Privacy
Canopy's privacy policy, in plain English: what Canopy collects, why, where it goes and how to delete it. Last updated 7 October 2026.
On your phone by default
Trips, location, motion, Health workouts, scans and your footprint are stored on your phone. They leave it only if you join a league or share something, and then only what that feature needs. Precise location never leaves your phone.
Where your data is stored
For everyone, in every country, anything that reaches our server is processed and stored in the UK, on Google
Cloud in London (europe-west2). If you live in the US or India, that means your data is
transferred to the UK.
Sign-in is optional. It uses Firebase Authentication, a global Google service that is not limited to London. It holds your sign-in details (such as your email address and Apple or Google ID) and nothing else from Canopy.
Receipts (UK only for now)
Reading receipts is optional and only happens if you ask for it. If you connect Gmail (read-only), Canopy searches for likely receipts on your phone and shows you the matches; nothing is sent until you pick which emails to read. You can also forward receipts to a private Canopy address instead.
By default Gmail stays connected only while the app is open. If you turn on "Keep Gmail connected" (it is off unless you do), a Google sign-in key is kept in your phone's keychain (never on our server) so Canopy can look for new receipts when you open it, at most every 6 hours. "Ask me first" (the default) shows them for you to pick; "Read automatically" reads them with the same redaction. Only Gmail message ids are kept, so an email is never read twice. Disconnect Gmail or Delete all my data revokes the key with Google and deletes it.
What is sent, and to whom
- Only the emails you pick or forward, with personal details removed first. Before an email leaves your phone, Canopy removes names, email addresses, phone numbers, street addresses and postcodes, card numbers, links, and order, account and tracking numbers. What is left (the shop, the items, quantities, prices, dates and times) is sent. The app shows you exactly that text ("What we send") before your first email is sent, and any time from "How?". Forwarded emails get the same redaction on our server, before anything else reads them.
-
Who reads it: our server on Google Cloud passes the redacted text to Google's Gemini model
on Vertex AI in London (
europe-west2). Google Cloud is our data processor. The model returns the order or ride details as structured data. Claude on Vertex AI is a backup we could switch to; it would run in the EU, and we would update this page first. - Not stored, not logged, not used for training. We never store or log the email text, on the server or the phone; it lives only in memory for the one request and is then discarded. Google's terms for Vertex AI say it "won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction" (Google Cloud: Vertex AI and zero data retention).
- Addresses never leave your phone. The delivery distance for a takeaway is worked out on your phone from the addresses in the email, and only that distance is kept.
- What we keep: only the extracted items and their footprint, on your phone. For forwarded emails, our server holds those extracted items until your phone collects them, and for 7 days at most.
- Lawful basis: your consent (UK GDPR Article 6(1)(a)). You can withdraw it any time: Disconnect Gmail, turn off forwarding, or use Settings → Delete all my data.
Google user data (Gmail)
Canopy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
This section covers the only Google user data Canopy uses: Gmail, if you choose "Connect Gmail" on the Food or Shopping screen. Connecting Gmail is optional, available in the UK only for now, and Canopy works fully without it. Signing in with Google (optional) gives Canopy your sign-in details only, never Gmail; that is covered under Where your data is stored.
-
What we access. One permission: read-only Gmail
(
https://www.googleapis.com/auth/gmail.readonly). Canopy uses it on your phone to search for emails from a fixed list of receipt senders (takeaways, ride hire and shops, such as Deliveroo, Lime, ASOS, Tesco and Amazon) from the last 30 days. For the matches it reads only the sender and subject, to show you a list. It reads the text of an email only when you tick it and tap Read, or, if you turned on "Keep Gmail connected" with "Read automatically", for new emails from those senders. Canopy does not ask for your contacts, your Google profile or your email address, and it cannot send, change or delete email. - How we use it. Only to pull out what you bought (the shop, items, quantities, prices, dates and times) and, for takeaways, the delivery distance, so Canopy can estimate the carbon footprint of those purchases and show it to you in the app. That is the only use. We don't use Gmail data for advertising, profiling, credit decisions or anything else, and no person at Canopy reads your emails.
