Privacy

What we store

When you create an account, we store your email and first/last name, plus anything optional you choose to add: a username, your country and preferred currency, a verified phone number, and any payment handles you add (Venmo, Cash App, Zelle, PayPal, Wise, or Revolut). If you sign in with Google, Apple, or Microsoft, we also store the provider account ID so future sign-ins link up.

For each tab you create or interact with, we store the items, the people you assigned, prepayments, tax/tip/service totals, and any receipt photo you upload (see Receipts below). If you create a tab on a friend's behalf and set them as the payee, their name and payment handle are shown to people on that tab so they can be paid back.

To understand how people find and use Tab Tender, we keep a lightweight, mostly anonymous event log — how a new account arrived (a shared tab, a personal invite link, or a QR campaign code), aggregate counts of link visits, product-funnel actions (e.g. a tab was created, shared, or paid), and whether the app is opened as an installed app (PWA) versus a browser. This is used for our own product analytics, never sold or shared.

What we don't store

We do not store credit card numbers, bank info, or payment credentials. When you import a digital receipt, we keep only the card brand (e.g. Visa) — never the card number, name, or expiration. See Advertising below for how the brand is used.

Receipts

Receipt photos you upload are stored as proof for the people on that tab and are automatically deleted after 30 days. We use an automated vision service to read the items, totals, and the venue's name/address off the photo, but we don't use your receipts to train models.

Venues & location

When a receipt includes the restaurant or bar's name and address, we save those details against a shared venue record and may convert the address into approximate coordinates so we can see, in aggregate, the kinds of places and regions Tab Tender is used. This is venue-level, not a record of yourlocation — we don't track your device location or movements, and we never request location permissions.

Aggregate insights & public price pages

We combine de-identified data across many receipts — item prices, tax, tip and service amounts, party sizes, and the venue's city/region — to produce aggregate statistics, such as the typical cost of a night out, what a beer or an entree runs at a given venue, grocery staple prices, or average tipping by city and state. We may also aggregate trip-level figures (e.g. lodging cost per person per night) for similar travel-cost insights.

These are statistics, not your records, and they can never identify you: every figure is stripped of identifiers, computed from a minimum number of receipts and submitters, and trimmed of outliers, so no person or individual bill can be singled out from the numbers. The venues themselves (the businesses, never the people) are a different matter: we publish venue-level aggregates by name, for example a public page showing the average price of a beer at a specific bar, how that compares with the city average, price trends over time, and the venue's star rating from Tab Tender users. A venue page only exists once several different people have split bills there, and it only ever shows averaged figures, never a single receipt.

We may publish these aggregates on public web pages, including pages that compare or rank places, and use them in our products, features (like the signed-in price search), and marketing. Aggregated, de-identified data may also power future Tab Tender data products.

Venue ratings

After a tab, you can optionally rate the venue (1 to 5 stars, plus a short note). Star ratings are combined into a venue's public average once enough different people have rated it. Your note text is never published verbatim: it may be summarized together with other people's notes by an AI model into an anonymous “what users are saying” blurb on the venue's page, and Tab Tender administrators can read notes to keep the feature healthy. Ratings are optional, and you can change or remove yours at any time from the tab. Deleting your account deletes your ratings and notes.

Invites & contacts

Inviting friends shares your personal invite link. If your device offers a contact picker and you choose to use it, the contacts you select stay on your device to pre-fill a message in your own texting app — we never receive or store your contacts.

Finding friends

So friends can connect, signed-in users can look each other up to send a friend request. You can always be found by your exact username or the emailyou signed up with (you have to know the exact value — we don't list users). Being found by your real name is off by default: name search only returns people who opted in, and you can turn it on or off anytime in your profile. People you've blocked can't find you, and search never reveals payment handles or tab details.

Advertising & affiliate links

Tab Tender is free, supported by ads and affiliate offers. We show standard display ads, and we may show a contextual sponsored offer on a tab chosen from non-identifying signals on that tab — the detected card brand and how much was spent by category (e.g. food vs. drinks). We never send your name, email, or card number to advertisers.

Sponsored placements are labeled “Sponsored”. If you tap one and sign up or buy, we may earn a commission. Clicking opens a third-party site governed by its own privacy policy; we pass only an anonymous reference so the partner can credit the referral.

Cookies & consent

We ask for your consent before serving personalized ads. Until you accept, ads default to non-personalized and ad cookies stay off (Google Consent Mode). You can Accept or Decline in the banner; your choice is remembered in a cookie and you can change it by clearing that cookie. Essential cookies (sign-in, security) are always on. Our own usage analytics are cookieless; Google Analytics also honors your banner choice. Until you accept, it runs without cookies or identifiers.

Sharing

Tab share pages are public to anyone with the link for 7 days, then become visible only to the owner and signed-in people who claimed a spot. They're marked noindexso search engines skip them. We don't sell or share your data with third parties.

Email, SMS & notifications

Transactional messages keep your account and tabs working: email verification and password resets, sign-in links, contact replies, friend requests, and a one-time SMS code if you choose to verify a phone number.

A few emails are opt-in and you control them from your profile:

• Payment reminders — a host can nudge you about a tab you owe on; these only reach your inbox if you turned them on, and every one has a one-click unsubscribe.
• Tab status emails— if you host tabs: an optional Friday email listing who still owes you (only when something's unpaid), a note when a tab fully settles, and a monthly recap. One preference covers all three; it's on by default for hosts and you can turn it off in your profile or from the link in any of those emails' footers.
• Product news & feedback — occasional updates and feedback requests, sent only if you explicitly opt in (off by default). Unsubscribe anytime.

If you turn on push notifications, we store a browser push subscription (an anonymous endpoint from your browser's push service, e.g. Google or Apple) so we can deliver them; you can switch them off anytime in your profile or browser settings. We measure whether our emails were delivered, opened, or clicked to gauge usefulness.

Who at Tab Tender can see your data

Authorized Tab Tenderadministrators can access account and tab data when it's needed to operate the service — answering your support messages, reviewing reported users or content, and debugging problems. Administrative tools show the minimum needed for the task, access is limited to what the task requires, and your data is never browsed out of curiosity, sold, or shared.

Service providers

We rely on a few vendors to run the service, each processing only what they need: hosting + basic traffic analytics (Vercel), the database (Neon), transactional email (Resend), receipt reading plus item classification and rating-note summarization (Google's Gemini API), address-to-coordinates lookup (OpenStreetMap / Nominatim, or another geocoder we configure), site analytics (Google Analytics, consent-gated as described above), and display ads (Google AdSense). We don't sell your data to anyone.

Your data, download & deletion

From your profile you can download a copy of your data (a JSON export of your account, tabs, friends, groups, and trips) and delete your account at any time — no need to email us. Deleting removes your profile, sign-in, friends, and personal details; any receipt photos you uploaded are deleted from storage, and your activity is unlinked from you. Tabs you hosted stay available to the other people on them but are no longer linked to you. You can also delete any tab you own from the tab editor.

Self-serve export and deletion are instant. If you'd rather make a data-access or deletion request by email — or you're acting on behalf of someone else — contact us and we'll respond within 30 days, in line with GDPR and CCPA.