What a receipt reveals

A receipt is a small document with a surprising amount on it: part of a card number, where you were, what time, what you bought, and sometimes your name. A year of them describes your movements, your household, your health and your habits in more detail than you would volunteer to anyone.

That has practical consequences for how a pile of them is stored, transported, uploaded and disposed of — consequences that exist independently of any tax question and that most receipt advice skips entirely.

What’s actually printed

A card fragment. Typically the last four digits, sometimes the first six as well, which identify the issuer and card type. Full numbers are not normally printed on modern card receipts, and where a receipt is very old or the terminal unusual, they occasionally are — worth checking rather than assuming.

The location and the time. A store address and a timestamp, often to the minute. This is the part people underestimate: a sequence of receipts is a movement log, and a fairly precise one.

The itemisation. What you bought, which for pharmacies, clinics, and some shops is information about health, and for others is information about a household, a hobby, or a dependent.

Sometimes a name. Delivery receipts, invoices, and anything tied to a loyalty account.

Sometimes an address. Anything delivered.

A loyalty identifier, which links this transaction to every other one made on the same account.

Individually, most of that is unremarkable. In aggregate — which is what an archive is — it’s a detailed personal record, and archives are exactly where aggregation happens.

Where the exposure is

The pile in transit. A wallet, a car, a bag. The commonest real-world exposure and the least considered.

Whoever else is in the building. Domestic and small-office storage is usually unsecured, which is fine for most purposes and worth thinking about for records containing other people’s details.

The bin. Intact receipts in general waste is the low-effort route to a card fragment, an address and a purchase history. Whether that matters depends on what the receipt shows.

Uploading. The one worth being clear-eyed about. When an image of a receipt leaves your device, the file is stored on infrastructure you don’t control, its retention is governed by that provider’s policy rather than yours, its contents may be processed to extract text, and the provider — including any staff or subprocessor with access — is in a position to see it. That’s not an accusation of misconduct; it’s a description of the arrangement. The relevant point is that it is an arrangement, with terms, and the terms are worth reading before a decade of financial records goes into it.

Shared and inherited storage. A folder shared for one purpose that quietly contains everything. A device passed on. An account someone else can reach.

Photographs in a general library. Receipt images in the same place as everything else are subject to whatever that library syncs to and whoever it’s shared with. The location and timestamp metadata attached to the photo adds to what’s already printed — what happens to metadata covers what that metadata is.

The practice

None of this warrants alarm, and the reasonable response is modest.

Know where the copies are. The single most useful thing. You cannot make a judgement about exposure without knowing which devices, services and drawers hold records — a synced folder is not a backup covers enumerating them.

Read the terms of anything you upload receipts to, specifically for retention and deletion. The questions worth answering: where is it stored, how long is it kept after you delete it, is the content processed and by whom, who can access it, and what happens if you close the account. Whether the answers are acceptable is your call — but they should be answers you’ve seen rather than assumed.

Check that deletion means deletion. Deleting from a live folder leaves copies in version history, sync caches, and backups. That’s usually a feature. It is not a feature when the point of deleting was to stop holding something.

Destroy rather than discard, where the contents warrant it. Shredding or tearing across the printed area is proportionate for anything showing a card fragment, an address, or something you’d rather not have read. Ordinary purchases don’t need it. Judgement, not ritual.

Be more careful with other people’s records than your own. A contractor’s claim, a customer’s order, an employee’s receipts. You chose your own exposure; you didn’t choose theirs — the point in records two people share and in the expense claim as a records problem.

Hold less. Volume is exposure. The disposal habit in the cost of keeping everything has a privacy dividend attached, which is the second argument for it after retrieval.

Keep or bin

KEEP OR BIN — handling what's on the paper

  · Knowing every place copies live
                    → KEEP. Prerequisite for any
                      judgement about exposure.

  · Terms of an upload destination, read
    for retention and deletion
                    → KEEP. Answers you've seen, not
                      assumed.

  · Receipts with a card fragment, torn or
    shredded across the print
                    → KEEP the habit. Proportionate,
                      not paranoid.

  · Intact receipts in general waste
                    → BIN differently. Card fragment,
                      address, purchase history, no
                      effort required to read.

  · "Deleted" from a live folder only
                    → NOT DELETED. Version history,
                      sync caches and backups still
                      hold it.

  · Other people's receipts kept past the
    point of needing them
                    → BIN, subject to any retention
                      obligation. Their exposure,
                      your storage.

  · Whether you have any legal duty over
    personal data in records you hold
                    → ASK LOCALLY. Data-protection
                      obligations vary by
                      jurisdiction and by what you do.

The genuine tension

There is a real conflict here and it shouldn’t be smoothed over. Retention pushes toward keeping records, in multiple copies, for a long time. Privacy pushes toward holding less, for shorter, in fewer places. Both are legitimate and they point in opposite directions.

The resolution isn’t a compromise, because retention obligations generally win where they apply — you don’t get to dispose of something you’re required to keep on the grounds that it’s personal. It’s to be precise about which records are actually subject to a requirement and which are kept out of habit. The first group stays, in as few copies as the requirement tolerates. The second is where privacy decides, and it’s usually the larger group. Working out which is which requires knowing the requirements, which is where this site stops.

What this doesn’t settle

Whether you have data-protection obligations, what they require, whether they apply to records about customers or contractors or employees, how long personal data may be held, or whether any of it conflicts with a retention requirement. Nor whether uploading records anywhere is permitted in your situation, or whether records must remain in a particular jurisdiction.

Those are legal questions, they vary substantially by where you are and what you do, and they need your tax authority, your data-protection regulator, or an adviser. What this page settles is only the factual part: the contents of a receipt are more personal than the amount on it suggests, and every decision about storing them is also a decision about that.