Tabbit Privacy Policy
Tabbit is a receipt-splitting app: take a photo of a receipt, assign each item to a person, and send a payment link. This policy explains what data Tabbit collects, why, and what we do with it. It applies to the Tabbit website at usetabbit.app and to the Tabbit iOS and Android apps. The rules for using Tabbit are in our Terms of Service.
The short version
Tabbit stores the information you see in the app on our servers so your tabs survive reinstalls and can be shared with the people you split with. That data is private to you and the people you choose to share it with. We never sell it, and we never share it with third parties for advertising or any other purpose, with two narrow exceptions: PostHog, a third-party analytics tool we use for metrics, and the service providers that process data on our behalf to make the app work (both described below).
Your account
Tabbit creates an account for you automatically the first time you use the app. We do not ask for your email address, phone number, or a password. Instead, the app generates a random device credential and stores it on your device; that credential identifies your account to our servers. If you set a display name or payment handle (Venmo, PayPal, Cash App, or custom instructions) inside the app, those are saved to your account profile.
For security, our authentication system records the IP address and browser user-agent string associated with each sign-in session. Expired sessions are swept from our database automatically.
What we store on our servers
Everything displayed within the app is stored against your account in our database:
- Your profile: display name, payment handles, default currency, and any custom scanning instructions you set.
- People: the names of the people you add to split with.
- Tabs and receipts: titles, line items, prices, tip, fees, discounts, who was on the tab, and how items were assigned.
- Groups: group names, member rosters, attached tabs, balances, recorded settlements, and recurring charges.
- Payment activity: when a participant opens their share page, taps a pay link, marks themselves paid, or a tab owner confirms a payment. Tabbit records these signals so tabs can show who has settled up. Tabbit never sees or processes the payment itself.
- Receipt photos, PDFs, and voice clips: stored in private cloud storage and linked to their tab so you can look at the original receipt later. Uploads that never get attached to a saved tab are deleted automatically within about a day.
- Share links: when you share a tab, we store a revocable link record. Anyone who has the link can view the tab it points to, so share links only with people you intend.
A small amount of data also stays on your device: your device credential, app settings, and offline caches of your tabs, so the app opens fast and works with a flaky connection.
How your data is shared
Your data is private to your account and to the people you deliberately share it with (via share links and group invites). We never sell your data. We never share it with third parties for advertising, marketing, or any other purpose, with these exceptions:
- PostHog (analytics): described in the next section.
- Receipt scanning and voice transcription: when you scan a receipt or use voice-fill, the photo or audio clip is sent to Google Gemini (via Google AI or OpenRouter) to be read into line items or assignments. It is processed for that single request; Google's and OpenRouter's handling is governed by their own terms.
- Infrastructure: Tabbit runs on Cloudflare (Workers, D1, and R2), which hosts our database and file storage as our infrastructure provider.
- Currency rates: for multi-currency tabs, our server fetches exchange rates from public rate APIs (Frankfurter, ExchangeRate-API). No personal data is sent with these requests.
- Static assets: the app loads fonts from Google Fonts and emoji images from the jsDelivr CDN, which see your IP address like any web request.
Analytics (PostHog)
Tabbit uses PostHog to understand how the app is used: which screens are visited, which features are tapped, error rates, and session recordings that help us debug problems. PostHog assigns an anonymous device identifier; we do not attach a real name or email to it (we never have your email). If you set a display name or payment handle inside the app, those values are included in analytics events so we can debug your sessions if you write to us. Diagnostics for receipt scanning and voice-fill (including the extracted items and transcriptions) are also logged to PostHog so we can improve scan quality. Share-link tokens are scrubbed from analytics before they are sent, and session recording is disabled on shared-tab pages. You can opt out by blocking the PostHog domain at the network level.
Permissions the app asks for
- Camera: only when you tap the camera button, to capture a receipt.
- Photo library: only when you pick an existing photo of a receipt.
- Microphone: only when you tap the voice-fill button.
Tabbit does not access your contacts, location, calendar, or any other system data.
Children
Tabbit is not directed at children under 13 and we do not knowingly collect information from them.
Data retention and deletion
Your tabs, groups, and files are kept until you delete them. Deleting a tab removes it from your history immediately; its photos and voice clips are purged from cloud storage by a scheduled cleanup that runs daily. The same cleanup removes uploads that were never attached to a tab, expired sign-in sessions, and revoked share links. Records that other people depend on (for example a payment recorded in a shared group ledger) are corrected by recording an adjustment rather than by erasing history.
Because your account has no email attached, deleting the app does not by itself delete your server-side data (the account simply becomes unreachable). To have your account and all associated data deleted, or to request deletion of analytics tied to your device, email the address below.
Changes
If we change this policy, we will update the "Last updated" date at the top. Material changes will also be surfaced inside the app.
Contact
Questions or deletion requests: hello@usetabbit.app.