Privacy Policy

1. Introduction

This Privacy Policy explains how Tabsnap B.V. ("Tabsnap", "we", "us", "our") collects, uses, and protects your personal data when you use the Tabsnap iOS app and the tabsnap.app website, including the split.tabsnap.app and pay.tabsnap.app pages. Tabsnap B.V. is a private limited company (besloten vennootschap) registered in the Netherlands (Berkenweg 11, 3941 JA Doorn, KvK 42128754) and is the Data Controller for the personal data described here.

Tabsnap is a bill-splitting app. You scan a restaurant receipt, split the items between the people at the table, and everyone pays the host through the host's own payment link. Tabsnap does not handle money itself.

If you have questions about this policy, email contact@tabsnap.app.

1. Introduction

This Privacy Policy explains how Tabsnap B.V. ("Tabsnap", "we", "us", "our") collects, uses, and protects your personal data when you use the Tabsnap iOS app and the tabsnap.app website, including the split.tabsnap.app and pay.tabsnap.app pages. Tabsnap B.V. is a private limited company (besloten vennootschap) registered in the Netherlands (Berkenweg 11, 3941 JA Doorn, KvK 42128754) and is the Data Controller for the personal data described here.

Tabsnap is a bill-splitting app. You scan a restaurant receipt, split the items between the people at the table, and everyone pays the host through the host's own payment link. Tabsnap does not handle money itself.

If you have questions about this policy, email contact@tabsnap.app.

2. Data we collect

We collect the data we need to run the app. From the contents of bills, without names or contact details, we also make anonymous statistics about products, prices, venues and brands, which we can share with or sell to other companies; for those statistics we can also read a few extra details from the receipt, such as the venue's address and the time printed on it. Section 13 explains how, and how you can object. We do not sell personal data about you or about the people on your bills; figures about a venue run by one person or a partnership go to companies only with its agreement. We show no ads, send no marketing, use no advertising SDKs and do not track you across other companies' apps or websites.

You need a phone number to create an account, because that is how you sign in. Everything else is optional or follows from how you use Tabsnap: you can type bills in instead of scanning, and leave contacts, notifications and usage statistics off.

Account data

A user ID.
Your phone number, which you use to sign in with a one-time SMS code. We store it as soon as you request a sign-up code, also if you never finish signing up (Section 7).
A display name, an avatar colour and, if you set one, an avatar photo. Avatar photos are public files: anyone with the direct link can view yours.
An optional email address, if you add one, used only to contact you about your account.
Your settings: language, currency, notification switches and a marketing preference that is off by default.
Your Tabsnap Pro status and, if you subscribe, the subscription record Apple gives us, with the plan, its status, its end date and Apple's transaction number.
When your account was created and when you last signed in.
Sign-in sessions: for each device you sign in on, the IP address and the device and app type it was last used from, to keep you signed in and to spot misuse.

Bill data

The venue name, date, currency, items with prices and quantities, totals, tax, tip and service charge, and how the bill is split, including who ordered what.
The participants you add: a name, an avatar colour and their phone number, if you type it in or add them from your contacts.
The payment link you add as host, which we check automatically to flag links that look like phishing.
Payment status (requested, paid), with times and who set it. Opening the host's payment link can mark a share as paid automatically.
Extra payment requests when leftover items are assigned to someone after the bill was shared.
An audit log of changes to the bill, with times and the names of those involved.
In-app notifications about your bills.
Saved groups: the name of each group you save, and each member's name, colour and optional phone number.

Receipt images

The photo you take or choose of the receipt, kept in private storage. Before upload the app removes hidden camera details, such as where the photo was taken.
The photo shows whatever is printed on the receipt, such as the venue's address, a staff member's name, a table number or the last digits of a card, and we store it as it is.
When you scan, an AI model reads the photo. For the bill it is asked for the venue name, date, currency, items and amounts. For the anonymous statistics in Section 13 we can also have it read the venue's address, town and country, its registration or VAT number and the time printed on the receipt, which we keep apart from your bill, but never a staff member's name, a table number or card digits.

