Privacy Policy

Personal records and shared binders

Your personal income calendar is private to your account. Joining a binder does not give its administrators access to that calendar. Binder administrators and members can see shared tip sheets and the staff, contact, allocation and signature information made available through that binder.

Your earnings and your choices

TipKeepr does not automatically report your tips or income to the IRS or other tax authorities, or file tax returns for you. You remain responsible for your tax reporting. We may disclose information when legally required.

We do not sell or rent personal information, share it with other companies for their own marketing, or provide workplace earnings summaries to commercial partners. Sharing a tip sheet with people you choose is a separate feature.

Clear information and practical controls

You can edit your records, export calendar data and request account deletion. Some privacy rights and requests depend on where you live. The sections below explain the controls, service providers and retention limits.

Account and profile

Account details include your email address, name and authentication information. Optional details include a phone number, birthday and profile photo. A birthday can be used for birthday notifications, which can arrive in the app, by push notification, email or text message. You can turn off email and text notifications in Settings → Notifications.

We use your email address for account and service emails, such as sign-up confirmation and password resets. If we send product or marketing emails in the future, they will include a way to unsubscribe.

Work and earnings records

You can enter job names, employers, locations, hourly and tax rates, schedules and hours worked. Financial records can include cash and card tips, sales, covers, tip-outs, expenses, estimated wages and taxes, paychecks, goals and notes.

You can enter custom job and employer names.

Shared sheets, documents and messages

We handle the tip sheets, photos, receipts, PDFs, staff allocations, sharing permissions and recipient contact details you supply. Signatures can include the signature image, timestamp and IP address. Support requests and service messages contain the information you send.

Usage, preferences and technical information

We handle app settings, notification preferences, device and app information, identifiers, feature interactions, attribution information, subscription status and push notification tokens. Crash and error reports contain technical diagnostics and may include entered content. The service-provider section explains these uses.

Website forms and shared-link activity

Newsletter and career-interest sign-ups collect your email address. Career-interest sign-ups use the same mailing list as newsletter sign-ups. Some sign-up notifications also include your IP address. Contact forms collect your name, email, company, message and selected department. Affiliate applications can include contact details, website and social handles, follower counts, audience information, promotion plans and work or affiliate experience.

When you open or use a shared tip-sheet or signature link, we record link activity, IP address, browser/user-agent and device information. This service activity tracking is separate from optional PostHog website analytics.

Providing the service

We use information to operate your account, store and display records, provide reports and sharing features, and manage subscriptions and support.

Feature permissions

We ask for consent for optional website analytics through cookie choices and request device permissions for features that use them.

Notes, documents and messages

Please avoid putting sensitive personal information in notes, documents or messages unless you intend it to be stored or shared through the feature you are using.

Your records and reports

We calculate and display income summaries, estimates, goals, calendars and reports from your entries. Shared-binder information is used to prepare, distribute and sign shared tip sheets.

Accounts, subscriptions and communication

We authenticate accounts, manage subscription status, deliver invitations and notifications, and respond to support requests. We use your email address for account and service emails, such as sign-up confirmation and password resets. If we send product or marketing emails in the future, they will include a way to unsubscribe. We process website inquiries and affiliate applications. Website newsletter and career-interest sign-ups use a shared mailing list.

Reliability and improvement

Usage analytics help us understand features and marketing attribution. Diagnostics help us investigate errors, performance and security problems. Product analytics are distinct from the financial records stored to provide the service.

Supabase

Supabase provides authentication, databases, file storage and backend functions. It processes account details, personal earnings records, shared sheets, uploaded files, settings and other service data.

Upstash

Upstash Redis caches calendar and earnings records, including notes, to help load your calendar. Each calendar-cache copy is kept for up to 7 days and then expires.

Apple, Google and RevenueCat

Apple or Google handles payment collection for store purchases. RevenueCat manages subscriptions using account identifiers, purchase and receipt data, subscription status and device information. TipKeepr also stores subscription, payment and webhook records.

The app also sends your AppsFlyer identifier and available device identifiers to RevenueCat to link purchases with attribution. If the RevenueCat–AppsFlyer integration is enabled, RevenueCat can forward purchase, renewal and subscription events, including subscription revenue and product/account identifiers, to AppsFlyer.

AppsFlyer

AppsFlyer provides marketing attribution using the identifiers and events described here. The SDK can process an app user identifier, IP address, device and operating-system information, iOS IDFA with App Tracking Transparency consent, and Android advertising ID subject to device settings.

The current app sends custom events for registration and the first tip logged, with registration method, entry mode or days since registration. These event fields contain no tip or income amounts, names or notes. They record that a tip was logged, never how much.

The registration and first-tip events above are custom events sent directly by the app. Purchase and subscription attribution can also arrive through the RevenueCat integration described above; subscription prices are separate from your tips or income.

PostHog

PostHog provides product analytics. Events can be linked to your account and can include user ID, email, name or phone number in account flows, feature and session information, device information, acquisition data and subscription metadata.

Starting with app version 2.2.6, product analytics do not include tip or income amounts.

Firebase

Firebase Crashlytics receives crash reports, exception text, stack traces, device and app information and diagnostic context. Error text or context may include entered content, including amounts. Firebase Cloud Messaging uses notification tokens and message data to deliver push notifications.

The app also includes Firebase Analytics, which can automatically collect app and session activity, app-instance identifiers and device information. This SDK collection is separate from our custom PostHog and AppsFlyer events.

Twilio

Twilio delivers SMS invitations, verification and other service messages. It processes recipient phone numbers, message content and delivery information.

