Tabwell Privacy Policy

Last updated: October 8, 2026

Tabwell is an app for recording and splitting shared expenses. 1001762518 Ontario Ltd., operating as Tabwell ("we", "us"), operates it. This policy tells you what personal information we collect, why we collect it, who receives it, how long we keep it, and what you can do about it.

We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). If you live in Quebec, we also follow Quebec's Act respecting the protection of personal information in the private sector.

1. Who is responsible for your information

Tabwell is responsible for the personal information described here. Our person in charge of the protection of personal information is the President. You can contact the President at admin@tabwell.ca.

2. Information we collect

Your account

• Your name and email address.
• Your password. We store only a hashed form of it, never the password itself.
• If you sign in with Google or Apple: an account identifier from that provider, and the name and email address it gives us. We do not receive your Google or Apple password.
• Your settings: default currency, app language and notification choices.
• A profile picture, if you add one.
• A friend code, which other people can use to add you as a contact.

What you record in the app

• Expenses, groups, splits, balances and settlements, with the descriptions and notes you enter.
• A history of changes to each expense: who changed it, when, and what changed.
• The contacts you add, by email address or friend code.
• Receipt photos and PDF files that you choose to add.

People who do not have an account

You can add a person to Tabwell by their email address before they have an account. We then keep their email address, and a name that we make from that address. We use them to show shared expenses and to send that person emails about expenses that include them. The person can create an account with that address and take over this record, or ask us to delete it (section 8).

Technical information

• Server logs. When your device calls our servers, we log your IP address, the type of device and browser, your account identifier, the address requested, the time and the result. We design the logs to leave out email addresses and search text.
• Receipt-reading records. For each receipt we read, we record your account identifier, the time, the file size and the result. We use these records to apply the daily scan limit and to control costs.
• Crash reports. If the mobile app crashes or has an unexpected error, it sends a report to Sentry. A report contains the error, the screens you used just before it, your device model, operating system and app version. Before the app sends a report, it removes email addresses, amounts, friend codes and sign-in data. A report is not linked to your account, and Sentry does not keep your IP address.
• Push notification token. If you allow notifications, the app gets a token that identifies your phone for this app. We keep it with your account, with your platform (Android or iOS) and the date the app last sent it.

We do not use advertising, analytics or tracking tools. We do not sell your personal information, and we do not use it for advertising.

3. Camera and photos

The app asks for access to your camera and photo library only when you add a receipt. It uses only the photo or file that you choose. We store the receipt and send it to a receipt-reading service, which returns the text, line items and totals. The app uses that text to fill in the expense.

4. Why we use your information

• To create your account, sign you in and keep your account secure.
• To record, split and settle shared expenses.
• To read the receipts that you add.
• To send emails about your account and about expenses that include you.
• To send push notifications, if you allow them.
• To convert amounts between currencies.
• To find and fix errors, prevent abuse and keep the service working.

We use your information only for these purposes. If we want to use it for a new purpose, we will ask for your consent first, unless the law allows the use without consent.

5. Consent

When you create an account, you agree to the collection and use described in this policy. Push notifications, camera access and photo access each need your separate permission on your device. You can withdraw that permission at any time in your device settings. You can withdraw your consent to everything else by deleting your account (section 8). Without the information in section 2, we cannot provide the service.

6. Service providers

We use the providers below to run Tabwell. Each one receives only the information that it needs to do its work for us. Our contracts with them do not let them use that information for their own purposes, except as stated below.

Provider	What it does for us	Information it receives	Where it processes it
Amazon Web Services	Runs our servers and our database	All the information in section 2, except crash reports	United States (Ohio)
Cloudflare (R2)	Stores receipt files	Receipt photos and PDF files	Eastern North America
Google (Gemini API)	Reads the receipts that you scan. Google keeps them for a limited time to detect misuse (see below).	The receipt photo or PDF file that you scan, and our instructions to read it	United States and other countries where Google has facilities
Google and Apple	"Sign in with Google" and "Sign in with Apple", if you use them	Your sign-in request; they send us your account identifier, name and email address	United States
Resend	Sends our emails	The recipient's email address, and the content of each email (names, group names, expense descriptions and amounts)	United States (Virginia)
Expo	Sends push notifications	Your push token, and the title and text of each notification (names, group names, expense descriptions and amounts)	United States
Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service)	Deliver push notifications from Expo to your phone	A push token for your phone, and the same notification content	United States
Sentry	Stores crash reports from the mobile app	The crash reports described in section 2	European Union (Germany)
Axiom	Stores and searches our server logs	The server logs described in section 2	United States (Virginia)
ExchangeRate-API	Supplies currency exchange rates	Currency codes only. No personal information.	Not applicable

