Privacy Policy

Last updated 14 November 2026

Tabsie is an iPhone app for splitting bills with friends and settling up by PayNow. This policy explains what we collect, why, who we share it with, how long we keep it, and what you can ask us to do. It covers the Tabsie app and the website at tabsie.app.

Tabsie is operated by Wai Chong Lee in Singapore ("Tabsie", "we", "us"). We are the organisation responsible for your personal data under Singapore's Personal Data Protection Act 2012 (PDPA). Our Data Protection Officer can be reached at privacy@tabsie.app.

The short version

We never see your bank account, your cards or your money. Tabsie records who owes whom. Payments happen in your bank app.
We collect what we need to run your account and groups: your sign-in identity, the name you choose, and the bills you record.
Your PayNow number is optional. Friends in your groups see it only inside the QR code when they pay you.
AI features (receipt reading, describing a bill, voice entry, split suggestions) send your photo, voice clip or text to our AI service provider. You choose when to use them.
No ads, no tracking, no analytics, no selling of data.
You can delete your account in the app. Shared group records stay, with your name replaced by "Deleted member".
Questions and requests: privacy@tabsie.app.

1. What we collect

Your account

Sign-in identity. You sign in with Apple, Google, Facebook or Microsoft. We keep the provider's name and the stable account identifier it gives us for you, so we can recognise you next time. We never receive or store a password.
Contact email. If your sign-in provider tells us your email address is verified, we keep it as a contact address for your account. We don't use it to find or link accounts, and other users never see it.
Name and Tabsie ID. At sign-up you choose a display name and a Tabsie ID. Apple may pass your name to the app once to pre-fill the box; what we store is what you type.
Profile photo. Optional. We remove location and camera metadata before storing it. Only you can see it.
Sessions. A sign-in token for your device, kept in your iPhone's secure storage and, on our side, only as a one-way hash.

PayNow details

PayNow mobile number. Optional. It must be a Singapore mobile number; we don't accept NRIC or FIN numbers. We store it with the version and time of the consent wording you agreed to. We use it only to build the PayNow QR code that someone in your group scans when they pay you. You can change or remove it in Profile at any time.
Phone verification. Optional. If you choose to verify the number, we send a one-time code by SMS or WhatsApp through a messaging provider. We keep a record that the number was verified and when. Attempt records are deleted within about two days.

Groups, bills and payments

Groups. Name, description, optional group photo, who is in it and their roles.
Bills. Description, items, amounts, dates, who paid, who shares, and any notes or reasons you add when accepting or rejecting a share.
Payments. Who recorded a payment to whom, the amount, and whether the receiver confirmed it, said it didn't arrive, or said less arrived.
Friends. Friend requests and friendships between accounts.
Reminders. Who nudged whom and when.
People without an account. If you add someone to a group who isn't on Tabsie yet, we store the name you type as a label for them. If you import balances from a Splitwise export, we store the names and net balances in that file, not the individual expenses.
Free text. You can type anything into a bill description or note. We refuse text that looks like a phone, ID or card number. Please don't put other people's personal details in notes.

Receipts and AI inputs

Receipt photos, for reading. When you scan a receipt, the app crops and compresses the photo on your phone and removes camera metadata. When receipt reading is on, the photo is sent through our server to our AI service provider to read the items and amounts. If that read isn't available, your phone reads the receipt on-device instead.
Saved receipts. When you add a bill from a scanned receipt, we store the image and the text read from it with the bill so people on the bill can open it later. We strip metadata before storing it.
Describing a bill, voice entry and split suggestions. If you describe a bill in words, dictate it, or ask for a split suggestion, that text or audio is sent to our AI service provider, together with the total and the display names of the people in the split where the feature needs them. We don't keep the audio or text for this step. On newer iPhones, dictation may be handled on your phone instead.

Technical data

Connection details. Our server uses your internet address (IP) in memory to limit abuse, for example too many sign-in attempts. We don't write it to our database. Our hosting provider may record connection details in its own platform logs.
Server logs. Our logs record the kind of request, when it happened and whether it worked. They don't include your name, IP address, token or the contents of what you sent.
Exchange rates. If you enter a bill in another currency, the app asks a public exchange-rate service for that day's rate, directly from your phone. The request carries the currency codes and the date. Like any website, that service sees your phone's internet address.

