Privacy Policy
1. Introduction and scope
This Privacy Policy (the “Policy”) describes how the Tabs Android application (the “App”) accesses, processes, stores and shares information, and the choices available to you. It applies to the App as distributed through Google Play under the package name com.scratch.tabs, and not to third-party applications you may send information to from the App (for example, a messaging application chosen from the Android share sheet).
The App is a bill-splitting and tab-tracking utility designed to operate on your Device: what you enter or scan is stored in the App’s private storage and is not transmitted to the Developer. The only information that may leave your Device without an action on your part is limited diagnostic data sent by Google’s ML Kit library (Sections 4 and 7).
Definitions
- App
- The Tabs Android application, package
com.scratch.tabs. - Developer
- The developer identified in Section 2 who publishes the App on Google Play.
- Device
- The Android phone or tablet on which the App is installed.
- Personal Information
- Information that identifies or could reasonably be linked to an individual, such as a name or photograph.
2. Who the Developer is and how to contact them
The App is developed and published on Google Play by Scratch Zone, an independent developer (the “Developer”). The Developer operates no servers, hosts no user accounts and keeps no database of user information for the App.
Privacy point of contact: tabs@scratchzone.org. Use this address for any question, request or complaint regarding this Policy.
3. Summary of key points
- Local-only by design. Your tabs, items, people, friends, receipt scans and settings are stored in the App’s private storage on your Device. The Developer never receives any of it.
- No accounts, no cloud, no backup upload. No sign-in, and no account or user identifier created by the App or the Developer; no cloud synchronisation; Android cloud backup is disabled for the App.
- No advertising, no analytics by the Developer, no sale of data. No advertising, analytics or crash-reporting SDK is added by the Developer, who does not sell or share Personal Information.
- Receipt scanning happens on your Device. Text recognition uses Google ML Kit with a model bundled inside the App; receipt images and recognised text are not sent to Google or the Developer, and the App keeps no copy of the receipt photo once you leave the scanner.
- One third-party transmission. The ML Kit library may send limited diagnostic and usage metrics (not images or receipt text) to Google LLC. This is the only reason the App holds network permissions.
- You are in control. Delete tabs, people and friends and edit or delete items in the App; deleting a tab also deletes the scanned receipt records saved with it, and temporary camera captures are deleted when you leave the scanner. Uninstalling removes all App data from your Device (Section 9).
4. Information the App processes
“Private storage” below means the App’s sandboxed internal storage on your Device, which other applications cannot read.
| Category | Examples | Where it is stored | Leaves your Device? | Your controls |
|---|---|---|---|---|
| Tabs (bills) | Tab name, tip and tax percentages, paid and archived status, per-tab settings, creation time. | Local database. | No. Appears in text only if you choose to share a tab (Section 8). | Edit or delete the tab in the App; uninstall. |
| Bill items | Item names, prices, assignee, split groups. Items may be typed or recognised from a scanned receipt. | Local database. | No. Included in text only if you choose to share. | Add, edit or delete items singly or in bulk; deleted with the tab; uninstall. |
| People on a tab | Names you type (for example “Sam”), paid status, optional link to a saved friend. No contact details are stored. | Local database. | No. Names appear in text only if you choose to share. | Remove a person (their items become unassigned; the name itself cannot be edited in place); deleted with the tab; uninstall. |
| Friends and optional friend photos | Friend name; optionally a downscaled copy (at most 512 px on its longest side, JPEG) of a photo you select through the Android system Photo Picker (or, on some older devices, the system file picker); the original is not referenced afterwards. | Local database and a private storage folder. | No. Photos are never transmitted, shared or included in shared text. | Replace or remove the photo (previous file deleted); delete the friend (photo deleted, tab links cleared); uninstall. |
| Live camera frames | Preview frames analysed on the Device by ML Kit while the scanner is open, used only for on-screen guidance (for example “Move closer”) and to fire the shutter automatically once the receipt is judged legible. | Memory only; discarded after analysis, never written to storage. | No. | Only while the scanner is open with camera permission granted; you may decline the permission and choose a photo of the receipt from your gallery instead, or add items by hand. |
