Privacy Policy

Papertab ("we", "us", "our") is a bill-splitting tool that lets you break a receipt into line items, assign each one to whoever ordered it, and track who owes whom. This policy explains what personal information we collect, why, and the choices you have about it.

Account information

Papertab has no password sign-in of its own. When you sign in with Google or Discord, that provider shares your name, email address and profile photo with us, and we store them along with a token that lets you stay signed in. If you choose to set a real name or phone number in Settings, we store those too.

Financial data

The projects, participants, receipts, line items, split assignments and payment records you create. This includes merchant names, dates, amounts, currencies and the notes you add. These records track who owes whom; Papertab is not a payment processor and never handles money itself.

Receipt photos

If you upload a photo of a receipt, we store it so you can view it later. A receipt photo can contain additional personal or transaction information beyond what you type in.

Invitation recipients

When you invite someone by email, we store the address you entered so the invitation can be delivered and tracked. You should only enter addresses of people you are entitled to contact.

AI provider credentials

Adding your own Claude API key is turned off at present. A key you added before stays stored encrypted (AES-256-GCM) and is not used; we keep only its last four characters in readable form, to tell one key from another. You can remove it in Settings at any time.

Device and session data

Sign-in uses session cookies so you stay signed in. We do not use analytics, advertising or tracking cookies.

We use the information above to run the service: to sign you in, to keep your projects and receipts in sync, to send and track invitations, to scan receipts when you choose to, and to respond to your requests. We do not sell your personal information, and we do not use it for advertising or marketing.

If you are in the EEA, we rely on the following bases under the GDPR to process your information: your consent (recorded when you accept the Terms, Conditions, and Privacy Policy at sign-in); performance of the contract to provide you the service you signed up for; our legitimate interests in keeping the service secure and functioning; and legal obligations where they apply.

We share limited information with the service providers that host and operate Papertab:

• Google and Discord — sign-in providers; the identity data you chose to share with them is shared with us through their OAuth flows.
• Vercel — hosting and the Blob storage your receipt photos are kept in.
• Supabase — the PostgreSQL database where your account and project data is stored.
• Resend — sends the invitation emails you create, so recipient addresses are passed to them for delivery.
• OpenRouter — only when you scan a receipt photo. The image is sent through OpenRouter to the company running the model that reads it, at present Wafer or AtlasCloud. Scanning keeps no copy of its own; the photo is stored only if you attach it to the receipt.

We will also disclose information where the law requires us to, or to protect our rights, your safety, or the safety of others.

We use the session cookies that BetterAuth sets to keep you signed in (for example better-auth.session_token). These are strictly necessary to the service and cannot be switched off while you are signed in. We set no analytics or advertising cookies.

We keep your data for as long as your account is active. Deleting your account deletes the data you own; data you appear in as a participant of someone else's project is kept as an anonymous record so the project owner's financial history stays intact, but no longer points at your account. Residual copies may remain in our backups for up to 30 days after deletion.

Invitation records are kept until the invitation is accepted, expires (after 7 days) or is revoked, and are deleted with the sender's account.

GDPR (if you are in the EEA or UK)

You have the right to access the personal information we hold about you, to correct it, to ask us to delete it, to receive a copy of it in a machine-readable form (export), and to object to or restrict certain processing. You can exercise most of these directly: edit your details in Settings, use Export my data, delete your account, or contact us using the details below.

CCPA/CPRA (if you are a California resident)

You have the right to know what personal information we collect and share, to request its deletion, to correct it, and to opt out of any sale or sharing of personal information. We do not sell or share your personal information, so there is nothing to opt out of. We will not discriminate against you for exercising these rights.

To exercise any of these rights, use the tools in Settings or email us at the address below. We will respond within the timeframes the applicable law requires.

We protect your data with HTTPS in transit, encrypted storage for the AI credentials you add, and invitation tokens stored only as hashes. Access to a project's records is enforced by the application: you can read a project you own and a project somebody added you to, and nothing else, and the database itself does not decide that for us. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Papertab is hosted on infrastructure located in the United States (Vercel and Supabase), so your data may be transferred to, and stored in, the United States. Where this involves a transfer of EEA or UK personal data, we rely on the standard contractual clauses adopted by the European Commission as the transfer mechanism.

Papertab is not directed at children. We do not knowingly collect personal information from anyone under 13, and the Terms, Conditions and Privacy Policy require users to be at least 16 years old. If you believe a child has provided us personal information, contact us and we will delete it.

We may update this policy from time to time. When we do, the "Last updated" date above changes. If you continue to use Papertab after a change takes effect, you accept the updated policy.

Questions about this policy or about your data can be sent to the email address privacy@papertab.xiangyushi.dev. We aim to respond within 30 days.