What we don't collect

No bank logins. No card numbers. No money. No contacts list, no location and no advertising identifier. No analytics or crash-reporting kit in the app. No cookies or trackers on tabsie.app; the site loads its font from Google Fonts. We don't track you across other apps or websites.

On your phone

The app keeps your sign-in token in the iPhone Keychain, plus unsent changes, bill drafts, recently used people and currencies, and display settings. These are cleared when you sign out or delete your account, or when you remove the app. If you save a PayNow QR image to Photos, that image is yours and Tabsie can't delete it for you.

2. Why we use it

To run the service: accounts, groups, bills, balances, payment records, QR codes, friend requests and reminders.
To read receipts and draft bills when you ask.
To send you one-time codes when you ask to verify your number, and service messages about your account.
To keep Tabsie safe: rate limits, abuse prevention and stopping repeated requests.
To answer your support and privacy requests.
To meet legal duties, for example a request we are required by law to comply with.

We don't use your data for advertising, profiling or sale, and we don't send marketing messages. If we ever want to use your data for a new purpose, we'll tell you first and ask for consent where the law requires it.

Under the PDPA we rely on your consent (given when you sign up and when you turn on each feature), on deemed consent for what is plainly needed to deliver what you asked for, and on the legitimate-interests exception for security and abuse prevention. You can ask about this at privacy@tabsie.app.

3. AI features

Receipt reading, describing a bill, voice entry and split suggestions use an AI service provider (OpenAI). What is sent is only what the feature needs: the receipt image, your text or audio, the total, and the display names of the people in the split where the feature needs them. We don't send your group history, your email or your PayNow number.

Our provider processes the request and returns the result. Under the provider's business terms, your content is not used to train its models. The provider may hold it for a short period for safety and abuse monitoring under its own policy. We don't keep the image, audio or text for this step ourselves.

AI output can be wrong. Amounts, items, dates and names may be misread. Check what the app fills in before you save, and before anyone pays.

You can skip these features entirely and type bills in by hand. Using a feature is your choice each time. Don't upload receipts or text that contain other people's details you have no right to share.

4. What other people can see

Your name and Tabsie ID. People in a group with you, your friends, and anyone who looks you up by your Tabsie ID or your exact public ID. Searching by name is limited to friends and people who share a group with you.
Bills, shares, amounts, notes and payment records. Everyone in that group. A removed member keeps only the history from before they were removed.
Your PayNow number. Not shown on your profile. It's inside the PayNow QR, with your name and the amount, shown only to a current member of your group when the app works out that they owe you. That person could save or share the QR image. Removing your number later stops new QR codes but can't recall copies.
Saved receipts. Current group members and anyone with a share in that bill, even after they leave the group.
Group photo. Current members of the group.
Profile photo and email. Only you.
Friend requests. The person you sent it to sees your name.

A group's invite link lets people join that group, and a signed-in person who has the link can claim a "Deleted member" or placeholder seat in it. Share invite links only with people you want in the group.

We don't sell your data. We share it only with providers that work for us, under contracts that require them to protect it, and only as much as each needs:

Hosting (Railway). Runs our server and database, stores saved receipts and photos, and keeps server logs.
AI (OpenAI). Receives receipt images, text, voice clips and split instructions when you use an AI feature.
Messaging (Twilio for SMS, Meta for WhatsApp). Receive your mobile number and a one-time code when you ask to verify it.
Sign-in (Apple, Google, Facebook, Microsoft). You sign in directly with the provider on your phone, and it tells us who you are. Our server fetches only the provider's public keys to check that. We request the minimum sign-in scope.
Notifications (Apple). If you turn on notifications, your device token and the notification text go to Apple's push service for delivery.
Exchange rates. A public rate service, called from your phone as described above.

We may also disclose data to our professional advisers, to a successor if Tabsie is sold or transferred (we'd tell you), and to authorities or courts where the law requires it.

