Fetch

Is Fetch safe to use?

Fetch is a real business that pays real gift cards, so it is not a scam. The cost is data. Every receipt you photograph adds to a record of what you buy, where and when, and that record is what brands pay Fetch for. If you link an email account for eReceipts, Fetch scans the inbox too. We score Fetch 48/100: a little better than Freecash, behind Ibotta.

The app is simple. You snap a receipt from any store, restaurant or petrol station, earn points, and redeem them for gift cards. Bonus points come from buying featured brands, shopping through Fetch Shop, playing partner games in Fetch Play, or activating a GoodRx card. The App Store listing promises that Fetch will "never ask for credit card or banking information", and the core app does not.

What does Fetch do with your receipts?

The privacy policy, revised on 13 October 2026, is frank once you find the right section. By using Fetch you consent to your information going to "all Fetch partners who promote or advertise Offers", and those brands may email you and use the data under their own policies. The policy says this may count as a sale under state privacy laws. Separately, Fetch sells or shares IP addresses, device identifiers and browsing data with analytics and advertising partners.

Fetch says brand partners and ad platforms do not get your phone number, precise location or health data. Its Google Play data safety form reads differently: it lists precise location, fitness information, photos and the list of apps installed on your phone as shared for advertising or marketing. Apple's label shows your user ID and device ID used to track you across other companies' apps, and links health data, purchase history, contacts and the contents of emails or text messages to your identity. Where the store forms and the policy disagree, we score on the broader disclosure.

Receipts themselves can be sensitive. A pharmacy receipt can reveal a health condition, which is why Fetch publishes a separate Washington consumer health data notice.

eReceipts: letting an app read your inbox

eReceipts is the feature that most changes the risk. You connect a Gmail, Yahoo, AOL, Outlook or iCloud address, and Fetch "may scan for any data believed to be a receipt" in that account, pulling out billing and mailing addresses, payment method and names. For Gmail and Yahoo it says it follows their API rules, which limit use of the data to the feature. iCloud works differently: you create an Apple app-specific password and paste it into Fetch, and that password opens the whole mailbox.

The feature is optional and you can switch it off in the app. Our advice is to use a dedicated shopping address if you want eReceipt points at all, and never to connect the inbox you use for banking or password resets.

How secure is your Fetch account?

You sign in with your phone number and a six-digit code sent by text. There is no password and no option for an authenticator app, so whoever controls your number controls the account and its points. SIM-swap fraud is the obvious risk. Fetch publishes a security.txt file that points researchers to a vulnerability disclosure programme on HackerOne, which lists no rewards. We found no reported breach and no entry for Fetch on California's breach-notice list. Google Play says data is encrypted in transit.

Teenagers and Fetch Play

The terms require users to be of the age of majority, 18 in most states, but Apple rates the app 13+. That gap matters because of Fetch Play, a games wall run by adjoe that pays points for installing and playing partner games, the same model as Mistplay. Apple's content notes list simulated gambling. Those games earn money from in-app purchases, and chasing a points target can cost more than the gift card is worth.

How to use Fetch with less risk

1. Use the Do Not Sell or Share link in the privacy policy to stop sharing with brand and ad partners.
2. Choose "Ask App Not to Track" on iPhone, and refuse location access unless you want local offers.
3. Skip eReceipts, or connect only a separate shopping email.
4. Add a carrier PIN or port-out lock to your phone number, since the texted code is the only login factor.
5. Redeem points before 90 days pass without activity, or they expire.
6. Do not spend money in Fetch Play games to hit a points level.

How we scored it

Privacy (30) is the weakest factor: the business runs on selling access to purchase data, and store forms list health, email contents and installed apps. Transparency and control (45) reflects consent-by-use and expiring points, and security (50) a text-only sign-in balanced by a disclosure programme and no known breach. Regulatory record (86) is the strongest, because no regulator has acted against Fetch.