Privacy Policy

1. The short version

Tabber is a bill-splitting app for iPhone, built and published by Kyle Thornton (“I”, “me”). It has no server, no account system, and makes no network requests in the course of doing its job.

Your receipt photos, the text read off them, the names of the people at your table, what everyone ordered, and every total Tabber works out are created on your iPhone, stored on your iPhone, and never transmitted anywhere. I have no ability to see any of it — not because I promise not to look, but because there is nowhere for it to go.

2. What Tabber collects

Nothing. Tabber collects no personal data, no usage data, no diagnostics, no identifiers, and no contact information. The app's App Store privacy manifest declares no collected data types and no tracking, and its “App Privacy” label on the App Store reads Data Not Collected.

Specifically, Tabber does not:

• Require or offer an account, sign-in, email address, or password
• Upload receipt images or any text read from them
• Transmit the names, initials, or colours of people you add
• Record, store, or transmit audio from your microphone
• Collect analytics, usage statistics, crash reports, or telemetry of its own
• Use advertising identifiers, cookies, fingerprinting, or any tracking technology
• Access your contacts, location, calendar, health data, or photo library beyond a single image you deliberately choose

3. What is stored on your iPhone

Tabber does keep data — locally, in the app's own private storage area, which other apps cannot read. This is what makes your saved tabs work. It stays on the device, and it is removed completely when you delete the app.

• Saved tabs — the restaurant name, date, line items, amounts, and who owed what
• Remembered people — the names, initials, and avatar colours of people you've split bills with, plus an optional Venmo username if you enter one
• Receipt photos — a downscaled copy of each receipt image, kept according to the retention setting you choose (see section 10)
• Your preferences — your own first name, default tip percentage, whether tip is calculated pre- or post-tax, entry mode, and photo retention rule, stored in the app's own settings

Saved tabs are stored as snapshots: names and amounts are copied in at the time you finish a split, so editing or deleting a person later never rewrites a tab you already settled.

4. Permissions Tabber asks for

iOS will ask your permission before Tabber can use any of the following. Each is used for one narrow purpose, and you can decline or revoke any of them in Settings → Privacy & Security (or Settings → Tabber) on your iPhone. Declining a permission limits the corresponding feature; it never locks you out of the app.

Camera

Used to photograph a receipt. The image is processed on the device and is never uploaded. If you decline, you can pick a photo from your library instead, or type the bill in by hand.

Microphone and Speech Recognition

Used only while you are actively dictating who had what, so that speech can be turned into text. Recognition is configured to run on the device only; audio is not sent to Apple's servers or anywhere else, and no recording is saved. The microphone is open only while you are dictating. If you decline, you can type the same sentence instead.

Photo library

Only if you choose to pick an existing receipt photo. Tabber receives the single image you select; it does not browse, index, or read the rest of your library.

5. On-device intelligence

Tabber's receipt reading and its plain-English assignment step use Apple's Vision framework and Apple's Foundation Models — the on-device generative models built into iOS 26 on Apple Intelligence–capable hardware.

These models run locally on your iPhone. Tabber does not use ChatGPT, Private Cloud Compute, or any cloud model, and it does not send your receipt or your description to any external service, including Apple's. Nothing you type or say is used to train any model.

On iPhones that cannot run these models, Tabber falls back to a fully manual entry mode with identical split arithmetic — and identical privacy characteristics.

6. When you share a tab

Tabber can hand a summary of a split to the standard iOS share sheet, so you can send it in Messages, Mail, or any other app you choose. At that point the information goes wherever you send it, and the privacy policy of the app or service you picked applies to it. Tabber itself is not involved in the transmission and keeps no record of it.

This is the only way information leaves Tabber, and it only ever happens because you deliberately asked for it.

7. Device backups

If you back up your iPhone — to iCloud or to a computer — that backup may include Tabber's local data, in the same way it includes data from your other apps. Those backups are made and encrypted by Apple, are governed by Apple's Privacy Policy, and I have no access to them. Tabber does not use iCloud sync, CloudKit, or any shared database of its own.

8. What Apple sees

Downloading Tabber is a transaction between you and Apple, and Apple's own privacy practices apply to it.

If you have chosen to share analytics with developers in your iOS settings, Apple may make aggregated, anonymised statistics available to me through App Store Connect — figures like total downloads, territory-level counts, and crash reports. This information comes from Apple, is not tied to your identity, and is not gathered by anything in the app itself. You can turn it off in Settings → Privacy & Security → Analytics & Improvements.

9. Third parties and tracking

Tabber contains no third-party SDKs, no advertising libraries, and no analytics packages. It links only against Apple's own system frameworks. There are no trackers to disclose under Apple's App Tracking Transparency framework, and Tabber will never present a tracking permission prompt because it has nothing to track you with.

No data is sold or shared with anyone, for any purpose, ever. There is no category of business partner, advertiser, data broker, or affiliate that receives anything from this app.

10. Deleting your data

Because everything lives on your device, you control all of it directly and do not need to ask me for anything.

• Choose how long photos are kept. In Settings, receipt photos can be kept always, deleted 30 days after the meal, or never stored at all — in which case the receipt is read and discarded immediately.
• Delete all receipt photos. One confirmed tap removes every stored photo while leaving your tabs, their itemisations, and remembered people intact. Settings also shows exactly how much space the photos are using.
• Delete a single tab. Swipe it away on the home screen and confirm.
• Reset everything. “Reset account” in Settings erases every saved tab, every remembered person, and every preference, then returns the app to its first-run state.
• Delete the app. Removing Tabber from your iPhone removes all of its data with it. Nothing is left behind on any server, because none was ever sent to one.

11. Children

Tabber is a general-audience utility and is not directed at children. It does not knowingly collect personal information from anyone, including children under 13 (or the equivalent minimum age in your country), because it does not collect personal information at all.

12. Your rights

Privacy laws including the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA) give you rights over personal data that a company holds about you — to access it, correct it, delete it, port it, and to opt out of its sale.

I hold no personal data about you, so there is nothing for me to disclose, correct, export, or erase, and nothing has ever been sold or shared. The data described in section 3 is on your own device, under your own control, and can be removed at any time using the steps in section 10. No data is transferred internationally because no data is transferred at all.

If you would like written confirmation of any of this, or you believe something here is inaccurate, please get in touch — see section 14.

13. Changes to this policy

If Tabber ever gains a feature that changes any of the above, this policy will be updated before that feature ships, and the effective date at the top of the page will change with it. Material changes will also be noted in the App Store release notes for the version that introduces them.

Two features are on the roadmap that would involve other apps: sending a payment request through Venmo, and requesting money through Apple Cash in Messages. Both would work by handing a prefilled request to that app on your device — the same way the share sheet does today — rather than by Tabber contacting any service itself. Neither is implemented in version 1.0.

14. Contact

Questions about this policy, or about privacy in Tabber generally, are welcome.