Privacy Policy
Effective July 26, 2026
tidytab (“we,” “us”) is a free bill-splitting tool. We collect only what we need to make the product work, and we don’t sell your data to anyone. This policy explains what we collect, why, and who else touches it. If you’re in the EU, UK, or Switzerland, your rights under the GDPR are all gathered in a dedicated section near the end.
What We Collect
Information you provide
- •Your name (when creating a bill, contributing, or joining a group)
- •Email address (optional for bill creators and group members, required for login)
- •Payment details you choose to share (Venmo, Zelle, CashApp, PayPal, Revolut, or Wise handles, and bank details such as an IBAN)
- •Receipt photos you upload
- •Bill amounts and item details
Information collected automatically
- •Analytics (page views, performance, and anonymous feature usage events) via Vercel Analytics and PostHog - on by default in the US; cookieless and in-memory for EU, UK, and Swiss visitors until they opt in (see Cookies & Local Storage below)
- •Authentication cookies when you sign in
- •A preferences cookie storing your name and preferred payment method (180 days)
How We Use Your Data
- •Split bills - calculate shares, track contributions, generate payment links
- •Send notifications - email you when someone pays, and send gentle payment reminders (you can unsubscribe from any email)
- •Read receipts - your receipt photo is sent to an AI model to extract line items, totals, and tax
- •Improve the product - anonymous analytics help us understand which features get used
Third-Party Services
We use a small number of services to run tidytab. Each receives only the data it needs:
| Service | What it receives | Why |
|---|---|---|
| Microsoft Azure OpenAI | Receipt images | AI receipt scanning (OCR) |
| Resend | Email addresses, notification content | Sending emails |
| Supabase | All stored data | Database and file storage |
| Vercel | Anonymous usage metrics | Hosting and analytics |
| PostHog | Page views, feature usage events, opaque user ID (authenticated hosts only) | Product analytics and session replay |
We do not sell, rent, or share your personal data with advertisers or data brokers.
Cookies & Local Storage
Authentication cookies
If you sign in, Supabase sets session cookies to keep you logged in. These are essential for authentication.
Preferences cookie
We save your name and preferred payment method in a cookie (180 days) so you don’t have to re-enter them each time.
Region cookie
Outside the EU, UK, and Switzerland we set a tidytab_region cookie (24 hours) so the site knows standard analytics may run. It holds no identifier - just that classification - and in consent-required regions it is never set at all.
Local storage
Your browser stores contribution history and payment preferences locally on your device to improve the experience.
Analytics
We use Vercel Analytics and PostHog to collect usage data, including page views, feature usage events (e.g., bill creation, payment method chosen), and AI model performance metrics. Authenticated hosts are identified by their account user ID and email so we can support them across devices. Anonymous contributor activity is tracked at the bill or group level, not the individual level. No names, emails, or payment account details are sent to analytics services for anonymous users.
What happens by default depends on where you are. In the US - and everywhere else outside the EU, UK, and Switzerland - standard analytics are on from your first visit, and you can opt out any time with the control below. If you’re in the EU, UK, or Switzerland, or if we can’t tell where you are, analytics start cookieless instead: everything stays in memory, nothing is written to your device, and session replay is off unless you opt in via the consent banner. When analytics are on, PostHog may store an identifier in cookies/local storage and record sessions so we can watch back anonymized usage. Whichever way you decide, your choice is saved on your device - the tidytab_consent key in local storage plus a matching cookie our server refreshes, so a browser storage cleanup can’t silently flip your decision - and strictly functional storage (like the app-install prompt counter) never leaves your device.
Analytics preferences
You have not chosen yet: until you do, analytics stay anonymous and in-memory only.
Receipt Images
Receipt photos are stored in our cloud storage to display on the bill page. They are also sent to Microsoft Azure OpenAI for AI-powered text extraction. We do not use your receipt images to train AI models. Images are retained as long as the bill exists.
