Privacy Policy

Who we are

TabApp is run by FYNEWORKS LTD (company number 10916302), 124 City Rd, London EC1V 2NX, which is the controller of the personal data described here. For anything about your data, write to privacy@tabapp.app or call +44 (0)208 058 0556.

TabApp is for people aged 18 and over.

What we collect

• Your account: your email address, name and initials, your phone number if you give one, your profile picture if you add one, and your preferred currency.
• Your payment details: the ways you want to be paid that you save, such as a bank account, PayPal, Monzo, Revolut, Venmo, Cash App, Zelle, Starling or Pix. A bank account number and sort code are stored encrypted; the other details are stored as you typed them. They are shown only to people on a bill or tab who owe you, so they can pay you.
• What you buy: each upgrade you buy, its price and currency, when you bought it, Stripe's reference for the payment and when it was refunded, the credits and passes you hold, which tabs and bills they upgraded, and how many free receipt readings you have used this month. We never see your card number. Your name and what you bought are shown to everyone on the tab or bill you bought it for, on the line it adds.
• Bills, tabs and groups: their names, items, prices, splits, the people on them, the payments recorded, and a history of the changes made. Everyone on a bill, tab or group sees the names on it.
• Photos: receipt photos, photos added to a bill, and group pictures.
• Where a bill was made: when you start a bill, or add a photo to one, and your browser allows it, we take your device's location and keep it with the bill or the photo. It suggests the bill's currency and places the bill on your Map. To suggest a name for a new bill or tab, our server sends that location, rounded to about 100 metres, to Google Places to find the places and the town around you. The answer is kept for a few minutes, so a second start nearby sends Google nothing. Your browser asks before it shares your location, and you can refuse.
• People you add: the name of each person you put on a bill, tab or group, or invite as a friend, and a phone number or email address if you enter one for them.
• Guests: someone who joins a tab or bill from a link without an account is known by the name they give, and by the kind of browser and device they joined on, such as Safari on iOS, which the organiser sees so they can tell seats apart.
• Notifications: the notifications you switched off, a record of which events were raised for you (identifiers only), and, for each device where you turned notifications on, the address and keys your browser gave us for reaching it.
• Messages to us: what you send through the Contact form, with your email address, your account identifier if you are signed in, and the kind of device and browser you used. It is emailed to us and not stored in TabApp.
• Messages of thanks: if you leave a message on the Say thanks page, its text, whether you posted it without your name, when you wrote it, whether it is waiting to be read, shown or hidden, and when it was last read. Once the developer shows it, anyone can read it on that page under your first name, or as Someone, with the month you wrote it; never your surname, picture or email. You can delete it at any time.
• Tips: a tip by card is paid on Stripe's own page and we store nothing about it. Buy Me a Coffee and PayPal tips are made on their own sites. We count presses of Say thanks and of each way to tip, with the page Say thanks was pressed on, but never who pressed or how much.
• Assistants you connect: if you connect an AI assistant to your account, which of its tools was used and when, but not what it asked or what it was told.
• Technical data: your IP address, which our host sees with every request; error reports; logs of what each request and screen did, named by account, bill, tab or group and never by what anyone typed; measurements of how the app performs; and counts of how it is used, such as how many accounts and bills are made and how many bills are settled. The measurements and counts identify nobody.

We do not use advertising, and we do not sell your personal data.

Why we use it

• To provide TabApp, which is our contract with you: your account, your bills, tabs and groups, reading receipts, showing who owes what, and telling you what happens on them, and the upgrades you buy, on our terms of sale.
• To meet the law: keeping the record of each sale that tax law requires.
• In our legitimate interests: messaging a person an organiser added, when the organiser asks; keeping TabApp secure and limiting abuse; finding and fixing faults; understanding how TabApp is used, from counts that identify nobody and the event records Hookdeck receives, which carry your account identifier and no names; logging what each request and screen did, by account, bill, tab or group, to run TabApp and support you, which is not analytics and not session recording; and answering you when you write to us.
• With your consent: your device's location; notifications on a device; and session recording, which records nothing until you switch it on under Settings, Preferences, on that device, and links what it records to your account identifier. You can withdraw it at any time in your browser's settings, by turning notifications off on that device, or by switching session recording off again.