-
How it is processed and stored. Before anything leaves your phone, Canopy removes names,
email addresses, phone numbers, street addresses and postcodes, card numbers, links, and order, account and
tracking numbers (see What is sent, and to whom). Only that redacted text is
sent, over an encrypted connection, to Canopy's server on Google Cloud in London
(
europe-west2), which passes it once to Google's Gemini model on Vertex AI in London and returns the extracted items to your phone. The server never writes the text to disk, a database or a log: it exists only in memory for that one request. We have turned off Vertex AI's in-memory data caching for our project. Google may keep a prompt that its abuse-detection systems flag, for up to 90 days and only to check for misuse; we have asked Google to exempt Canopy from this. - How long we keep it. On our server: nothing from Gmail, ever. On your phone: the extracted items, their footprint and the delivery distance (never the addresses), plus the Gmail message ids of receipts already read, so an email isn't read twice. They stay until you delete them or use Delete all my data; ride receipts are kept for 30 days. Google's access key lives only in the app's memory and is gone when you close Canopy (an hour at most). If you turn on "Keep Gmail connected", a Google key is kept in your phone's keychain (never on our server, never in backups) until you disconnect.
- How it is shared. With no one except Google Cloud, acting as our data processor to run our server and the Gemini model. We never sell Gmail data, never transfer it to anyone else, never use it for advertising, and never use it to train or improve AI or machine-learning models (ours or anyone else's); Google's terms for Vertex AI also forbid it from training on it. If we ever changed how Gmail data is processed, we would update this page and ask you again first.
- How to revoke access. In the app: Food or Shopping → Disconnect Gmail. This revokes Canopy's access with Google and deletes the key from your phone. Or at any time in your Google Account: Google Account → Third-party apps and services (myaccount.google.com/permissions) → Canopy → Delete all connections.
- How to delete your data. In the app: Settings → Delete all my data. This deletes everything Canopy holds on your phone, including the receipts read from Gmail and the message ids, revokes Gmail access with Google, and deletes your account and everything about you on our server. Or email founder@ed-any.com and we will delete it within 30 days.
Services we use
Google Cloud in London (our server; Vertex AI Gemini for reading the receipts you choose), Firebase Authentication (optional sign-in; global), RevenueCat with Apple and Google (only if you buy Canopy+; we never see card details), Sentry (anonymous crash reports, which you can turn off in Settings) and Open Food Facts (barcode lookups).
Your control
Settings lets you export all your data or delete all of it in one tap, including anything on our server.
United Kingdom
-
Who: Canopy (Rahul Sagar, United Kingdom) is the controller under UK GDPR. Data is
processed and stored in London (
europe-west2), and Gemini runs there too. - Lawful basis: your consent, which you can withdraw at any time in the app.
- Your rights: to see, correct, export or delete your data. Use Settings, or email us. You can also complain to the ICO.
United States
-
Where: your data is transferred to and stored in the UK (London,
europe-west2). Gemini runs in London. Receipts aren't available in the US yet. - What we collect: your sign-in details; the name, teams, friends, household and league you join; Canopy+ status; anonymous crash reports; and, if you turn on sharing, daily totals (leaves and kg) and when a walk ended.
- Location and health data stay on your phone. Precise location is never sent; trip locations are kept on the phone for 7 days. Motion and activity data is tracked only after a separate opt-in. See our Consumer Health Data Privacy Policy.
- Why: only to run the features you turn on.
- No selling, no ad sharing. We don't sell your personal information or share it for cross-context behavioural advertising. We show no targeted ads.
- Your rights: to know, correct and delete your data. Use Settings → Delete all my data, or email us; we reply within 45 days. Using your rights never changes the service you get.
- Age: Canopy is for people 13 and over.
India
-
Where: your data is transferred to and stored in the UK (London,
europe-west2). Gemini runs in London. Receipts aren't available in India yet. - Consent: under the Digital Personal Data Protection Act, 2023, we process your data only with your consent, for the features you turn on. Withdraw it any time by turning a feature off or with Settings → Delete all my data.
- Your rights: to see a summary of your data, correct or erase it, nominate someone to act for you, and raise a grievance.
- Grievance contact: founder@ed-any.com. We answer within 90 days. If you're not satisfied, you can complain to the Data Protection Board of India.
- Age: Canopy is for people 18 and over in India.