| Camera captures (temporary) | A still photo written each time the scanner’s shutter fires (automatically or manually), used for text recognition and for the strip of photo shown beside each line while you review the scan. The App keeps no other copy of the receipt photo: a photo you choose from your gallery instead is read through the same system picker and not copied, and receipt photo copies that earlier versions saved with a receipt record are deleted when the App starts. | The App’s private cache folder. | No. | Deleted by the App when a scan fails or finds no receipt, when you cancel or leave the scanner, and, when you confirm a scan, once it has been saved to the tab. A capture left behind because the App was closed during a scan is deleted the next time the App starts. Clearing the App’s cache or storage, or uninstalling, also removes it. |
| Scanned receipt records | Created when you confirm a scan: recognised item names (with any detail lines printed under them), prices and totals and their positions on the image, and, for receipt lines not treated as items (for example payment or fee lines), their position, the reason they were excluded and, where the scan suggested adding one as an item, its amount, but not their text. Records saved by earlier versions have that text removed when the App starts. | Local database. | No. | Not viewable or individually deletable in the current version; deleted together with the tab they belong to (settling or archiving a tab keeps them until the tab is deleted); records that earlier versions left behind for deleted tabs are removed when the App starts; removed by clearing the App’s storage or uninstalling (Section 9). |
| App settings | Theme, auto-sort, default tip and tax percentages, tip-on-post-tax, onboarding-shown flag. | Private preference stores. | No. | Change in Settings (except the onboarding-shown flag, which has no user interface); uninstall. |
| Shared text (user-initiated) | A plain-text summary of a tab or of one person’s share: names, item names, prices, subtotal, tip, tax and totals. | Not stored by the App; handed to the application you select in the share sheet. | Only when you tap Share and choose a destination application, whose own privacy policy then applies. | Entirely optional and per action; you choose the recipient application. |
| Diagnostic data (Google ML Kit) | Usage and performance metrics described in Section 7: device and App information, a per-installation identifier, latency, image format and resolution, event types and error codes. Not receipt images or recognised text. | Queued briefly in the App’s private storage by the ML Kit library, then sent to Google LLC servers; the Developer does not receive it. | Yes, may be transmitted to Google. | No in-app control; governed by the ML Kit Terms of Service and the Google Privacy Policy. |
The App does not ask for, and has no fields for, your name, e-mail address, phone number, contacts, location or payment details; it uses no advertising identifiers; and it accesses your photo library only through the photos you select in the system picker (Section 6).
5. How information is used
The App uses information solely to provide the functionality you request:
- Tabs, items and people: to record a bill, assign items, calculate each person’s share including tip and tax, and display totals.
- Friends and photos: to add people to a tab quickly and recognise them by name and picture.
- Camera frames and captures: to guide you to a legible photograph, capture the receipt image for text recognition, and show the strip of photo beside each line while you review the scan.
- Scanned receipt records: to record the result of a confirmed scan alongside the tab it was applied to. The current version does not display these records.
- App settings: to remember your preferences between sessions.
- ML Kit diagnostic data: used by Google, not the Developer, to measure performance, debug, maintain and improve ML Kit and detect misuse (Section 7).
The Developer uses no information from the App for advertising, profiling, marketing, analytics or any other purpose.
6. Permissions the App requests
| Permission | Declared by | Purpose and behaviour |
|---|---|---|
CAMERA | The App. | Optional. Requested only from the receipt scanner, to preview and capture receipt images. If you decline, the App remains fully usable: a photo of the receipt can be chosen from your gallery instead, and items can be added by hand. Camera hardware is not required to install the App. |
INTERNET | The Google ML Kit library, not the App’s own code. | The App’s own code makes no network requests. Present only because the ML Kit library declares it for the transmissions to Google described in Section 7; never used by the App’s own code and never used to upload receipts, images or anything you enter. |
ACCESS_NETWORK_STATE | The Google ML Kit library, not the App’s own code. | Lets the ML Kit library check network availability before sending its diagnostic data; not used by the App’s own code. |
The App does not request storage or media permissions (photo selection uses the Android system Photo Picker (or, on some older devices, the system file picker), either of which exposes only the photos you choose), nor location, contacts, telephone, microphone, Bluetooth or notification permissions. An internal signature-level permission (com.scratch.tabs.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION) is generated automatically by the AndroidX Core library; it grants no access to information and is not shown to users.