Messages we send

An account is told about what happens on its tabs and bills by email, by push notification on a device where it turned them on, and, when text messages are switched on, by text to the number on its profile. Each kind of message can be switched off under Settings, Notifications.

A person an organiser added by name is written to only when the organiser asks us to, at the address or number the organiser typed. Reminders are limited: no more than one a day from the same person, and a fixed number in all.

Every message ends with a link that stops all messages from TabApp to that address or number, without signing in, and the same link turns them back on. To honour it we keep a scrambled copy of the address or number, never the address itself, and we keep it after an account is deleted, so that an address that asked for silence stays silent.

Who we share it with

These services process personal data for us, each only for the purpose given. Some of them process it in the United States or elsewhere outside the United Kingdom.

• Clerk: Signs you in and holds your account: your email address, name, phone number if you give one, and profile photo.
• Cloudflare Turnstile: Checks that whoever is signing in or signing up is a person and not a bot, on Clerk's behalf. It receives your IP address and details of your browser.
• Turso: Our database. It stores everything listed under What we collect, apart from images and messages to us.
• Vercel: Hosts TabApp. Every request passes through it, with your IP address, and it keeps our server logs.
• Cloudinary: Stores and serves the images you upload: receipt photos, photos on a bill, profile pictures and group pictures.
• Google Cloud Vision or OpenAI: Reads the items and prices from a receipt photo when you scan one. The photo is sent to whichever of the two we use at the time.
• Google Maps: Draws the Map page. Google receives your IP address, the area shown, which is around the places your bills were made, and anything you type into its search box.
• Google Places: Finds places near you when you start a bill or tab and allow your location: Google receives the area, to about 100 metres, from our server, and nothing that says who you are.
• Pusher: Carries live updates to the people on a bill, tab or group, including the names on it, so everyone sees a change at once.
• Stripe: Takes the card payment when you buy an upgrade, works out the VAT, and makes any refund: your name, email address, card details and billing country. Your card number goes to Stripe and never to us. Nothing is sold at present.
• Mailgun: Sends our emails, in the European Union: your address and the message. It also carries what you send through the Contact form to us.
• Twilio: Sends text messages: the phone number and the message. Text messages are switched off at present.
• Your browser's push service: Carries a notification to your device, run by Google, Mozilla, Apple or Microsoft depending on your browser. It is encrypted so that only your device can read it.
• Hookdeck: Receives a record of what happens in TabApp, such as a bill made, an item added, a payment recorded or a person joining, with your account identifier and the identifiers, counts and amounts of the bill, tab or group, never a name, a place or anything typed. We use it to run TabApp and see how it is used.
• Sentry: Receives a report when TabApp fails: the technical description of the error, the page it happened on and, if you are signed in, your account identifier. Email addresses, phone numbers and invite links are removed first, and it holds nothing from your bills.
• Grafana Cloud: Receives our operational measurements, which identify nobody, and our logs: the account, bill, tab or group a request was for, the screens opened, what was pressed or saved and whether it worked. A log never holds a name, contact details, payment details or anything typed, and email addresses, phone numbers and invite links are removed from it before it is sent. We use it to run TabApp and to answer you when something goes wrong, not to study how you use it. Grafana Cloud keeps a log for 30 days.
• LogRocket: Records how pages are used, to diagnose a problem. Text on the page and anything typed are masked before they leave your device, the contents of requests are not recorded, and a recording is linked to your account identifier, not your name or email. Session recording is switched off unless we turn it on, and even then it records only on a device where you switch it on, under Settings, Preferences.
• LaunchDarkly: Decides which features are switched on. It receives no name, email or phone number: our servers decide each feature against its rules, and nothing about you is sent back. The only account identifiers or email addresses it holds are any we enter to switch a feature on for particular people. It is not in use unless we connect it.

