Your documents are not the product. The date is.
Expiry Manager is built to track when things expire and remind you before they do - while minimizing what leaves your device and what we keep long-term.
OCR
Self-hosted, on our server
Files
Not retained after scan
Data
Date-first by design
External checks
None by default
We need the date. Not a dossier about you.
The core value is an expiry date attached to an item. We do not need to build a profile of who you are, what you own, or whether an outside institution thinks your record is valid.
Architecture follows purpose
Extract in an isolated worker
Recognition and date parsing happen in a server-side worker we operate, not a third-party service.
Keep deliberately
Files aren't retained after processing; structured data is kept minimal.
Act on dates
The system schedules reminders around the date you confirm.
OCR runs in a server-side worker we operate. Self-hosted, not a third party.
When you scan a document, recognition runs in an isolated server-side worker using open-source Tesseract that we run ourselves — no third-party OCR API is used unless explicitly enabled. On the web app, a browser-side fast path can additionally run for supported image formats, but the server worker is the path every scan goes through, on both web and mobile.
Self-hosted by default
OCR runs in a server-side worker we operate (open-source Tesseract), not a third-party API, unless a provider is explicitly enabled.
Third-party OCR is optional and off by default
A paid third-party OCR integration exists in code but only activates if its environment variable is deliberately set; it is off in our current production configuration.
Web also offers a browser-side fast path
For JPEG/PNG on supporting browsers, tesseract-wasm can additionally run client-side in a Web Worker; this is a supplement, not a replacement for the server path.
Known limitation
Scanned PDFs and the mobile app always use the server-side OCR worker described above; there is no client-side OCR path on mobile.
What happens to your scan?
Private upload
Document image is transferred over an access-controlled connection, never a public URL
Server-side OCR worker
A self-hosted Tesseract engine runs recognition in an isolated worker we operate
Date parser
Creates candidate expiry dates
Your review
Up to 20 short candidates: ISO date + confidence, nothing saved until you confirm
Only short date candidates come back for your review — the full image is not retained after processing
We extract dates. Not document content.
The long-term structured data from a scan is intentionally small: the confirmed expiry date and a few short evidence snippets that justify why a candidate was suggested.
Confirmed date
2031-06-15
Evidence snippet
“15/06/2031”
Confidence
Short structured score
Full raw OCR text
A complete document transcript
Behavioral profile from content
Issuer verification results
Reserved database columns exist for a possible future debugging cohort, but no current code path writes raw OCR text into them.
We do not verify your life against outside systems.
Expiry Manager does not cross-reference what you track against providers, registries, issuers, credit sources or identity databases.
No warranty validation
We do not confirm whether a warranty is real or still active with the issuer.
We do not do thisNo account standing checks
We do not look up identity, credit or account status with a third party.
We do not do thisNo issuer sharing
The company or institution that issued the document is not told what you track.
We do not do thisNo hidden enrichment
There is no external system quietly adding facts to your item.
We do not do thisYou tell us a date; we remind you before it passes. That is the extent of the relationship.
Workspace boundaries are enforced at the database.
Access control is not only a UI convention. Every table holding user data enforces row-level security scoped to the workspace, and server-side functions re-check ownership on every sensitive call.
Defense in depth
Database
Row-level security on every user-data table
Server functions
Ownership re-checked for OCR jobs, uploads and documents
Automated tests
Workspace-scoping behavior is covered by tests
Logs
Job state, attempts and error codes only - no document content, filenames or raw error text
Security means telling you where the edges are.
We would rather explain a limitation precisely than market a capability that does not exist.
Scanned PDFs
The optional browser-side fast path does not render scanned PDF pages to images; these always go through the server-side OCR worker instead.
Backups
A restore from an older database backup can reintroduce database state from before a purge.
Raw file encryption model
Raw file bytes are not client-side encrypted because doing so would break OCR and previews.
Third-party OCR code exists
A paid third-party OCR integration exists in code but is off by default and requires a provider environment variable to be deliberately enabled.
No “military-grade” slogans. No claim that uploaded files are never stored. No pretending limitations do not exist.
Found something? Tell us privately.
If you believe you found a security issue, report it privately rather than opening a public issue. Include steps to reproduce and, where relevant, the affected endpoint or file path.
What helps us triage quickly
A simple model for a security-sensitive product.
To our server
Document image, over an access-controlled connection
Not retained
The source file is not kept after your dates are confirmed
Long-term text
Only short evidence snippets, not full OCR text
Outside systems
No identity, issuer or account verification
Item deletion
Deleted items are recoverable for 30 days, then hard purged
Know what happens to your data.
The same product philosophy applies here too: keep what is necessary, explain what is stored, and give you clear boundaries.
Keep exploring