Budgeting apps show where your money went. Recoup gets it back. It scans statements or read-only Gmail receipts, finds recoverable money, builds the evidence, drafts the claim — and waits for your approval before anything leaves your hands. No bank login, ever.
Recoup will never ask for your money, password, bank details, or remote access. Money only ever moves on the official vendor/government site — never through Recoup.
Who's behind this? Built by Vaibhav — a final-year Computer Science student at the University of Liverpool — as a dissertation & portfolio project.Free because it's a student project, not a data broker. The code is open-source and your data is never sold. See the code →
Recoup preview
Scanning statements…
Scanning Gmail & Statement…
Atlas Vector Search
Precedent: FTC Click-to-Cancel
Similarity: 0.88
Gemini ADK Reasoner
› PureGym: unused 60 days.
› Legal basis: FTC Negative Option.
› Action: draft claim for $480.
Human approval gate
pending_approval — nothing sends until you tap approve
Recovered $0
PureGym — Cancelled
you approved it · SHA-256 logged
rules own every $you approve all
Product preview — tap the phone to scan your own
ESTIMATE YOUR REFUNDS
Interactive Savings Estimator
Check common leaks & payouts you might qualify to recover. Our Gemini agent will draft the claims grounded in MongoDB Atlas memory.
ESTIMATED RECOVERY POTENTIAL
$720
Grounded in FTC, EU261 & Fair Credit Billing Act precedents in MongoDB Atlas. Recurring leaks shown per year; one-time payouts counted once.
AGENT SPECTRUM
Tamper-Evident Multi-Agent Swarm
How our specialized agents work in a pipeline, using the official MongoDB MCP server to retrieve precedents and execute plans.
1. Surface Scan
Scanning receipts and statements. Identifies potential leaks and cadences (yearly vs one-time).
Subscription Hunter
2. Vector Match
Queries MongoDB Atlas Vector Search using text embeddings to match the charge to a recovery playbook.
Atlas Precedent Matcher
3. Gemini ADK Reasoner
Builds the plan. Cites the precedent, drafts cancellation emails, never hallucinates dollar amounts.
Gemini 3 Flash
4. Human Approval Gate
Strict safety block. The draft is locked under pending approval. Nothing leaves your browser without your click.
Human-in-the-Loop
LEGAL GROUNDING
Consumer Protection Playbooks
Recoup matches your transaction footprint to specific consumer protection rules and merchant guidelines stored in MongoDB Atlas.
FTC Click-to-CancelUS
Subscription Cancellation
Mandates that companies make cancelling a recurring subscription as easy as signing up. Pre-paid unused periods must be prorated and refunded.
Fair Credit Billing ActUS
Billing Error & Duplicate Dispute
Protects consumers from billing errors, duplicate charges, or unauthorized fees. Cardholders have up to 60 days to file disputes and trigger chargebacks.
EC 261/2004 & UK261EU/UK
Flight Delay Cash Compensation
Provides air passengers delayed 3+ hours or denied boarding with cash compensations of €250 to €600, depending on flight distance, not travel vouchers.
ROSCA Act (15 U.S.C.)US
Free-Trial Auto-Renew Refund
Requires clear consent and disclosure before a free trial auto-converts to a paid subscription. Silent conversions qualify for full chargebacks.
CRYPTOGRAPHIC SAFETY
Tamper-Evident Security
Every action generates a SHA-256 audit block. The hash chain links each state change together to prevent database spoofing or fraud.
EXAMPLE HASH CHAIN
verify the real one at /api/health
BLOCK #01
SCAN_RUN · recoverable items found
HASH: 7a8b9f01c2...e3d4f5
BLOCK #02
ACTION_APPROVED · Gym Cancel
HASH: 9a8c1e2f3d...0a9b8c
BLOCK #03
CLAIM_SENT · Claim Form Open
HASH: e8d7c6b5a4...f9e8d7
ADVERSARIAL AI QA — 3 ROUNDS
Brutally tested by simulated personas
Recoup was attacked by panels of adversarial AI test personas plus a hackathon-judge lens, across three rounds, with automated multi-viewport sweeps. These are real findings from that process — simulated testers, not customer testimonials. What they flagged, we fixed and re-verified live.
SP
The Scam-Wary Pensionersimulated persona · round 1
FLAGGED → FIXED
Flagged: "Looks like every scam that promises me money." Shipped: an above-the-fold promise — Recoup never asks for your money, password, or bank details — and money only ever moves on the official vendor/government site.
SE
The Privacy-Paranoid Engineersimulated persona · round 2
FLAGGED → FIXED
Flagged a CORS misconfiguration and a self-certifying audit chain. Shipped: a pinned origin allowlist, a thread-safe SHA-256 chain (verified under concurrent approvals), and a public /api/health integrity check anyone can curl.
HJ
The Hackathon Judgesimulated persona · round 3
FLAGGED → FIXED
Flagged: "The engine fabricates price hikes from variable spend — PAYPAL *NYTIMES and PAYPAL *SPOTIFY collapse into one merchant." Shipped: gateway-descriptor parsing and a hike test that rejects scatter — verified with the exact failing inputs.
MU
The Impatient Mobile Usersimulated persona · rounds 1–3
FLAGGED → FIXED
Flagged overlapping cards and a black-screen reveal on mobile. Shipped: a rebuilt reveal with a can't-stay-hidden failsafe and clean layouts — re-certified at 390, 768, 1280 and 1440px with zero console errors.
Verified in testing — every claim reproducible
CORS pinned to an origin allowlist — no wildcard with credentials
5,000-line statement parsed in-browser in ~25ms — nothing uploaded
Money math deterministic — gateway descriptors split, one-time payouts never annualized
Recovery results
● LIVE Your real money — three real paths, real data
Ctrl K
When on, the agent re-checks your drains on a schedule; if money keeps leaking to something you haven't confirmed using, it notifies you — one tap approves and the execution agent takes over.
Search real unclaimed money official CA records · $500+
Search a live slice of the California State Controller's official unclaimed-property records ($500-and-up segment) — real money held under real names. Recoup never touches the money: claims happen only on the official state site.
Read-only — it reads subscription receipts and renewal emails from the Google account you pick (one account per connect), never sends or deletes anything, and you can erase the results anytime. Google shows an "unverified app" screen: click Advanced → Continue.
or paste a statement — 100% in your browser, no sign-in