Contacts matching

Contacts access stays off until you allow it in iOS. The app then reads only names, including company names, and phone numbers.
To check who already uses Tabsnap, the app sends the phone numbers, not the names, to our server. For each number that belongs to an account, the server returns that account's ID, display name and profile photo. It does not store the numbers you send.
If you add a contact to a bill or a saved group, their name and phone number are stored there, linked to your account. On a bill, this routes the bill to their Tabsnap account if they have one.

Push notification token

If you allow notifications, we store the push token iOS gives the app and use it to notify you about your bills, for example when someone pays, with payment reminders and, with Tabsnap Pro, a weekly summary of what you are owed.
Apple's push service carries the notification text, which can contain another person's name, the venue and an amount, plus the kind of notification and a reference to the bill.
Signing out does not delete the token, so notifications for your account can still reach that phone.

Your own overview

The app can show you figures about your own bills, such as what you spent and who you split with most. They are worked out on your phone from data already in your account, are not stored on our servers and are shown only to you.

Usage statistics

Usage statistics are off until you switch them on. We ask once, at the end of sign-up, and before you say yes no analytics identifier is stored on your phone and nothing is sent.
You can change your answer at any time under Settings, Security & Privacy, Security, Usage statistics. Switching them off stops collection at once. Your answer is saved on your phone until you sign out. After that, usage statistics stay off for whoever signs in, until they switch them on.
Events are product actions, such as app opened, receipt scanned or bill shared. Amounts are sent only as rough ranges; item names, venue names and links are never sent.
Events carry a one-way hash of your account ID, never your name, phone number or email. They are pseudonymous, not anonymous: we can still link them to your account.
Each event also carries technical details: app version, phone model, iOS version, screen size, language, time zone and whether you use Wi-Fi or mobile data.
Our analytics provider (Section 6) receives the IP address the events come from. We have set it to discard that address and not to derive a location from it.
We use usage statistics only to understand and improve Tabsnap, never for the anonymous statistics in Section 13.

Crash reporting

Crash and error reports, which we use to find and fix problems, contain the error, the stack trace, your iOS version, device model and app version.
Each report, and each app start, carries a random identifier per installation that resets when you reinstall the app, so we can see how many installations a problem affects and how often the app crashes. An app start sends only that identifier, the app version and whether the app closed normally.
The app removes account and bill identifiers, email addresses and link details from reports, but an error message can occasionally contain a piece of the data involved, such as a name.
We have set our crash-reporting provider (Section 6) not to store your IP address or a location derived from it.

Service counters and technical records

Scan records: for each receipt scan, your account ID, whether it worked, how long it took, what it cost and other technical details, without receipt content, to monitor costs and scan quality.
Usage counters: your scans and storage per day, and your successful scans per month for the free scan limit.
Link statistics: per share link, the opens and App Store taps of each invited person, without IP address, browser details or name.
Rate-limit counters: per account and per bill, including failed or blocked attempts.
Safety and fraud records: a record when the service blocks something, such as a usage cap, and of a few ordinary events that help us spot misuse, such as a payment link changed on a shared bill, a share marked as paid without the payment link being opened, or a Pro subscription that ended. They contain identifiers, counts, amounts and the domain of a payment link, never a name, phone number or email address.
Payments received: each share marked as paid on a host's bills, with the amount, the bill and the time, recorded for that host to spot misuse of payment links.

2. Data we collect

We collect the data we need to run the app. From the contents of bills, without names or contact details, we also make anonymous statistics about products, prices, venues and brands, which we can share with or sell to other companies; for those statistics we can also read a few extra details from the receipt, such as the venue's address and the time printed on it. Section 13 explains how, and how you can object. We do not sell personal data about you or about the people on your bills; figures about a venue run by one person or a partnership go to companies only with its agreement. We show no ads, send no marketing, use no advertising SDKs and do not track you across other companies' apps or websites.

You need a phone number to create an account, because that is how you sign in. Everything else is optional or follows from how you use Tabsnap: you can type bills in instead of scanning, and leave contacts, notifications and usage statistics off.

