Tabsnap | The Next Generation of Effortless Bill Splitting

1. Introduction

This Privacy Policy explains how Tabsnap B.V. ("Tabsnap", "we", "us", "our") collects, uses, and protects your personal data when you use the Tabsnap iOS app and the tabsnap.app website, including the split.tabsnap.app and pay.tabsnap.app pages. Tabsnap B.V. is a private limited company (besloten vennootschap) registered in the Netherlands (Berkenweg 11, 3941 JA Doorn, KvK 42128754) and is the Data Controller for the personal data described here.

Tabsnap is a bill-splitting app. You scan a restaurant receipt, split the items between the people at the table, and everyone pays the host through the host's own payment link. Tabsnap does not handle money itself.

If you have questions about this policy, email contact@tabsnap.app.

1. Introduction

This Privacy Policy explains how Tabsnap B.V. ("Tabsnap", "we", "us", "our") collects, uses, and protects your personal data when you use the Tabsnap iOS app and the tabsnap.app website, including the split.tabsnap.app and pay.tabsnap.app pages. Tabsnap B.V. is a private limited company (besloten vennootschap) registered in the Netherlands (Berkenweg 11, 3941 JA Doorn, KvK 42128754) and is the Data Controller for the personal data described here.

Tabsnap is a bill-splitting app. You scan a restaurant receipt, split the items between the people at the table, and everyone pays the host through the host's own payment link. Tabsnap does not handle money itself.

If you have questions about this policy, email contact@tabsnap.app.

2. Data we collect

We collect only the data we need to run the app. We do not sell data. We do not use advertising SDKs. We do not track you for marketing.

Account data

A user ID.
Your phone number. It is your account identifier, because sign-in works with a one-time SMS code.
A display name (up to 40 characters).
An avatar colour, and an avatar photo if you set one. Avatar photos are stored in a publicly readable storage bucket: anyone who has the direct image link can view the photo. Choose your avatar photo with that in mind.
An optional email address, only if you choose to add one in your profile. It is used only so we can reach you about your account. It is never used for sign-in, marketing, or account recovery.
App preferences: language and currency.
Notification settings: the in-app push switch and the automatic payment reminders switch.
Your Tabsnap Pro status (whether Pro is active and until when).
A marketing opt-in flag that defaults to off. We send no marketing today.
Account timestamps (created, last sign-in).

Bill data

Venue name, bill date, currency, totals, tax, tip, and service charge.
The items on the bill, with prices and quantities.
Who ordered what (the split).
The participants you add: a name, an avatar colour, and, when you add them from your contacts, their phone number. A participant entry can also contain an email address.
The payment link you paste as host (for example a Tikkie link). We also derive the link's provider and domain and run an automatic check that flags suspicious links, to protect participants from phishing.
Payment-status markers (requested, paid) with timestamps and who set them. A marker can also be set automatically when someone opens your payment link; the host can always correct it.
Extra payment requests when leftover items are assigned to someone after the bill was first shared.
For collaborative splitting: the split method, the expected number of participants, and a join code that powers the link.
For bills in a foreign currency: the exchange rate to EUR, frozen when the bill is created.
An audit log of changes to the bill (edits, participants added, payments marked), with timestamps. Participants on the bill can read it. Entries are deleted after 12 months.
In-app notifications about your bills (for example "X paid their share"), visible only to you, deleted after 90 days.

Saved groups

If you save a group of people you often split with, we store the group name and each member's name and optional phone number. Only you can see your saved groups.

Receipt images

The photo you take of the receipt, stored as a compressed image (up to 3 MB) in a private storage bucket.
Readable in the app by you and by the participants on that bill.
If you share a split or payment link, people with the link see the receipt photo through a short-lived signed link: about 1 hour on the web pages, up to 7 days inside the app.

Contacts matching

Contacts access is off until you grant the iOS Contacts permission.
On your phone, the app reads names and phone numbers only. No photos, no email addresses, no postal addresses.
To check who already uses Tabsnap, the app sends those phone numbers (in standard international format, as the numbers themselves, not as hashes) to our backend in Europe, in batches of at most 200.
The server compares them against existing accounts and returns the matches. It does not store the numbers you submitted. The only thing it writes is a counter on your account that limits how often the check can run.
The match result is kept in the app's memory for at most 1 hour and is never written to disk.
We never upload or store your address book as a whole.
When you add a matched contact to a bill, their name and phone number are stored on that bill as a participant entry. That is what routes the bill to their own Tabsnap account.