When you pay someone through a link on a bill, such as PayPal or Monzo, your browser opens that service directly; we send it nothing.

How long we keep it

• Your account and everything in it, for as long as you have the account.
• A bill, tab or group you delete can be restored for 30 days. After that a bill is removed, with its photos, the next time you create or delete a bill, and a tab the next time you create or delete a tab. A deleted group is kept until you delete your account.
• A friend invitation link works for 14 days; the invitation, with any address or number you entered, is kept until you delete your account. A record of an assistant's tool use is kept for 90 days. The scrambled addresses we use to limit abuse are removed once they are a day old.
• A message of thanks, until you delete it or your account. A message you delete can be put back for a few minutes, and is removed the next time the page is opened after that.
• The record of each sale, for at least 6 years, as UK tax law requires.
• A guest's seat lasts on that browser for up to 30 days.
• Our logs, for 30 days at Grafana Cloud. Error reports, Vercel's server logs and event records are kept by Sentry, Vercel and Hookdeck for their own retention periods.

Deleting your account

You can delete your account from Account in Settings. That removes your profile, payment details, friends, notification settings and devices, your messages of thanks, the bills, tabs and groups you own that nobody else is on, and their photos, and it deletes your sign-in account at Clerk. A bill, tab or group you own that others are on is kept for them and handed to one of them.

Every bill, tab and group that stays keeps what it needs to add up: your seat, splits and payments stay on it, with your name replaced, so that nobody else's balance changes. The credits and passes you hold, and your free allowance, are removed; of each sale we keep only what was sold, its price and currency, when, and Stripe's reference for the payment and any refund, under an identifier that no longer leads to you. The scrambled copies kept for stopped messages and for counting reminders sent to you, and anonymous answers to "Did this help?", are kept.

Your rights

You have the right to:

• Get a copy of your data: Export, under Account in Settings, downloads it in a portable format
• Have inaccurate data corrected
• Have your data deleted, as described above
• Object to, or ask us to restrict, how we use your data
• Withdraw your consent where we rely on it

Write to privacy@tabapp.app to use any of them. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Cookies and storage on your device

TabApp uses only cookies it needs to work: those that keep you signed in, and those that keep a guest's seat. There are no advertising or analytics cookies. If you switch session recording on, the recorder keeps its own storage on that device while it runs.

If you join a bill from an invite link without an account, we set one cookie for that bill. It holds a random key that keeps your seat on that browser for up to 30 days, and nothing else about you; we store only a scrambled copy of the key, on the bill. Clearing it, or the organiser releasing your seat, ends it.

If you open a tab from the link of your own that TabApp sent to your phone or email, we set one cookie for that tab in the same way. Opening the link on another browser moves the seat there. Clearing the cookie, pressing "Not you?", or the organiser sending you a new link ends it. The organiser can see when you opened the link and the kind of browser and device you opened it on.

Your browser also keeps your settings on the device, such as your theme, and a copy of your bills, tabs and people so that TabApp works without a connection, with any changes waiting to be sent. That copy belongs to the account signed in, and is removed when another account signs in on the device.

If you answer "Did this help?" under a help article, your browser keeps your answer and a random key, so that you count once and can change your mind. We store a scrambled copy of the key with the article and your answer, and nothing that says who you are.

Keeping it safe

Data travels encrypted between your device, TabApp and the services above. What is on a bill, tab or group is seen by the people on it and by anyone they share its link with, and only people who owe you see your bank account.

Changes to this policy

When this policy changes we post the new version here and update the date at the top.

Contact us

privacy@tabapp.app

FYNEWORKS LTD, 124 City Rd, London EC1V 2NX. Telephone +44 (0)208 058 0556.