Account data

A user ID.
Your phone number, which you use to sign in with a one-time SMS code. We store it as soon as you request a sign-up code, also if you never finish signing up (Section 7).
A display name, an avatar colour and, if you set one, an avatar photo. Avatar photos are public files: anyone with the direct link can view yours.
An optional email address, if you add one, used only to contact you about your account.
Your settings: language, currency, notification switches and a marketing preference that is off by default.
Your Tabsnap Pro status and, if you subscribe, the subscription record Apple gives us, with the plan, its status, its end date and Apple's transaction number.
When your account was created and when you last signed in.
Sign-in sessions: for each device you sign in on, the IP address and the device and app type it was last used from, to keep you signed in and to spot misuse.

Bill data

The venue name, date, currency, items with prices and quantities, totals, tax, tip and service charge, and how the bill is split, including who ordered what.
The participants you add: a name, an avatar colour and their phone number, if you type it in or add them from your contacts.
The payment link you add as host, which we check automatically to flag links that look like phishing.
Payment status (requested, paid), with times and who set it. Opening the host's payment link can mark a share as paid automatically.
Extra payment requests when leftover items are assigned to someone after the bill was shared.
An audit log of changes to the bill, with times and the names of those involved.
In-app notifications about your bills.
Saved groups: the name of each group you save, and each member's name, colour and optional phone number.

Receipt images

The photo you take or choose of the receipt, kept in private storage. Before upload the app removes hidden camera details, such as where the photo was taken.
The photo shows whatever is printed on the receipt, such as the venue's address, a staff member's name, a table number or the last digits of a card, and we store it as it is.
When you scan, an AI model reads the photo. For the bill it is asked for the venue name, date, currency, items and amounts. For the anonymous statistics in Section 13 we can also have it read the venue's address, town and country, its registration or VAT number and the time printed on the receipt, which we keep apart from your bill, but never a staff member's name, a table number or card digits.

Contacts matching

Contacts access stays off until you allow it in iOS. The app then reads only names, including company names, and phone numbers.
To check who already uses Tabsnap, the app sends the phone numbers, not the names, to our server. For each number that belongs to an account, the server returns that account's ID, display name and profile photo. It does not store the numbers you send.
If you add a contact to a bill or a saved group, their name and phone number are stored there, linked to your account. On a bill, this routes the bill to their Tabsnap account if they have one.

Push notification token

If you allow notifications, we store the push token iOS gives the app and use it to notify you about your bills, for example when someone pays, with payment reminders and, with Tabsnap Pro, a weekly summary of what you are owed.
Apple's push service carries the notification text, which can contain another person's name, the venue and an amount, plus the kind of notification and a reference to the bill.
Signing out does not delete the token, so notifications for your account can still reach that phone.

Your own overview

The app can show you figures about your own bills, such as what you spent and who you split with most. They are worked out on your phone from data already in your account, are not stored on our servers and are shown only to you.

Usage statistics

Usage statistics are off until you switch them on. We ask once, at the end of sign-up, and before you say yes no analytics identifier is stored on your phone and nothing is sent.
You can change your answer at any time under Settings, Security & Privacy, Security, Usage statistics. Switching them off stops collection at once. Your answer is saved on your phone until you sign out. After that, usage statistics stay off for whoever signs in, until they switch them on.
Events are product actions, such as app opened, receipt scanned or bill shared. Amounts are sent only as rough ranges; item names, venue names and links are never sent.
Events carry a one-way hash of your account ID, never your name, phone number or email. They are pseudonymous, not anonymous: we can still link them to your account.
Each event also carries technical details: app version, phone model, iOS version, screen size, language, time zone and whether you use Wi-Fi or mobile data.
Our analytics provider (Section 6) receives the IP address the events come from. We have set it to discard that address and not to derive a location from it.
We use usage statistics only to understand and improve Tabsnap, never for the anonymous statistics in Section 13.