Push notification token

If you allow notifications, iOS gives the app a push token and we store it with your account.
We use it to notify you about your bills: for example when someone pays their share, and for payment reminders on open bills.
The content that passes through Apple's push service is a title, a short text, and the bill reference. Nothing else.
The token is deleted when you delete your account, and automatically when Apple reports that the app is no longer on the device.
You control pushes with the notification switch inside the app and with the standard iOS notification settings. Turning notifications off in iOS always stops delivery.

Product analytics

We use PostHog, hosted in the EU, to understand how the app is used and to improve it.
Analytics is on by default in this version. You can switch it off at any time in the app's Settings under "Anonymous analytics". Opting out stops collection and resets the analytics identity.
Your account is referenced only by a one-way hash of your account ID, never the ID itself, and never your name, phone number, or email.
Events are product actions: app opened, sign-up completed, receipt scanned, bill created, bill shared, bill settled, and similar. Amounts appear only as coarse ranges. Item names and venue names are never sent to analytics.
There is no autocapture, no screen recording, and no session replay.

Crash reporting

We use Sentry, hosted in the German region, to detect and fix crashes and errors.
Reports contain technical context: the error, stack trace, iOS version, and device model, plus anonymous session counts for release health.
Crash reports contain no receipt content and no phone numbers. There is no performance tracing.

Service counters and technical records

Scan records: for each receipt scan we record your account ID, whether it succeeded, how long it took, and an internal cost estimate. No receipt content. These records enforce the free scan limit (5 successful scans per calendar month on the free plan; Pro has no monthly limit) and our abuse limits. We keep them as cost records even after account deletion; once your account is deleted, the ID in them no longer links to any profile.
Link statistics: per share link we count opens and App Store taps per invited person. Deliberately no IP address, no browser details, no name. These rows are deleted together with the bill.
Rate-limit counters per account, kept for about 48 hours, plus overall daily limits across the service.
A daily internal cost digest is emailed to ourselves (via Resend) with aggregate usage per internal account ID. Operations only, never marketing.

What we do not collect, and what we never do

No location data. The app never asks for GPS and stores no place data beyond the venue name on the receipt.
No email address at sign-up. Your phone number is the identifier; the profile email is optional and contact-only.
No storage of your contact list (see Contacts matching above).
No credit card numbers and no stored IBANs. Payment runs through the host's own payment link; Tabsnap does not process money.
No advertising identifiers, no ad SDKs, no third-party marketing trackers.
No selling of personal data, to anyone, for any purpose.
No session replay and no screen recording.
No device fingerprinting and no IP-based linking of web visitors to accounts.
No profiles of your eating or spending habits. We store your bills so the app works. We do not analyse them to build taste, habit, or behaviour profiles.
The only SMS we ever send is the sign-in code you request yourself.
No marketing email today. If we ever introduce it, it will be opt-in and off by default.

2. Data we collect

We collect only the data we need to run the app. We do not sell data. We do not use advertising SDKs. We do not track you for marketing.

Account data

A user ID.
Your phone number. It is your account identifier, because sign-in works with a one-time SMS code.
A display name (up to 40 characters).
An avatar colour, and an avatar photo if you set one. Avatar photos are stored in a publicly readable storage bucket: anyone who has the direct image link can view the photo. Choose your avatar photo with that in mind.
An optional email address, only if you choose to add one in your profile. It is used only so we can reach you about your account. It is never used for sign-in, marketing, or account recovery.
App preferences: language and currency.
Notification settings: the in-app push switch and the automatic payment reminders switch.
Your Tabsnap Pro status (whether Pro is active and until when).
A marketing opt-in flag that defaults to off. We send no marketing today.
Account timestamps (created, last sign-in).