Data Retention
Bills, contributions, and group data are kept as long as they’re useful to you. We don’t currently auto-delete old data, but we plan to add automatic cleanup for settled bills in the future. If you want your data removed sooner, you can delete your account yourself at any time, or email us.
Splitting a bill is a shared record, so deletion works in two halves: everything that is only yours - your sign-in, unpublished bills, payment handles, badges, and device notification registrations - is erased, while bills and balances other people rely on stay put with your name replaced by “Deleted user.” Nothing left behind identifies you.
Your Rights
- •Unsubscribe - every notification email has an unsubscribe link
- •Delete your account - do it yourself at tidytab.app/account/delete, in seconds, or email hello@tidytab.app and we’ll remove your information for you
- •Ask questions - reach out anytime at hello@tidytab.app
If you’re in the EU, UK, or Switzerland, the GDPR gives you more rights on top - they’re all in the dedicated section below.
Children
tidytab is not intended for children under 16. We do not knowingly collect data from anyone under 16.
Changes to This Policy
If we make meaningful changes, we’ll update this page and the effective date above. For major changes, we’ll do our best to notify you via email.
Contact
Questions about this policy? Email hello@tidytab.app.
For visitors in the EU, UK & Switzerland
Everything above applies to you too. This section adds the disclosures and rights that are specific to your region.
Who’s Responsible (Data Controller)
The data controller for tidytab is Terry Tang. Full contact details, including a postal address, are on our Impressum. For anything privacy-related, email hello@tidytab.app.
Legal Bases Under the GDPR
Each of the purposes in “How We Use Your Data” rests on a legal basis under Art. 6 GDPR:
| Purpose | Legal basis |
|---|---|
| Running the service (bills, groups, payment links, receipt scanning) | Contract (Art. 6(1)(b)) - it’s what you asked us to do |
| Notification and reminder emails (always with an unsubscribe link) | Contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) |
| Operational analytics (anonymous, cookieless, in-memory) | Legitimate interest (Art. 6(1)(f)) - understanding and improving the product |
| Persisted analytics and session replay | Consent (Art. 6(1)(a)) - only if you opt in, withdrawable anytime with the control above |
| Security, rate limiting, and abuse prevention | Legitimate interest (Art. 6(1)(f)) - keeping tidytab safe |
International Transfers
tidytab is operated from the United States, and the providers listed under “Third-Party Services” process data there. Where data leaves the EU, transfers rely on the safeguards each provider commits to in its data-processing terms - the EU-US Data Privacy Framework where the provider is certified, and the European Commission’s Standard Contractual Clauses otherwise.
Analytics Storage & Consent
For you, cookieless analytics are the default: until you opt in via the consent banner, analytics state lives in memory only, nothing is written to your device, and session replay is off. If you decline (or never decide), the cookieless default stays. The only analytics-related storage before an opt-in is your consent choice itself - the tidytab_consentkey and its matching cookie, kept so a storage cleanup can’t flip your decision. You can change your mind any time with the analytics preferences control above.
Your GDPR Rights
The GDPR gives you these rights on top of the ones above - all free, all via a simple email to us (erasure you can also do yourself, instantly, on the delete account page):
- •Access (Art. 15) - get a copy of the personal data we hold about you
- •Rectification (Art. 16) - correct inaccurate data
- •Erasure (Art. 17) - have your data deleted
- •Restriction (Art. 18) - limit how we process your data
- •Portability (Art. 20) - receive your data in a machine-readable format
- •Objection (Art. 21) - object to processing based on legitimate interest
- •Withdraw consent (Art. 7(3)) - e.g. flip the analytics preference above, anytime
You also have the right to lodge a complaint with a data protection supervisory authority - in Germany, for example, the authority of your federal state, or any EU supervisory authority of your choice. We’d appreciate the chance to sort it out directly first, but you don’t have to give us one.
See also our Terms of Service for the rules of using tidytab, and our Impressum for provider information.