Crash reporting

Crash and error reports, which we use to find and fix problems, contain the error, the stack trace, your iOS version, device model and app version.
Each report, and each app start, carries a random identifier per installation that resets when you reinstall the app, so we can see how many installations a problem affects and how often the app crashes. An app start sends only that identifier, the app version and whether the app closed normally.
The app removes account and bill identifiers, email addresses and link details from reports, but an error message can occasionally contain a piece of the data involved, such as a name.
We have set our crash-reporting provider (Section 6) not to store your IP address or a location derived from it.

Service counters and technical records

Scan records: for each receipt scan, your account ID, whether it worked, how long it took, what it cost and other technical details, without receipt content, to monitor costs and scan quality.
Usage counters: your scans and storage per day, and your successful scans per month for the free scan limit.
Link statistics: per share link, the opens and App Store taps of each invited person, without IP address, browser details or name.
Rate-limit counters: per account and per bill, including failed or blocked attempts.
Safety and fraud records: a record when the service blocks something, such as a usage cap, and of a few ordinary events that help us spot misuse, such as a payment link changed on a shared bill, a share marked as paid without the payment link being opened, or a Pro subscription that ended. They contain identifiers, counts, amounts and the domain of a payment link, never a name, phone number or email address.
Payments received: each share marked as paid on a host's bills, with the amount, the bill and the time, recorded for that host to spot misuse of payment links.

3. Who can see what

Only you: your saved groups, in-app notifications, settings, usage counters and push token, and your own overview (Section 2).
Participants on your bill who use the app: the bill with its items, split, amounts and receipt photo, the other participants' names and avatars, the bill's audit log, and the names and paid amounts of web guests on that bill.
Anyone who has a share or join link: a bill summary, the host's display name, the items with their claim status, and the receipt photo through a link that works for about 1 hour. Other claimers are shown anonymised. The payment page also shows the name the host entered for the person it is for, with their share, the host's first name and profile photo, and all items and totals on the bill, without other people's names. Anyone with the link can open it, so share it only with the people at the table.
People who have your phone number in their contacts: through contact matching, that your number has a Tabsnap account, with your display name and profile photo.
Brands, venues and other companies that receive or buy our anonymous statistics: combined figures only, never anything about you or about a single bill (Section 13).
Our own team and the developers of our development partner (Section 6): the data we store, which they use only to build, run and fix Tabsnap.

Who can see your phone number

Other users and web visitors cannot see or retrieve your phone number or email address through Tabsnap. Anyone who added your number to a bill or a group keeps the number they supplied. Contact matching only confirms a number to someone who already has it.

3. Who can see what

Only you: your saved groups, in-app notifications, settings, usage counters and push token, and your own overview (Section 2).
Participants on your bill who use the app: the bill with its items, split, amounts and receipt photo, the other participants' names and avatars, the bill's audit log, and the names and paid amounts of web guests on that bill.
Anyone who has a share or join link: a bill summary, the host's display name, the items with their claim status, and the receipt photo through a link that works for about 1 hour. Other claimers are shown anonymised. The payment page also shows the name the host entered for the person it is for, with their share, the host's first name and profile photo, and all items and totals on the bill, without other people's names. Anyone with the link can open it, so share it only with the people at the table.
People who have your phone number in their contacts: through contact matching, that your number has a Tabsnap account, with your display name and profile photo.
Brands, venues and other companies that receive or buy our anonymous statistics: combined figures only, never anything about you or about a single bill (Section 13).
Our own team and the developers of our development partner (Section 6): the data we store, which they use only to build, run and fix Tabsnap.

Who can see your phone number

Other users and web visitors cannot see or retrieve your phone number or email address through Tabsnap. Anyone who added your number to a bill or a group keeps the number they supplied. Contact matching only confirms a number to someone who already has it.

4. When someone sends you a Tabsnap link (web guests, no account)

You can open a Tabsnap split or payment link in your browser without an account.

What we receive: the items you claim, an optional name, a random token your browser creates so you can return to your claim, whether and how you marked your share as paid, when you opened the link, and whether you tapped the App Store banner. Opening the host's payment link can mark your share as paid automatically. If the host later assigns leftover items to you, we create an extra payment request for those items.