7. Third-party services and SDKs
Google ML Kit Text Recognition (Google LLC)
The App bundles the “bundled” variant of the Google ML Kit Text Recognition library to read the text on receipts: the recognition model ships inside the App package and recognition runs on your Device without a runtime model download. Under the ML Kit Terms of Service, processing of input data (images and text) happens on the Device and ML Kit does not send that data or its outputs to Google’s servers.
However, the ML Kit Terms of Service state that the ML Kit APIs also send metrics about the performance and utilisation of the APIs to Google. According to Google’s published disclosure, this may include device information (manufacturer, model, OS version and build, hardware accelerator support), application information (package name and version), a per-installation identifier that Google states is not intended to uniquely identify a user or device, performance metrics (latency), API configuration (image format and resolution), input and output sizes, feature version, event types (initialisation, detection, resource release) and error codes. Google states that this data is encrypted in transit using HTTPS and is not transferred to third parties, and that the library may also contact Google’s servers for bug fixes and compatibility information.
The Developer does not configure, extend, receive or have access to this data and cannot verify its exact contents, frequency or destination, which are determined by Google. Google’s handling of it is governed by the ML Kit Terms of Service and the Google Privacy Policy it references.
Other components
Apart from ML Kit and its supporting Google libraries, the App uses only standard AndroidX and Kotlin libraries for its interface, local database, camera preview and preferences; these operate on the Device and transmit nothing. The App integrates no advertising network, analytics service, crash-reporting service, payment or billing SDK, social login or web-view content, and bundles its own fonts rather than downloading them.
Google Play may provide the Developer with aggregated crash statistics (“Android vitals”) gathered by Google Play services where the user has enabled Android usage and diagnostics reporting; that collection is performed by Google Play under Google’s terms, not by code in the App, and excludes the contents of your tabs or receipts.
8. Sharing of information
The Developer does not share, sell, rent, license or otherwise disclose Personal Information from the App, because the Developer never receives it. Specifically:
- User-initiated sharing only. The only way information you enter can leave your Device is when you tap a Share action. The App builds a plain-text summary (Section 4) and hands it to the Android share sheet, where you choose the destination application. The App sends nothing automatically and never shares images; the destination application’s privacy policy governs what happens next.
- Google ML Kit diagnostics. The ML Kit library may transmit diagnostic metrics to Google LLC under Google’s terms (Section 7); the Developer receives none of that data.
- No other recipients. No advertising partners, data brokers, analytics providers or service providers act on the Developer’s behalf.
9. Data retention and deletion
All information the App stores is held in private storage on your Device until you delete it in the App, the App deletes it as described below, you clear the App’s storage, or you uninstall. The Developer holds no copy and so has no retention period of its own.
Deleting information in the App
- Tabs. Deleting a tab (after confirmation) permanently deletes the tab with all of its people and items and the scanned receipt records saved with it.
- Items and people. Items can be deleted individually or in bulk; removing a person from a tab moves their items to “unassigned”.
- Friends. Deleting a friend deletes the photo file and clears links from any tab; replacing or removing a photo deletes the previous file.
- Settings. Preferences can be changed at any time in the Settings sheet.
Scanned receipts and camera captures
The current version has no in-app control to view scanned receipt records or to delete them individually; they are deleted together with their tab, and settling or archiving a tab keeps them until the tab is deleted. Temporary camera captures are deleted when you leave the scanner (Section 4); a capture left behind because the App was closed during a scan is deleted the next time the App starts. The App keeps no copy of the receipt photo. When the App starts it also removes what earlier versions kept: scanned receipt records of tabs already deleted, the receipt photo copies saved with confirmed scans, and the text of rejected receipt lines in the records it keeps.