How Google uses the receipts that you scan

We use the paid service of the Google Gemini API to read receipts. Under Google's terms for the paid service:

• Google does not use the receipts that we send, or its answers, to improve its products.
• Google keeps the receipts and the answers for 55 days, only to detect and prevent misuse of its service and for disclosures that the law requires.
• If Google's automated systems flag a receipt or an answer as possible misuse, authorized Google employees can read it.
• Google can store them in any country where Google or its agents have facilities.

We send a receipt to Google only when you scan it. We send only the receipt photo or PDF file and our instructions to read it. We do not send your name, your email address or your account identifier. The receipt itself can show personal information, such as a name or the last digits of a payment card.

If you do not want Google to receive your receipts, do not scan them. Enter the expense by hand instead.

Other disclosures

We disclose personal information to others only if the law requires it, or to protect the rights, safety and security of our users or the service. If we sell or transfer the business, the buyer receives the information and must protect it as this policy says.

7. Information that other users can see

Tabwell records expenses that you share with other people. The people in a group or an expense with you can see your name, your profile picture, and the expenses, receipts, balances and settlements that you share with them. They can also see the change history of those expenses.

8. How long we keep your information

• We keep your account information while your account is open.
• When you delete your account, we lock it immediately. We remove your password, your Google or Apple identifier, your friend code and your push tokens. We delete the receipt files that you uploaded.
• If you have no open balance, we also replace your name and email address with "Deleted User" at that time, and remove your profile picture. If you have an open balance, we keep your name and email address until every balance is settled, so that the other people can settle with you. We check for this every 6 hours.
• The expenses, groups and settlements that you shared with other people stay in their records, with "Deleted User" in place of your name.
• Deleted expenses stay in the group's record and the group's members can restore them. Their receipts are kept with them. A deleted expense in a group is removed for good when the group is deleted.
• A receipt file is kept until the person who uploaded it removes it from the expense or deletes their account, or until its group is deleted.
• Push tokens that the app has not sent again for 60 days are deleted.
• Copies of emails that we could not send at first are deleted 30 days after the last attempt.
• Server logs are deleted after 30 days.
• Crash reports are deleted after 30 days.
• Database backups are deleted after 7 days. Information that you delete can stay in a backup until that backup is deleted.

9. Security

We protect your information with these measures: hashed passwords, encrypted connections (HTTPS), receipt storage that is not public, and receipt links that expire after a short time. Only the company's director and the developers it authorizes, under a confidentiality agreement can access the production database, and only to operate and support the service. No system is completely secure. If a breach of security creates a real risk of significant harm to you, we will tell you and the Privacy Commissioner of Canada, as the law requires.

10. Processing outside Canada

We store and process your information outside Canada, mainly in the United States. Some providers also process it in the European Union and in other countries (section 6). The laws of those countries apply to it there, and their courts or government agencies can sometimes get access to it. Our contracts with these providers require them to protect it. Section 6 describes how Google uses the receipts that you scan.

11. Your rights

You can do these things at any time:

• See and correct your account information in the app.
• Delete your account in the app, under You, then Delete account.
• Ask us for a copy of the personal information that we have about you, or ask us to correct or delete it. If you live in Quebec, you can also ask for a copy in a structured, commonly used technology format.
• Withdraw your consent (section 5).
• Ask us to delete a record that someone else made with your email address (section 2).

To make a request, email admin@tabwell.ca. We will answer within 30 days. We can ask you to confirm your identity first. If you do not agree with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.

12. Children

Tabwell is not for children. You must be at least 16 years old to use it. We do not knowingly collect personal information from children. If you think that a child gave us personal information, contact us and we will delete it.

13. Changes to this policy

We can change this policy. When we do, we change the date at the top of this page. If a change is significant, we tell you in the app or by email before it applies.

14. Contact us

Tabwell
admin@tabwell.ca