What your browser stores: only on the split page, in local storage (no cookies): your claim token, the last name you used and any extra charges assigned to you, so you still see what you owe when you return. The payment page stores nothing in your browser.

Who sees what you do: the host sees your name, your claims and whether you marked your share as paid, also in their notifications. Participants on the bill who use the app see your name and the amount you marked as paid. Other web visitors do not see your name.

What our providers see: our hosting providers (Section 6) record standard request data, including your IP address and browser type, in their technical logs. We do not use those logs to identify you.

Legal basis and retention: our legitimate interest, and the host's, in letting invited people split a bill without an account (Art. 6(1)(f) GDPR). Your claim data is kept as long as the host keeps the bill and deleted within about 30 days after the host deletes it, or at once if the host deletes their account. Expired payment links are deleted 90 days after they expire. What your browser stores stays there until you clear your site data.

Anonymous statistics: the contents of the bill can count in the anonymous statistics of Section 13, without your name or who ordered or claimed what. To object, send us the link at contact@tabsnap.app and we leave that bill out.

If someone added you to a bill or a group

If you are on someone's bill or in their saved group, whether or not you use Tabsnap, that person gave us your name, your phone number if they added it, and, on a bill, the items and amounts assigned to you. We use these details to split that bill and, if you have an account, to show it to you. The contents of the bill can also count in the anonymous statistics of Section 13, never with your name or who ordered what. If someone who has your number uses contact matching, your number is compared with our accounts and not kept, unless they add you to a bill or a saved group. The pages you open from a Tabsnap link point to this policy; if you never open one, we do not contact you separately, and this public policy is how we inform you (Art. 14(5)(b) GDPR).

You can use your rights in Section 9, including the right to object.

4. When someone sends you a Tabsnap link (web guests, no account)

You can open a Tabsnap split or payment link in your browser without an account.

What we receive: the items you claim, an optional name, a random token your browser creates so you can return to your claim, whether and how you marked your share as paid, when you opened the link, and whether you tapped the App Store banner. Opening the host's payment link can mark your share as paid automatically. If the host later assigns leftover items to you, we create an extra payment request for those items.

What your browser stores: only on the split page, in local storage (no cookies): your claim token, the last name you used and any extra charges assigned to you, so you still see what you owe when you return. The payment page stores nothing in your browser.

Who sees what you do: the host sees your name, your claims and whether you marked your share as paid, also in their notifications. Participants on the bill who use the app see your name and the amount you marked as paid. Other web visitors do not see your name.

What our providers see: our hosting providers (Section 6) record standard request data, including your IP address and browser type, in their technical logs. We do not use those logs to identify you.

Legal basis and retention: our legitimate interest, and the host's, in letting invited people split a bill without an account (Art. 6(1)(f) GDPR). Your claim data is kept as long as the host keeps the bill and deleted within about 30 days after the host deletes it, or at once if the host deletes their account. Expired payment links are deleted 90 days after they expire. What your browser stores stays there until you clear your site data.

Anonymous statistics: the contents of the bill can count in the anonymous statistics of Section 13, without your name or who ordered or claimed what. To object, send us the link at contact@tabsnap.app and we leave that bill out.

If someone added you to a bill or a group

If you are on someone's bill or in their saved group, whether or not you use Tabsnap, that person gave us your name, your phone number if they added it, and, on a bill, the items and amounts assigned to you. We use these details to split that bill and, if you have an account, to show it to you. The contents of the bill can also count in the anonymous statistics of Section 13, never with your name or who ordered what. If someone who has your number uses contact matching, your number is compared with our accounts and not kept, unless they add you to a bill or a saved group. The pages you open from a Tabsnap link point to this policy; if you never open one, we do not contact you separately, and this public policy is how we inform you (Art. 14(5)(b) GDPR).

You can use your rights in Section 9, including the right to object.