Bill data

Venue name, bill date, currency, totals, tax, tip, and service charge.
The items on the bill, with prices and quantities.
Who ordered what (the split).
The participants you add: a name, an avatar colour, and, when you add them from your contacts, their phone number. A participant entry can also contain an email address.
The payment link you paste as host (for example a Tikkie link). We also derive the link's provider and domain and run an automatic check that flags suspicious links, to protect participants from phishing.
Payment-status markers (requested, paid) with timestamps and who set them. A marker can also be set automatically when someone opens your payment link; the host can always correct it.
Extra payment requests when leftover items are assigned to someone after the bill was first shared.
For collaborative splitting: the split method, the expected number of participants, and a join code that powers the link.
For bills in a foreign currency: the exchange rate to EUR, frozen when the bill is created.
An audit log of changes to the bill (edits, participants added, payments marked), with timestamps. Participants on the bill can read it. Entries are deleted after 12 months.
In-app notifications about your bills (for example "X paid their share"), visible only to you, deleted after 90 days.

Saved groups

If you save a group of people you often split with, we store the group name and each member's name and optional phone number. Only you can see your saved groups.

Receipt images

The photo you take of the receipt, stored as a compressed image (up to 3 MB) in a private storage bucket.
Readable in the app by you and by the participants on that bill.
If you share a split or payment link, people with the link see the receipt photo through a short-lived signed link: about 1 hour on the web pages, up to 7 days inside the app.

Contacts matching

Contacts access is off until you grant the iOS Contacts permission.
On your phone, the app reads names and phone numbers only. No photos, no email addresses, no postal addresses.
To check who already uses Tabsnap, the app sends those phone numbers (in standard international format, as the numbers themselves, not as hashes) to our backend in Europe, in batches of at most 200.
The server compares them against existing accounts and returns the matches. It does not store the numbers you submitted. The only thing it writes is a counter on your account that limits how often the check can run.
The match result is kept in the app's memory for at most 1 hour and is never written to disk.
We never upload or store your address book as a whole.
When you add a matched contact to a bill, their name and phone number are stored on that bill as a participant entry. That is what routes the bill to their own Tabsnap account.

Push notification token

If you allow notifications, iOS gives the app a push token and we store it with your account.
We use it to notify you about your bills: for example when someone pays their share, and for payment reminders on open bills.
The content that passes through Apple's push service is a title, a short text, and the bill reference. Nothing else.
The token is deleted when you delete your account, and automatically when Apple reports that the app is no longer on the device.
You control pushes with the notification switch inside the app and with the standard iOS notification settings. Turning notifications off in iOS always stops delivery.

Product analytics

We use PostHog, hosted in the EU, to understand how the app is used and to improve it.
Analytics is on by default in this version. You can switch it off at any time in the app's Settings under "Anonymous analytics". Opting out stops collection and resets the analytics identity.
Your account is referenced only by a one-way hash of your account ID, never the ID itself, and never your name, phone number, or email.
Events are product actions: app opened, sign-up completed, receipt scanned, bill created, bill shared, bill settled, and similar. Amounts appear only as coarse ranges. Item names and venue names are never sent to analytics.
There is no autocapture, no screen recording, and no session replay.

Crash reporting

We use Sentry, hosted in the German region, to detect and fix crashes and errors.
Reports contain technical context: the error, stack trace, iOS version, and device model, plus anonymous session counts for release health.
Crash reports contain no receipt content and no phone numbers. There is no performance tracing.

Service counters and technical records

Scan records: for each receipt scan we record your account ID, whether it succeeded, how long it took, and an internal cost estimate. No receipt content. These records enforce the free scan limit (5 successful scans per calendar month on the free plan; Pro has no monthly limit) and our abuse limits. We keep them as cost records even after account deletion; once your account is deleted, the ID in them no longer links to any profile.
Link statistics: per share link we count opens and App Store taps per invited person. Deliberately no IP address, no browser details, no name. These rows are deleted together with the bill.
Rate-limit counters per account, kept for about 48 hours, plus overall daily limits across the service.
A daily internal cost digest is emailed to ourselves (via Resend) with aggregate usage per internal account ID. Operations only, never marketing.

What we do not collect, and what we never do

No location data. The app never asks for GPS and stores no place data beyond the venue name on the receipt.
No email address at sign-up. Your phone number is the identifier; the profile email is optional and contact-only.
No storage of your contact list (see Contacts matching above).
No credit card numbers and no stored IBANs. Payment runs through the host's own payment link; Tabsnap does not process money.
No advertising identifiers, no ad SDKs, no third-party marketing trackers.
No selling of personal data, to anyone, for any purpose.
No session replay and no screen recording.
No device fingerprinting and no IP-based linking of web visitors to accounts.
No profiles of your eating or spending habits. We store your bills so the app works. We do not analyse them to build taste, habit, or behaviour profiles.
The only SMS we ever send is the sign-in code you request yourself.
No marketing email today. If we ever introduce it, it will be opt-in and off by default.

