Privacy

Signing in

Signing in uses Google OAuth, shared across every [sage] tool. Manual entry on Tab Splitter and Square Up needs no sign-in at all. Scanning a receipt or extracting a recipe does, since both involve a paid API call and (for Recipe Record) the server fetching a page on your behalf.

Tab Splitter

A receipt photo you scan is sent to Anthropic's API to read the itemized bill. We don't keep a copy of it ourselves once the read completes, but we can't make promises on Anthropic's behalf about how long they retain it on their end.

While you're signed in, an in-progress split autosaves to your account automatically, so you can pick it back up later, on this device or another. This happens without asking each time. A finished split is only saved to your account, and only gets a shareable link, if you explicitly choose "Save & get link." That link is viewable by anyone who has it, no sign-in required, until you turn sharing off or delete the bill.

Square Up

Square Up never calls Anthropic or any other AI service. What you enter (participant names, expense amounts, who paid what) is kept only in your browser unless you're signed in and explicitly choose to save the settlement. A saved settlement's shareable link, when turned on, works the same way as Tab Splitter's: anyone with the link can view it, no sign-in required.

Recipe Record

Recipe Record fetches the page at the URL you submit, on our server, and sends its content (or text you paste directly) to Anthropic to extract and reword the recipe. A saved recipe is private to your account. There's no public share link for recipes.

Contacts

Contacts is a private list of people you add while splitting a bill, settling up, or sending a fax. For each one you can save a name, company, email, phone number, fax number, and a payment note. Only you can see your contacts. We don't use them for anything else, and we never email or text the people on your list. Saving a contact is always your choice, never automatic. Please only save details for people who'd be fine with it.

You can edit or delete any contact on your account page, and deleting your account deletes all of them. A saved bill, settlement, or fax keeps the name you used, even after you delete the contact. If you turn on a share link, anyone with the link sees that name. We can't promise a deleted contact is removed from routine database backups right away.

Event Quiz

Building a quiz requires signing in. Playing one doesn't: guests join with their name, phone number, and email, and no account is created for them. That phone and email are used only to keep one submission per guest and to let them look up their own results and the rankings later. If a guest adds a selfie, it's optional and only visible to the quiz organizer.

Event Quiz doesn't call Anthropic or any other AI service. There's no self-serve way for a guest to delete their own submission yet. If you'd like one removed, reach out through LinkedIn.

Transcriptions

An audio file you upload goes to a private storage bucket on Vercel Blob that only this app can read, then to AssemblyAI to be transcribed. The audio is deleted from that bucket as soon as it's sent, and deleted from AssemblyAI once the transcript is saved. If a transcription fails, the audio is deleted from AssemblyAI too.

The finished transcript is saved as a text file in your own Google Drive, in a folder this app creates. This app can only create and manage the files it makes in your Drive (Google calls this the "drive.file" permission). It can't see or read anything else in your Drive. Your Drive access token is stored encrypted.

For up to 7 days, this app also keeps the transcript's text, speaker labels, and timestamps in its own database. That's what lets you name speakers after the fact, and what keeps a transcript safe if your Drive gets disconnected before it's saved. After 7 days, that copy is deleted automatically. You can delete it sooner from a recording's Delete options, or all at once in Settings. That doesn't touch the file already saved in your Drive. Speaker names you add, and any group you put them in, are saved as one list so later recordings can reuse them. You can edit or delete them on the Speakers page.

Each recording's title, file size, length, and cost are kept as a record after the transcript is delivered. We can't promise a deleted copy is removed from routine database backups right away.

Transcriptions is only available to specific accounts right now, not everyone who signs in.

Errors and analytics

When something breaks, this app sends an error report to Sentry so it can get fixed. The report has the error message, the stack trace, your browser and operating system, and the page you were on. Share links are stripped out of that page address before it leaves, so a report never carries the token that would let someone open your bill or your settlement.

Left out on purpose: your IP address, your sign-in token, anything you typed or clicked, and the contents of any request you made. There's no screen recording. Receipt photos, fax documents, and camera frames are never attached to an error report.

One exception to that, worth saying plainly. Sentry works out a rough location from your connection, city and country only, and keeps it. The address it worked that out from isn't stored. The location is.

Being straight about the limit: an error message is written by code, not by a person. Things that look like tokens, keys, or images get stripped by pattern before anything is sent, but I can't promise a stray fragment never rides along in an unusual failure.

Page views go to Vercel Analytics and load times go to Vercel Speed Insights, which is how I know whether a tool gets used at all and whether it's slow. Neither sets a cookie, and neither follows you to other sites.

Error reports and analytics age out on Sentry's and Vercel's own retention schedules. I don't extend them. I don't sell your data, and I don't hand it to anyone for advertising.

Deleting your data

You can delete an individual saved bill, settlement, recipe, or contact at any time from your account page. You can also delete your entire account and everything tied to it from the same page, which removes your saved records, drafts, and sign-in itself. Questions about your data can be sent through LinkedIn.