5. How we use your data

Running your account and the app, including sign-up and sign-in, storing, splitting and sharing your bills and receipt photos, your own overview, Tabsnap Pro, the free scan limit and the push notifications you switch on: performance of a contract (Art. 6(1)(b)).
Reading your receipt photo with Anthropic's Claude model to turn it into items and totals: performance of a contract (Art. 6(1)(b)).
The names, phone numbers and amounts of people you add to a bill or a saved group, and the numbers compared during contact matching: our legitimate interest, and yours, in splitting a bill with the people you were with and finding them in the app (Art. 6(1)(f)).
Details about other people that a receipt photo happens to show, such as a staff member's name: our legitimate interest, and yours, in letting everyone on the bill check the split against the receipt (Art. 6(1)(f)).
Reading your address book for contact matching, only after you grant the iOS Contacts permission and use the feature: your consent (Art. 6(1)(a)), which you can withdraw at any time in iOS Settings.
Usage statistics, only after you agree: your consent (Art. 6(1)(a)), which you can withdraw at any time under Settings, Security & Privacy, Security, Usage statistics.
Crash reports, sign-in sessions, limits and counters, the phishing check on payment links, safety and fraud records, records of payments received, scan and cost records, and backups: our legitimate interest in keeping the app stable and scanning reliable, protecting the service, the people who use it and our costs, and keeping track of those costs (Art. 6(1)(f)).
Processing for web guests (Section 4): our legitimate interest, and the host's, in letting invited people split a bill without an account (Art. 6(1)(f)).
Link statistics: our legitimate interest in knowing whether shared links reach people and bring them to the app (Art. 6(1)(f)).
Making anonymous statistics from the contents of bills and receipt photos, including figures about venues and brands, and sharing or selling them (Section 13): our legitimate interest in funding Tabsnap by offering these statistics to venues, brands and market research firms (Art. 6(1)(f)). You can object at any time, without giving a reason.
Figures about a venue that agreed to them: our agreement with that venue (Art. 6(1)(b)).
Taking part with an account that already existed when this policy first described these statistics, and adding bills from before then: your consent in the app, which you can withdraw at any time (Art. 6(1)(a)).
Showing the prices of a venue run by one person or a partnership in the app or on tabsnap.app: our legitimate interest in giving people clear price information (Art. 6(1)(f)).
Answering your emails and contact-form messages: performance of a contract if you use Tabsnap, otherwise our legitimate interest in helping you (Art. 6(1)(b) or (f)). Handling a request about your privacy rights: our legal obligation (Art. 6(1)(c)).
Counting visits to tabsnap.app without cookies: our legitimate interest in knowing how the website is used (Art. 6(1)(f)).
Loading one font for tabsnap.app from Google Fonts, which gives Google your IP address: our legitimate interest in showing the website as designed (Art. 6(1)(f)).

Where we rely on legitimate interest, you can object at any time (Section 9).

No decisions by software alone

We take no decisions about you with legal or similarly significant effects by software alone. If an automated check blocks something you do, write to us and a person will look at it.

