Privacy Policy

Last updated: 29 September 2026

On-device first

TabTell stores your ledger in SQLite on this device. Opening the app does not create a TabTell account. A random device id is generated locally so anonymous AI quotas and event invites can work. Android is coming later; this release is iOS-first.

What we collect and how

• On-device ledger data (transactions, events, reminders, chat history, settings, optional place names) — created and stored on your device when you use the app. We do not receive this by default.
• Device id — generated locally and sent with API requests so we can enforce monthly AI quotas and bind App Store purchases / encrypted snapshots to this install.
• Precise location — only when you choose to pin a place on a spend, event, or reminder. Coordinates stay on device unless you publish a shared event invite that includes that place, or you use reverse geocoding (below).
• AI request content — only after you grant in-app permission: primarily the text you type or speak for that request; receipt images only if you choose to scan; and limited ledger context needed for that request (for example recent lines, event names, categories, display name, currency, and language). AI requests do not include your email, App Store account, password, or login credentials — TabTell has no user account for AI.
• Shared event payloads — if you publish an event invite, that event’s members, transactions, attachments, and any place you attached sync to our cloud database (Cloudflare D1) so joiners can see them.
• Encrypted snapshots / archives (Pro) — ciphertext only; we cannot read your personal ledger.
• Optional feedback — message text and optional email you provide when contacting support.
• Purchase identifiers — App Store transaction / entitlement ids used for TabTell Pro and Restore Purchases.

Location helpers (optional)

If you tap “use current location,” TabTell reads your position on-device (When In Use) and may call BigDataCloud or OpenStreetMap Nominatim solely to suggest a place name label. Map previews may load tiles from Esri. These services receive the coordinates you just pinned for that lookup — not your full ledger. You can skip pinning or type a place name instead.

Third-party AI (OpenRouter)

When you use AI capture, query, or receipt scan and you have allowed AI data sharing in the app, TabTell’s servers (Cloudflare Worker at api.tabtell.com) forward that request content to OpenRouter (openrouter.ai), which routes it to the language-model provider configured for TabTell. OpenRouter and that model provider process the content solely to generate a reply for the feature you requested (parse spends, answer ledger questions, OCR receipts). We do not sell this data or use it for advertising or tracking.

Before the first AI request, the app shows a disclosure that names what is sent, who receives it, and asks for your permission. You can revoke permission anytime in Settings → Display → AI data sharing. Turning it off stops further AI requests until you allow again. On-device logging and browsing still work without AI.

OpenRouter’s processing is subject to OpenRouter’s own privacy terms. We require that third parties we use for AI provide protections consistent with this policy for the data we send them for app functionality.

How we use data

• Provide AI chat, voice logging assistance, and receipt OCR.
• Enforce free / Pro monthly AI quotas.
• Optional place labels and map previews you choose to attach.
• Sync shared events you choose to publish and restore Pro encrypted backups you upload.
• Process App Store subscriptions and Restore Purchases.
• Respond to optional feedback you send.

Payments

The App Store processes TabTell Pro purchases (auto-renewable subscription: monthly and yearly). Payment is charged to your Apple ID; subscriptions renew automatically unless cancelled at least 24 hours before the period ends. Manage or cancel in Apple ID → Subscriptions. We store store identifiers and a bound device id for Restore Purchases. We do not use a TabTell password. Android / Google Play billing is not available in this release.

Your choices

Export JSON anytime. Skip backup and a new phone cannot restore personal data. Revoke AI data sharing in Settings. Decline location when prompted, or clear a pinned place. Contact [email protected] for deletion of cloud snapshots or shared events you created.