Tabbi app privacy notice
iPhone and iPad app · Effective 26 September 2026
Who is responsible and what this covers
Tabbi is operated by Willon Chun Yin Lai as an individual. He is responsible for the app data described in this notice. This notice covers the Tabbi app, its account, shared spaces and supporting service. The website and waitlist have a separate notice. For privacy requests, email info@threeguyshk.com.
Account and device information
We receive the name, email address or Apple-provided relay address and sign-in identifier you use to create an account, together with your chosen profile name, language, time zone and optional avatar. If a member invites someone by email, we also store the invitee address and invitation status for that room. Sign in with Apple is handled with Apple; when email sign-in is available, its messages are delivered through our email provider. We keep session, device and notification settings so you can sign in, sync and control alerts. If you enable push notifications, we register an Apple push token associated with your account.
Required and optional information
You need a supported sign-in identifier to use an account; without it, shared and synced features are unavailable. Other profile details, household records, images and optional features are your choice, but the corresponding features may not work without the information they need.
Records you choose to create
Tabbi stores the rooms you join and the financial entries, splits, settlements, budgets, goals, recurring bills, categories, notes, shopping lists, tasks, comments, reactions and household inventory you or other room members enter. These records can contain names, merchant details, amounts and other personal information you type. Purchase details you enter, such as an expense’s merchant, amount, date and category or an inventory item’s purchase date, are linked to your account and room. We use them to show your ledger, balances, reports and household inventory; Tabbi does not receive payment-card details or process those purchases. You may also choose to upload an avatar, room cover, product or list photo, comment image or saved receipt image. We use this information to provide the features, synchronise rooms, calculate balances and show records to authorised members. Tabbi does not connect to your bank or move money.
What other room members can see
Members of a shared room can see its shared ledger, balances, lists, tasks, comments, inventory and linked images according to their access rights. Their names and contributions may appear in shared history. Only invite people you intend to share with, and avoid entering private information about others without their permission. Leaving a room or deleting an account does not automatically remove records needed by the remaining members to understand their shared history.
Comment reports and blocks
If you report a shared-room comment, Tabbi stores the room and comment identifiers, your account identifier, a reason, any optional details you enter, the review status and relevant times. The room owner and administrators can review the report together with the current comment and its author; ordinary room members cannot open the report queue. If you block a member, Tabbi stores the two account identifiers and room so it can apply your choice. These report and block records are removed when the linked account or comment is purged.
Receipts and optional cloud processing
Receipt detection and text recognition first run on your device. A draft is shown for your review; the source photo is not uploaded merely because you scan it. If you choose to save a receipt image, a newly rendered JPEG is uploaded and linked to the entry. Cloud receipt processing is currently unavailable. If it is enabled later, Tabbi will upload a cropped JPEG and the local draft to private temporary storage and send them to the configured AI processor for extraction only after you separately confirm that use. You can continue with the local draft or enter details manually. We do not use receipt images for advertising.
Service providers and transfers
Railway hosts the app service, database and private file storage in Singapore. Apple handles Sign in with Apple and, when enabled, push notification delivery. When email sign-in is available, an email delivery provider processes its messages. An exchange-rate service receives currency codes, but not your account identifier or amount, when a fresh rate is needed. Cloud receipt processing is currently unavailable. If enabled later, the configured AI processor will receive receipt data only when you separately confirm use of that feature. These providers may process data outside Hong Kong. We share only what is needed for the relevant service, or where disclosure is required by law. We do not sell app data or use it to track you across other companies’ apps or websites for advertising.
Operational information
Tabbi has no in-app purchases or subscriptions at launch and does not collect payment card details. Our servers and infrastructure may process server-side request timing, including request duration/latency, along with network address, device or app version, account and request identifiers, response status and errors to secure and operate the service. The app also keeps limited Apple system diagnostics on your device; this implementation does not upload those diagnostic files to Tabbi.
Usage-limit records
During the free launch, we calculate counts of active rooms you own and categories in each room from the records used to provide those features. We count the entries requested for each ledger CSV export. We record account-data export requests with your account identifier and request time, and check the preceding rolling 24 hours to enforce the three-request limit. Cloud receipt processing is currently unavailable, so no cloud-scan allowance is consumed. If enabled later with your separate consent, we will record your account identifier, UTC calendar month and scan count to enforce an allowance of up to five scans per person per month; related scan and consent records are also kept for processing and audit. Capacity and abuse checks may temporarily prevent a request. We use these records to operate the service and enforce limits, not for advertising.
How long information is kept
We keep active account and shared-room records while they are needed to provide the service, unless you remove them or request deletion. When you request account deletion, Tabbi signs out your sessions and allows a 30-day recovery period. After that period, a deletion job removes your account and owned files and attempts to revoke a stored Sign in with Apple credential. In rooms with other members, financial history and shared tasks may remain under a separate historical identity for that room; free-form information you entered into those records can remain visible. Comments and files owned by your account are removed by the deletion process. Temporary receipt uploads and export archives have automatic expiry in the app service, subject to successful worker cleanup. Operational request logs may remain under the active hosting configuration. If infrastructure backup copies exist, they may remain until the relevant provider lifecycle ends, including after an app deletion request. We do not promise immediate removal of these copies or a single retention period for every system. You can ask us about current retention periods and how deletion applies to them.
Your choices and requests
You can correct many profile and room details in the app, turn off notifications in the app or device settings, and remove content where the feature permits. The app provides ledger CSV export and an account export where enabled; the account export contains structured data but not uploaded image bytes. You can request access, correction or deletion by emailing info@threeguyshk.com. We may verify your identity and consider the rights of other room members before acting on a shared record. Deleting the app from your device does not delete your account.
Security and updates
Tabbi uses authenticated sessions and room access checks, HTTPS for the app service and private file access links. Sign in with Apple credentials held for revocation are encrypted separately. No online service can promise absolute security. We will update this notice when app data handling changes and, where appropriate, explain material changes in the app or by email. The latest version is available at this URL.