Google and Microsoft sign-in. We use the information from Google or Microsoft only to sign you in and identify your account. We never use it for ads and never sell it. Tabsie's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

6. Where your data is kept

Our server and database are hosted by our cloud provider. Depending on its regions and on the other providers listed above, your data may be stored or processed outside Singapore, including in the United States. When data leaves Singapore we rely on contracts with the recipient that require a standard of protection comparable to the PDPA.

7. How long we keep it

Your account and profile (name, Tabsie ID, email, PayNow number, consent record, photo): until you delete your account.
Bills, payments and group history: shared records. They're kept for as long as the group exists so other members' records stay complete. After you delete your account your entries stay, with your name replaced by "Deleted member".
Saved receipts: until the bill is voided or the person who added it removes it. Archiving a group keeps its receipts.
Reminder records, request replay records and ended sign-in sessions: about 30 days.
Phone verification attempts: about two days. The record that your number was verified: until you delete your account.
Your Tabsie ID: held for 30 days after deletion so nobody can take it to impersonate you, then released.
AI inputs: not stored by us. See section 3 for the provider's handling.
Server logs: a limited period set by our hosting provider.
Backups: roll off on a fixed cycle. A backup taken before you deleted your account may hold your profile until that cycle completes.

8. Deleting your account

In the app: Profile → Delete my account. Deletion takes effect when you confirm.

What is erased: your profile (name, contact email, PayNow number and consent record), your profile photo, group photos you uploaded, your sign-in links and sessions, invites you sent, friend links and any push tokens. Your Tabsie ID is released after 30 days.

What stays: bills, payments and group history you shared with others, shown as "Deleted member" with the amounts unchanged. Receipts saved with your bills stay with those bills; remove them first if you don't want that. Names you typed for people without an account stay, because they describe someone else. Text other members typed is theirs and isn't edited. Backups roll off on a fixed cycle. If you still owe or are owed money in a group, the app tells you before you confirm.

You can also revoke Tabsie's access in your Apple, Google, Facebook or Microsoft account settings. If you can't get into the app, email privacy@tabsie.app from the address on your account and we'll verify you and delete it.

9. Your rights

Under the PDPA you can:

Access. Ask for the personal data we hold about you and how we've used or disclosed it in the past year. We reply within 30 days, or tell you within 30 days when we will. We may charge a reasonable fee for large requests and will tell you first.
Correct. Change your name, Tabsie ID, photo and PayNow number in Profile. For anything else, write to us. We can't edit shared bill entries, because they're the other members' records too, but you can add a correcting entry in the group.
Withdraw consent. Remove your PayNow number, stop using AI features, turn off notifications, or delete your account. Withdrawing consent may mean a feature stops working, and we'll tell you if so. We act on written withdrawal requests within 10 business days where we can.
Get a copy of your data. Email privacy@tabsie.app and we'll send you a copy of your account, groups, bills and payment records.
Complain. Write to privacy@tabsie.app first. If you're not satisfied, you can complain to the Personal Data Protection Commission at pdpc.gov.sg.

To protect you, we check that requests come from the account holder, usually by asking you to write from the email on your account or to confirm from inside the app.

10. Security

Data travels between the app, our server and our database over encrypted connections. We don't store passwords. Sessions are stored only as one-way hashes. Every request is checked against your session, and group data is returned only to its members. Uploaded images are re-encoded and stripped of metadata. Access to our production systems is limited to the people who run Tabsie, and rate limits slow down abuse.

No service is perfectly secure. If a breach of your data is likely to cause you significant harm, we will notify the Personal Data Protection Commission and you as the PDPA requires.

11. Children

Tabsie is for people aged 13 and over. If you're under 18, you need a parent or guardian's permission to use it. We don't knowingly collect data from children under 13. If you think we have, email privacy@tabsie.app and we'll delete it.

12. Notifications and messages

One-time codes are service messages sent only when you ask for them. Carrier charges may apply. If you turn on notifications, you can turn them off in iOS Settings at any time. We don't send marketing.

13. Changes to this policy

We'll post changes here with a new "Last updated" date. If a change affects how we use your data in a way you wouldn't expect, we'll tell you in the app before it takes effect and ask for consent where the law requires.

14. Contact

Data Protection Officer and privacy requests: privacy@tabsie.app
Help with the app: support@tabsie.app
Tabsie, Wai Chong Lee, Singapore