Privacy

Signing in

Signing in uses Google OAuth, shared across every [sage] tool. Manual entry on Tab Splitter and Square Up needs no sign-in at all. Scanning a receipt or extracting a recipe does, since both involve a paid API call and (for Recipe Record) the server fetching a page on your behalf.

Tab Splitter

A receipt photo you scan is sent to Anthropic's API to read the itemized bill. We don't keep a copy of it ourselves once the read completes, but we can't make promises on Anthropic's behalf about how long they retain it on their end.

While you're signed in, an in-progress split autosaves to your account automatically, so you can pick it back up later, on this device or another. This happens without asking each time. A finished split is only saved to your account, and only gets a shareable link, if you explicitly choose "Save & get link." That link is viewable by anyone who has it, no sign-in required, until you turn sharing off or delete the bill.

Square Up

Square Up never calls Anthropic or any other AI service. What you enter (participant names, expense amounts, who paid what) is kept only in your browser unless you're signed in and explicitly choose to save the settlement. A saved settlement's shareable link, when turned on, works the same way as Tab Splitter's: anyone with the link can view it, no sign-in required.

Recipe Record

Recipe Record fetches the page at the URL you submit, on our server, and sends its content (or text you paste directly) to Anthropic to extract and reword the recipe. A saved recipe is private to your account. There's no public share link for recipes.

Event Quiz

Building a quiz requires signing in. Playing one doesn't: guests join with their name, phone number, and email, and no account is created for them. That phone and email are used only to keep one submission per guest and to let them look up their own results and the rankings later. If a guest adds a selfie, it's optional and only visible to the quiz organizer.

Event Quiz doesn't call Anthropic or any other AI service. There's no self-serve way for a guest to delete their own submission yet. If you'd like one removed, reach out through LinkedIn.

Errors and analytics

When something breaks, this app sends an error report to Sentry so it can get fixed. The report has the error message, the stack trace, your browser and operating system, and the page you were on. Share links are stripped out of that page address before it leaves, so a report never carries the token that would let someone open your bill or your settlement.

Left out on purpose: your IP address, your sign-in token, anything you typed or clicked, and the contents of any request you made. There's no screen recording. Receipt photos, fax documents, and camera frames are never attached to an error report.

One exception to that, worth saying plainly. Sentry works out a rough location from your connection, city and country only, and keeps it. The address it worked that out from isn't stored. The location is.

Being straight about the limit: an error message is written by code, not by a person. Things that look like tokens, keys, or images get stripped by pattern before anything is sent, but I can't promise a stray fragment never rides along in an unusual failure.

Page views go to Vercel Analytics and load times go to Vercel Speed Insights, which is how I know whether a tool gets used at all and whether it's slow. Neither sets a cookie, and neither follows you to other sites.

Error reports and analytics age out on Sentry's and Vercel's own retention schedules. I don't extend them. I don't sell your data, and I don't hand it to anyone for advertising.

Deleting your data

You can delete an individual saved bill, settlement, or recipe at any time from your account page. You can also delete your entire account and everything tied to it from the same page, which removes your saved records, drafts, and sign-in itself. Questions about your data can be sent through LinkedIn.