Guide
Privacy & Online Document Tools
Online document tools are convenient and easy to misuse: people paste real invoices into a form “just to see the layout.” This guide explains practical habits and what ReceiptPlay’s code actually does—so you can decide what to type.
Prefer synthetic data
For demos and QA, invent merchants and customers. You rarely need a real PAN, plate number, or phone. Synthetic data still looks realistic enough for screenshots.
What stays in the browser on ReceiptPlay
After inspecting the application: generator field values and theme preference persist in localStorage; game configuration and uploaded sprite sheets use browser storage (IndexedDB / localStorage). Document PNG/PDF/ZIP creation runs in the page with client-side libraries. ReceiptPlay does not operate an application backend that stores your form entries.
What may leave the browser
- Fuel station search — your browser may call public OpenStreetMap Nominatim/Overpass APIs with the search area you enter.
- Google Analytics — aggregate traffic measurement (gtag).
- Google AdSense — advertising script may set cookies per Google’s policies.
- Fonts / static hosting — normal asset requests to CDNs and your host.
Details live in the Privacy Policy. Do not assume “everything is local” if you use station search or leave analytics unblocked.
Uploaded images
Game Config uploads stay in your browser unless you export JSON and email sheets yourself. Generator tools do not require uploading personal document photos to ReceiptPlay servers.
Clearing local data and shared computers
Clear site data when finished on a shared machine. Use private windows for one-off experiments. Export game configs you care about before clearing.
Sharing downloads and screenshots
Before posting a PNG to Slack or social media, skim for accidental real identifiers. Blur or regenerate with demo names. Bulk ZIPs should travel with a note that contents are sample mockups.
Analytics and advertising (high level)
Third-party scripts help operate and fund the site but are not required for generation itself. Browser controls and extensions can limit them. Consent tooling, where shown by Google, should be respected.
Screenshots, recordings, and third parties
Screen recordings of ReceiptPlay will capture whatever you typed. Pause before sharing Zoom recordings externally. If Analytics or AdSense scripts appear in the recording UI chrome, that is expected site behavior—not proof that your slip contents were uploaded to ReceiptPlay servers.
Team policies worth adopting
- Ban production document photos in shared Slack channels when a generator sample would do.
- Require synthetic data in public blog posts and app-store screenshots.
- Document which OpenStreetMap searches are acceptable on corporate networks.
- Clear localStorage on loaner laptops after workshops.
Example — preparing a public screenshot
Open Fuel, Random fill, then replace the customer name with “Demo User” and the vehicle number with a nonsense plate. Download PNG. Open the file in an image viewer and confirm no real phone number remains in footer lines. Only then attach it to a public ticket or tweet. The two-minute scrub prevents accidental disclosure better than any after-the-fact redaction.
How this relates to AdSense and Analytics
Advertising and analytics are separate from document generation. They may process standard web signals (pages visited, device category) under Google’s policies. They are not a reason to type secrets into forms. If your organization restricts trackers, use browser settings accordingly and still rely on synthetic generator inputs.