Complete removal
Because every file the App writes is in its private internal storage and never in shared or external storage, uninstalling the App removes all App data from your Device. “Clear storage” for the App in Android Settings does the same without uninstalling.
Backup
The App opts out of Android cloud backup (android:allowBackup="false"), so App data is not uploaded to Google’s backup service. The Developer cannot guarantee the behaviour of every device manufacturer’s transfer or migration tools.
Google ML Kit diagnostics
Retention of the diagnostic data described in Section 7 is determined by Google under the ML Kit Terms of Service and the Google Privacy Policy; the Developer cannot access or delete it.
10. Security
The App relies on the Android application sandbox: all data is written to the App’s private internal storage, which other applications cannot read without root access. The App does not write to external or shared storage, does not use the system clipboard, and does not transmit information you enter or scan over any network; the only network transmission is ML Kit’s diagnostic data, which Google states is encrypted in transit using HTTPS (Section 7). Release builds do not write receipt text, names or images to the system log.
These measures have limits. Information on your Device is only as secure as the Device itself: anyone with unlocked access to it, or with a copy made by tools outside the App’s control, may be able to view App data. The Developer recommends a screen lock and an up-to-date operating system. No method of storage is completely secure, and the Developer cannot guarantee absolute security.
11. Children
The App is a general-audience utility intended for adults splitting restaurant checks and similar expenses. It is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and the Developer does not knowingly collect Personal Information from children. As described above, the Developer holds no information about any user, child or adult.
12. Your rights and choices
Depending on where you live, you may have rights under laws such as the EU and UK General Data Protection Regulation or the California Consumer Privacy Act, including rights to access, correct, delete or restrict the processing of your Personal Information, to portability, and to object. The App is designed so that you exercise these rights directly on your Device:
- Access and correction: everything the App holds is visible in the App except scanned receipt records (deleted with their tab) and temporary camera captures (Section 9); items, tip and tax settings and friend photos can be edited in place, while tab, person and friend names are corrected by deleting and re-creating them.
- Deletion: delete tabs, items, people and friends in the App, or remove everything by clearing the App’s storage or uninstalling.
- Portability: use Share to export a plain-text summary of any tab or person’s share to an application of your choice.
- Camera: decline or later revoke the camera permission in Android Settings; the App remains usable for manual entry and for scanning a photo chosen from your gallery.
- Objection and restriction: the Developer performs no processing of your Personal Information, so there is nothing to object to or restrict.
The Developer does not sell or share Personal Information as defined under the California Consumer Privacy Act and does not use it for targeted advertising or profiling. Because the Developer receives no Personal Information from the App, the Developer cannot locate, produce or delete data in response to an individual request; the mechanisms above are the effective means of exercising your rights. Questions may be sent to the address in Section 15; you may also lodge a complaint with your local data protection authority.
Do Not Track: the App contains no web content and neither the App nor the Developer tracks you over time or across third-party websites or apps, so there is no tracking for a browser “Do Not Track” signal or similar mechanism to switch off.
ML Kit diagnostic data (Section 7) is processed by Google LLC; requests concerning it should be directed to Google under the Google Privacy Policy.
13. International use
The App processes and stores your information on your Device wherever you are located; the Developer does not transfer it across borders because the Developer does not receive it. ML Kit diagnostic data is processed by Google LLC, which may store it in the United States or other countries where Google operates, under Google’s terms and applicable safeguards.
14. Changes to this Policy
The Developer may update this Policy when the App gains features or its data practices change. Material changes will be reflected in an updated Policy with a revised effective date, published at the same URL, which is linked from the App’s Settings sheet and from the App’s Google Play listing, before or together with the release that introduces the change. Continued use of the App after an updated Policy takes effect indicates acceptance of it.
15. Contact
Questions, requests or complaints about this Policy: tabs@scratchzone.org (please mention “Tabs privacy” in the subject).