3. Who can see what

Only you: your saved groups, your in-app notifications, your settings, your usage counters, your push token.

Participants on your bill who use the app: the bill, its items, the split, the amounts, the receipt photo, the other participants' names and avatar colours, and the bill's audit log.
Anyone who has a share or join link: a bill summary, the host's display name, the items with their claim status, and the receipt photo through a link that works for about 1 hour. Web visitors do not see other guests' names; every other claimer is shown anonymised. Links expire automatically (currently after 14 days). Anyone holding the link can open it, so share it only with the people at the table.

Who can see your phone number

Tabsnap never displays your phone number, or any other participant's phone number, on any screen. A host who added you from their own contacts keeps the number they themselves supplied. Contact matching answers only whether a number already uses Tabsnap; it does not reveal numbers to anyone. Phone numbers are never included in what web visitors receive.

Our backend currently allows the app of another participant on your bill to request records that include a phone number: the participant entry the host created, and your profile record including your optional email. The app never shows this data. We are rolling out a backend change that removes this access entirely, so that other participants can technically retrieve only your display name and avatar, and participant phone numbers become readable by the host alone. Until that change is fully applied we do not claim that this data is technically inaccessible, only that it is never displayed or used.

3. Who can see what

Only you: your saved groups, your in-app notifications, your settings, your usage counters, your push token.

Participants on your bill who use the app: the bill, its items, the split, the amounts, the receipt photo, the other participants' names and avatar colours, and the bill's audit log.
Anyone who has a share or join link: a bill summary, the host's display name, the items with their claim status, and the receipt photo through a link that works for about 1 hour. Web visitors do not see other guests' names; every other claimer is shown anonymised. Links expire automatically (currently after 14 days). Anyone holding the link can open it, so share it only with the people at the table.

Who can see your phone number

Tabsnap never displays your phone number, or any other participant's phone number, on any screen. A host who added you from their own contacts keeps the number they themselves supplied. Contact matching answers only whether a number already uses Tabsnap; it does not reveal numbers to anyone. Phone numbers are never included in what web visitors receive.

Our backend currently allows the app of another participant on your bill to request records that include a phone number: the participant entry the host created, and your profile record including your optional email. The app never shows this data. We are rolling out a backend change that removes this access entirely, so that other participants can technically retrieve only your display name and avatar, and participant phone numbers become readable by the host alone. Until that change is fully applied we do not claim that this data is technically inaccessible, only that it is never displayed or used.

4. When someone sends you a Tabsnap link (web guests, no account)

You can open a Tabsnap split or payment link in your browser without creating an account.

What we receive from you: the items you claim, an optional display name (up to 80 characters), a random token your browser generates so you can return to your own claim, a paid marker if you mark your share as paid (including how you paid: via the payment link or directly), and a tap on the App Store banner if you use it.

What your browser stores: local storage only. Your random claim token, your last-used name, and a device-local record of any extra charges assigned to you, so a returning visitor still sees what they owe. No cookies. No analytics. No trackers of any kind on these pages.

What you can see: the bill, the host's display name, the items and their claim status (other claimers anonymised), your own share and items, and the receipt photo through a link that works for about 1 hour. The payment page shows only your own share. It never shows other participants' names or amounts.

Server-side: the split page records when your join link was first and last opened; the payment page records only when it was first opened. If you tap the host's payment link, your share can be marked as paid automatically; the host can always correct it. If the host later assigns leftover items to you, an extra payment request is created for exactly those items, and the page shows you that amount before you pay.

What we never do with web guests: no IP logging to identify you, no fingerprinting, no linking of your guest activity to any Tabsnap account behind your back. If you later create an account, your guest claims are not attached to it automatically.

Legal basis and retention: our legitimate interest (Art. 6(1)(f) GDPR) in letting invited people split a bill without an account. Your claim data lives as long as the host keeps the bill and is permanently deleted at most about 30 days after the host deletes it. Expired payment links are deleted 90 days after they expire. None of it is used for marketing or advertising.

The controller is Tabsnap B.V. The pages are served from Vercel's hosting infrastructure (see Sections 6 and 11). Questions: contact@tabsnap.app.