Privacy Policy for Tab
Last updated: 17 August 2026
Tab ("we," "us," "our") is a bill-splitting service available as a Telegram bot, a Telegram Mini App, and native iOS and Android apps. This policy explains what we collect, why, and what you can do about it.
The entity responsible for this data is Tab, based in Switzerland. Contact us about privacy at privacy@tabup.app.
What we collect
Account information
- Email address and a hashed password, if you sign up with email/password. We never store your password itself, only a salted hash (Argon2id).
- Your Telegram user ID, username, and display name, if you use Tab through Telegram or sign in with Telegram.
- A display name, for anyone using the apps.
Expense and group data
- Group and trip names, invite codes, and who's a member of what.
- Expenses: amount, currency, description, category, who paid, and who's splitting it.
- Settlement records ("I paid you back").
None of this is payment data in the financial sense - Tab tracks who owes whom, it does not move money or store payment card/bank details.
Content you send for AI parsing
- If you describe an expense in text, send a photo of a receipt, or leave a voice note, that content is sent to Google's Gemini API to extract the expense details (payer, amount, description, etc.).
- We do not store the photo or the audio recording itself. Only the structured result Gemini returns (amount, description, and so on) is saved to our database.
- Google processes this content under its own API terms; see Google's privacy policy for how Gemini handles API input.
Technical information
- A session token (for the native apps), stored securely on your device (iOS Keychain / Android EncryptedSharedPreferences) so you stay signed in.
- Standard server logs (timestamps, error traces) for keeping the service running - we don't run analytics or ad tracking.
How we use it
- To operate the core product: logging expenses, computing balances, keeping your groups in sync across Telegram and the apps.
- To authenticate you (email/password, or "Sign in with Telegram").
- To parse free-form text, photos, and voice notes into structured expenses via Google's Gemini API.
- We do not sell your data, and we do not use it for advertising.
Who we share it with
- Google (Gemini API): expense-related text, photos, and voice notes you submit for parsing.
- Telegram: if you use the Telegram bot or Mini App, your messages and profile information pass through Telegram's platform per Telegram's own privacy policy - that's inherent to how Telegram bots work, not something we control.
- We don't share your data with any other third party, and we don't sell it.
Data retention and deletion
We keep your account and expense data for as long as your account is active. To request deletion of your account and associated data, contact us at privacy@tabup.app. [Note: describe here whether deletion is immediate, how long it takes, and whether any data must be retained for legal/accounting reasons.]
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact us at privacy@tabup.app. [If you have users in the EU/UK, this section needs to name the specific legal bases you rely on under GDPR/UK GDPR - see the note below.]
Children's privacy
Tab is not intended for children under 16. We do not knowingly collect data from children under that age.
Changes to this policy
We'll update the "Last updated" date above if this policy changes, and post the new version here.
Contact
Questions about this policy or your data: privacy@tabup.app