5. How we use your data

Running your account and the app, including sign-up and sign-in, storing, splitting and sharing your bills and receipt photos, your own overview, Tabsnap Pro, the free scan limit and the push notifications you switch on: performance of a contract (Art. 6(1)(b)).
Reading your receipt photo with Anthropic's Claude model to turn it into items and totals: performance of a contract (Art. 6(1)(b)).
The names, phone numbers and amounts of people you add to a bill or a saved group, and the numbers compared during contact matching: our legitimate interest, and yours, in splitting a bill with the people you were with and finding them in the app (Art. 6(1)(f)).
Details about other people that a receipt photo happens to show, such as a staff member's name: our legitimate interest, and yours, in letting everyone on the bill check the split against the receipt (Art. 6(1)(f)).
Reading your address book for contact matching, only after you grant the iOS Contacts permission and use the feature: your consent (Art. 6(1)(a)), which you can withdraw at any time in iOS Settings.
Usage statistics, only after you agree: your consent (Art. 6(1)(a)), which you can withdraw at any time under Settings, Security & Privacy, Security, Usage statistics.
Crash reports, sign-in sessions, limits and counters, the phishing check on payment links, safety and fraud records, records of payments received, scan and cost records, and backups: our legitimate interest in keeping the app stable and scanning reliable, protecting the service, the people who use it and our costs, and keeping track of those costs (Art. 6(1)(f)).
Processing for web guests (Section 4): our legitimate interest, and the host's, in letting invited people split a bill without an account (Art. 6(1)(f)).
Link statistics: our legitimate interest in knowing whether shared links reach people and bring them to the app (Art. 6(1)(f)).
Making anonymous statistics from the contents of bills and receipt photos, including figures about venues and brands, and sharing or selling them (Section 13): our legitimate interest in funding Tabsnap by offering these statistics to venues, brands and market research firms (Art. 6(1)(f)). You can object at any time, without giving a reason.
Figures about a venue that agreed to them: our agreement with that venue (Art. 6(1)(b)).
Taking part with an account that already existed when this policy first described these statistics, and adding bills from before then: your consent in the app, which you can withdraw at any time (Art. 6(1)(a)).
Showing the prices of a venue run by one person or a partnership in the app or on tabsnap.app: our legitimate interest in giving people clear price information (Art. 6(1)(f)).
Answering your emails and contact-form messages: performance of a contract if you use Tabsnap, otherwise our legitimate interest in helping you (Art. 6(1)(b) or (f)). Handling a request about your privacy rights: our legal obligation (Art. 6(1)(c)).
Counting visits to tabsnap.app without cookies: our legitimate interest in knowing how the website is used (Art. 6(1)(f)).
Loading one font for tabsnap.app from Google Fonts, which gives Google your IP address: our legitimate interest in showing the website as designed (Art. 6(1)(f)).

Where we rely on legitimate interest, you can object at any time (Section 9).

No decisions by software alone

We take no decisions about you with legal or similarly significant effects by software alone. If an automated check blocks something you do, write to us and a person will look at it.

6. Who we share data with

Our providers process personal data only on our instructions, under a contract with us that requires them to protect it at least as well as this policy describes; Apple and Google Fonts act under their own terms.

Supabase Pte. Ltd., Singapore (data processor). Hosts our database, file storage, sign-in and server functions, so it holds the data we store, and keeps request logs with IP addresses.

Anthropic PBC, United States (data processor). Reads receipt photos with its Claude model, and receives only the photo and your phone's language and region setting.

Twilio Inc., United States (data processor). Sends our one-time codes by SMS, and receives the phone number and the message with the code.

PostHog, Inc., United States (data processor). Runs our usage statistics and, only after you switch them on, receives events tied to a hashed account ID, with the technical details described in Section 2.

Functional Software, Inc., doing business as Sentry, United States (data processor). Runs our crash and error reporting, and receives the reports described in Section 2.

Vercel Inc., United States (data processor). Hosts the split.tabsnap.app and pay.tabsnap.app pages and our internal admin dashboard, and receives request data such as IP addresses and the account data the dashboard shows.

Framer B.V., the Netherlands (data processor). Hosts tabsnap.app, including the contact form, and counts its visits without cookies; it receives request data such as IP addresses, and what you enter in the contact form.

Google Fonts (Google LLC, United States, under its own terms). Our website loads one typeface from it, so your browser sends Google your IP address, browser type and the address of our website.

Google (Google Workspace, data processor). Runs our mailbox, including contact@tabsnap.app, and receives the emails you send us, with any attachments.

Revido LLC, United States (data processor, development partner). Builds, maintains and releases the app with us, and so has access to our production systems and the data in them.

Apple Inc., United States (platform). Runs the App Store, In-App Purchase, push delivery and TestFlight, so it handles your purchases and the notifications we send you. It gives us your subscription record and, if you test through TestFlight, the tester details it shares with developers and any feedback or crash reports you choose to send.

Frankfurter (exchange-rate service). Supplies exchange rates to our server, and receives no personal data.

The people on your bills see what Section 3 describes. Brands, venues and other companies, such as market research firms, can receive or buy the anonymous statistics described in Section 13; figures about a venue run by one person or a partnership go to them only with that venue's agreement. We may also publish or share overall figures about Tabsnap, such as the number of accounts or bills.

We hand over data to courts or authorities only when, and as far as, the law requires it.