tabbal

Privacy policy

Last updated 7 October 2026.

Who we are

tabbal is provided by Untold Collective Ltd, a company registered in England and Wales, company number 14767932. We are the data controller for the information described here. Kieren Windsor is responsible for data protection; you can reach him at privacy@trytabbal.app.

What we collect, and why

• Account: your email address, display name, avatar (an emoji or a photo you choose), preferred currency, language and time zone. Needed to give you an account and to show you to the people you share with. Basis: performance of our contract with you.
• Split Bills: the groups you belong to, their members and guests, expenses, who paid and who owes, settlements, and any payment handles (PayPal, Wise, etc.) you add so friends can pay you. Basis: performance of our contract with you.
• Track Expenses: households, pots, personal expenses and recurring entries you create. Basis: performance of our contract with you.
• Receipts: photos you choose to scan, the text read from them, and the date and location held inside the photo. See Location in receipt photos below. Basis: performance of our contract with you.
• Devices: for each device you sign in on, whether it is iOS or Android and a push-notification token, so you can be told when something involving you changes. Only stored once you allow notifications. Basis: performance of our contract with you.
• Place searches: when you type into a location field, what you type — and, if a nearby point is known, its coordinates — is sent to Google Places to fetch suggestions. Basis: performance of our contract with you.
• Scan credits and purchases: a record of credits bought, granted and used. We receive confirmation of a purchase from Apple or Google; we never see your card details. Basis: performance of our contract, and our legal obligation to keep transaction records.
• Security and reliability: counts of failed scans and other rate-limit records. Basis: our legitimate interest in keeping the service working and preventing abuse.

We do not use analytics or advertising software, we do not track you across other apps or websites, and we do not sell or share your information for marketing.

Location in receipt photos

tabbal never asks for permission to use your device's location, and never reads it. It does not know where you are.

What it does read is the location that your phone's camera may already have written inside a receipt photo, when you choose that photo for a scan. Reading it happens on your device. The coordinates are then sent to our server with the scan and stored alongside that receipt, where they are used for one thing: suggesting which trip or pot the receipt belongs to, so you do not have to pick from a long list. They are never used to build a picture of your movements, and they are deleted when the receipt is deleted.

If you would rather we never saw this, turn off location for your camera app in your phone's settings, or take receipt photos with location switched off. Everything else in tabbal works exactly the same; you will just pick the trip yourself.

Who else processes it

• Supabase hosts the database, file storage and sign-in.
• OpenAI receives receipt photos you choose to scan, and the date and location from them, in order to read the items and totals. Under the API terms these are not used to train their models.
• Apple and Google confirm your identity to us if you choose to sign in with them (Apple can hide your real address behind a private relay address, and we work with whichever address we are given), deliver notifications to your device, and handle in-app purchases of scan credits under their own terms. Google also provides location suggestions (Google Places) when you type into a location field.
• Expo passes push notifications on to Apple and Google for delivery.
• Resend sends account and reminder emails.

Where it is held

Your account, your expenses and your receipts are stored on servers in Ireland, hosted by Supabase. Transfers from the UK to Ireland are covered by the UK's adequacy regulations for the European Economic Area, which treat it as offering equivalent protection.

Some of the other companies listed above operate outside the UK and the EEA, including in the United States — OpenAI when it reads a receipt, and Expo when it relays a notification. Those transfers rely on the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, or on the UK extension to the EU–US Data Privacy Framework where the company is certified under it.

Who can see what

People in the same group see the expenses, settlements and balances of that group, your display name and avatar, and — only while you owe them money in that group — the payment handles you have added. Nobody outside a group can see it. Households work the same way.

One thing worth knowing: avatar images are served from a public web address, so an avatar photo is not secret to someone who has its link. Everything else — receipts, group photos, exports — is private and reachable only through a short-lived link issued to someone entitled to see it. If you would rather not have a photograph of yourself served this way, choose an emoji avatar instead.

How long we keep it

• Your account and the things you created: until you delete your account.
• Shared records: expenses, settlements and receipts in a group stay while that group exists, because they are the group's shared history and other members rely on them.
• Abandoned scans: photos uploaded for a scan you never completed are removed automatically after 24 hours, as are files nothing refers to any more.
• Data exports: the file we generate for you is held briefly and then deleted; the link we give you expires within the hour.
• Purchase records: kept as long as tax law requires, which is longer than your account.

Exporting and deleting your data

You can export everything as a file, and delete your account, from inside the app (Profile → Delete account). Deletion removes your profile, your devices, your personal tracking data and your avatar, and invalidates your sign-in immediately.

Two things deliberately survive it, because other people depend on them. Shared expenses you took part in stay in the group's ledger under “Deleted user”, so the other members' balances stay correct. Receipts you scanned and shared into a group stay with that group as the evidence behind its expenses. Nothing that remains identifies you by name or email.

Your rights

You have the right to ask us for a copy of your information, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form. The export and delete buttons in the app are the fastest route for the last three; for anything else write to privacy@trytabbal.app and we will reply within one month.

Where we rely on legitimate interests, you can object and we will stop unless we have a compelling reason not to. If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, though we would rather you told us first.

Children

tabbal is not for children. You must be at least 16 to have an account, and we do not knowingly collect information about anyone younger. If you believe a child has an account, tell us and we will remove it.

Changes

If we change how we use your information we will update this page and, where the change is significant, tell you in the app before it takes effect.

Contact

Untold Collective Ltd, registered in England and Wales, company number 14767932. Questions about privacy: privacy@trytabbal.app.