Resend

Resend delivers account, service and support emails. We use your email address for account and service emails, such as sign-up confirmation and password resets. If we send product or marketing emails in the future, they will include a way to unsubscribe. For website subscribers, Resend also delivers newsletters and stores newsletter-list contacts. Resend processes recipient addresses and names, message content, form submissions and delivery information. Messages can include information you choose to share, such as a tip sheet.

Vercel

Vercel, our website hosting provider, processes technical requests to serve the site.

Website analytics and preferences

Our website uses cookies and local storage. The cookie banner lets you accept, reject or customize optional categories. PostHog analytics are enabled when you allow analytics; that choice also permits its cookie and local-storage persistence. Your cookie choices are stored locally.

You can block or clear cookies and site storage in your browser. Clearing our stored choice lets you choose again. Blocking storage can affect site features.

Mobile settings and permissions

The app stores session information, preferences and cached records on your device. You can manage supported app settings and notification permissions. Optional biometric sign-in uses your device’s authentication result; TipKeepr does not receive your biometric template.

Declining Apple tracking permission or changing Android advertising-ID settings limits the relevant advertising identifier. It does not turn off all product analytics or crash reporting. The app does not have a general switch that disables every analytics service.

Communication choices

Contact support@tipkeepr.com with questions about emails from TipKeepr.

Active accounts and recovery

We store account records and the content you keep in TipKeepr to provide the service. When you request account deletion, the account enters a 30-day recovery period. To cancel deletion during that period, sign in and confirm account restoration. Signing in alone does not cancel the request.

Calendar cache

Calendar and earnings records cached with Upstash, including notes, are kept for up to 7 days and then expire. These calendar-cache copies may remain after account deletion until they expire.

Permanent deletion processing

After the recovery period, permanent deletion processing removes account data and queues associated file and authentication cleanup. Processing or provider failures can delay completion. Completion can take longer than 30 days.

Tip sheets in binders owned by others, including your name, contact details, allocations, signatures and photos on them, stay with that binder after your account is deleted. Support and feature requests, binder invitations, signature requests, binder activity records, notification error records and SMS delivery logs may also be kept.

Copies already shared, downloaded or exported by recipients may remain outside your account. Copies may also remain in provider systems, including backups.

Provider records

During permanent account-deletion processing, we attempt to delete the PostHog person and events matched to your account. This requires the deletion integration to be available and successful; the initial deletion request does not erase them. If the provider request fails, it may not be retried and data can remain. Unmatched historical or anonymous records may also remain.

Deleting your TipKeepr account does not automatically erase Firebase Crashlytics reports or AppsFlyer attribution records. Those providers have their own retention practices. Contact support@tipkeepr.com for help with a provider-data request; we cannot promise that every request removes all records. Firebase Analytics records are also subject to Google’s retention and deletion practices rather than automatic erasure by the TipKeepr account-deletion flow.

Payments and temporary exports

Apple, Google, RevenueCat and TipKeepr may retain purchase, receipt and subscription records. Account deletion does not cancel a store subscription.

Generated calendar exports are temporary. Download them promptly; if a link expires, generate a new export while your account is available.

Account and device safeguards

Keep your sign-in details and device secure. Optional biometric sign-in relies on device authentication and secure credential storage. Ordinary app preferences and cached records are not all stored in that secure credential store.

Access and sharing

Access controls restrict your personal earnings records, such as income entries and paychecks, to your account and keep them separate from shared-binder records. Check recipients and binder membership before sharing. Information sent to another person can be saved or forwarded by that recipient.

Security incidents

If we learn of a security incident affecting your personal information, we will notify you as required by applicable law.

Provider processing

The provider policies listed above explain their international processing practices. Processing may take place outside your country.

Calendar and earnings records cached with Upstash may also be processed outside your country.

Contact support@tipkeepr.com with questions about processing locations.

Recipient information and permission

If you provide someone else’s phone number, get their permission to receive the message and share only information you are authorized to send. Phone numbers and delivery details can remain in invitation, sharing or service records; they are not used only for the instant of delivery.

Stopping messages and getting help

Reply STOP to any TipKeepr text to stop SMS messages; reply START to receive them again. Contact support@tipkeepr.com for help or to request access, correction or deletion of recipient information. We do not use invitation numbers for unrelated marketing.

Optional birthdays

A birthday is optional and can be used for birthday notifications, which can arrive in the app, by push notification, email or text message. You can turn off email and text notifications in Settings → Notifications. Providing one is not a requirement to use the app.

Before and after your request

Export any calendar records you want to keep before requesting deletion. Your account enters the 30-day recovery period described above. If you want to keep it, sign in and confirm restoration before that period ends.

Permanent deletion processing begins after the recovery period. It removes your account and profile, personal earnings records and paychecks, goals, schedules, your uploaded files and the binders you own. Tip sheets in binders owned by others, provider records and the other items described under Data Retention can remain.

If you no longer have the app, email support@tipkeepr.com from the email address on your account. We use that address to confirm the request is yours. For help with a request, contact support@tipkeepr.com.

Cancel a subscription separately

Account deletion does not cancel an Apple App Store or Google Play subscription. Manage or cancel it through the store to avoid further renewals.

Tools in the app

You can edit supported profile fields and records. For a calendar CSV, open Settings → Import & Export Data → Export Calendar Data. This export does not require a paid subscription. It covers calendar income entries and paychecks, rather than every account record, uploaded file or provider record.

Other requests

Contact support@tipkeepr.com for other personal-data or privacy-rights requests, including marketing opt-out requests. We may need to verify your identity and assess any applicable exceptions.

We aim to respond within 30 days, subject to the timeframes and extensions allowed by applicable law. Withdrawing consent does not affect processing already carried out on that basis.