buy BundleProof Premium in the BundleProof iOS app, under your Apple Account. Apple collects and holds your payment details; BundleProof never sees or stores them. What we receive back is a subscription identifier, whether it is active, and when the paid period ends.

Google Cloud Vision and the Gemini Developer API are not on this list because BundleProof's photo text recognition, which would use them, is not switched on: BundleProof sends nothing to either. The U.S. Consumer Product Safety Commission is not a provider either: BundleProof reads the CPSC's public recall data and sends the CPSC nothing about you or your products.

These providers host and process information in facilities they operate, which may be in a different location than you are. Beyond them, we share information only with people in your own household (see below), or where we are legally required to, must protect someone's safety or our rights, or if BundleProof is ever transferred to another operator — in which case this policy would continue to apply to information collected under it.

If you invite a partner to your household, or accept an invitation to join one, the members of that household can see and manage the same products and recall information. That is what the feature is for, and it is the main way your information becomes visible to another person.

The household owner can remove a member at any time, which ends that person's access immediately. An invitation link is single-use, expires, and can be cancelled before it is used — only share it with the person you intend to invite.

We keep your account, household and Vault records for as long as your account exists, so BundleProof can do its job.

A proof of purchase you save is kept until you remove it, delete the product it belongs to, or delete your account. Its record is deleted straight away, and the file is then deleted from storage by BundleProof's automatic cleanup, as described above.

When you delete your account from inside BundleProof, the account and its active Vault data are removed immediately. Activity records associated with an account are deleted with that account, and so is the record that the account accepted these documents. If you ask us to delete an account by email instead, our policy is to complete it within 7 days of verifying the request.

Records kept before an account exists — sign-up and invitation records, and the counts that limit requests for account emails — are deleted on the schedule described above, under “Before an account exists”.

A few things are not deleted with an account: requests made through the old access-request form, which were never part of an account (you can ask us to delete yours); the log of payment messages from Stripe or Apple described above, which holds no card or payment details; the records of a web membership's agreement to automatic renewal and of its confirmation and reminder emails, described above; and backups and provider logs, which age out on their providers' ordinary cycles rather than being deleted individually. We may also keep information longer where we are legally required to.

Access to your records is enforced by rules in the database itself, so one household's records are not readable by another account. Your password is managed by our authentication provider and is not something we can read.

A proof of purchase you save is kept in private storage that no browser can read directly. BundleProof opens one only for someone signed in who is allowed to see it, through a link that works for about a minute.

No online service can promise complete security, and we do not. If you believe something is wrong with your account, or you have found a security problem, please tell us at support@bundleproofapp.com.

Most of what BundleProof holds is there because you entered it, and you can change or delete individual products at any time from within the app. You decide whether to invite anyone to your household, and you can remove them afterwards.

Saving a proof of purchase is always your choice: you can add one to a product, replace it, or remove it whenever you like.

Warranty reminder emails are off until you turn them on for a product, and you can turn them off again at any time from that product's page.

If you buy BundleProof Premium, you can cancel it at any time: on the web from Manage billing in BundleProof, or, if you bought it in the iOS app, in your Apple Account's subscription settings.

You can ask us for a copy of the information associated with your account, ask us to correct it, or ask us to delete the account entirely. Email support@bundleproofapp.com and we will help. Depending on where you live you may have further rights over your information; tell us what you need and we will do our best to honor it.

You can delete your account yourself, from inside BundleProof. Sign in, open Account, and choose Delete BundleProof account. The screen tells you exactly what will be removed before you confirm.

Deletion happens immediately once you confirm it. It removes your sign-in, your household membership, and — where nobody else depends on it — your household and every product record in it. It cannot be undone, and we cannot restore anything afterwards.

If you share a household with someone else, deleting your account does not delete their records. When you are the only owner of a household another member is part of, BundleProof hands that household to them as part of deleting your account: they keep the products and the recall information, and you are removed from it.

A proof of purchase saved with a product goes with that product: its record is deleted with the rest of the household's records, and its file is then deleted from storage by the same automatic cleanup. In a household that is handed over, saved documents stay with the household, just as its products do.

If you pay for BundleProof Premium, deleting your account affects that too. A subscription you pay for on the web is cancelled straight away, so you are not charged again. BundleProof cannot cancel a subscription bought through Apple: cancel it in your Apple Account's subscription settings, because deleting your BundleProof account does not stop Apple from renewing it.

If you cannot sign in, email support@bundleproofapp.com from the address associated with your account and ask us to delete it. Our policy for a request handled that way is to complete it within 7 days of verifying that the request is really yours.

BundleProof is about baby products, but it is not a service for children. It is designed for parents and caregivers, accounts are for adults, and BundleProof is not directed to children.

We do not knowingly collect personal information from children. The records you keep are about products — a stroller's model number, a car seat's expiration date — and BundleProof does not ask for a child's name, birth date, photograph, or any other information about a child. Please do not enter information about a child in the notes fields. If you believe a child has provided us with personal information, contact us at support@bundleproofapp.com and we will delete it.

We will update this policy as BundleProof changes. Each version carries an effective date and a version identifier at the top of this page. If a change materially affects how we handle your information, we will take reasonable steps to let you know rather than changing it quietly.

Email support@bundleproofapp.com with any question, problem, or request about privacy or anything else. Support is best effort — we read everything, but we cannot promise a response time.

BundleProof is an independent product operated by Alex Francesco Sarcina, an individual.

The Terms of Service describe the rest of the agreement between us, including what BundleProof does and does not promise about recall information.