Privacy Policy

This policy explains what TableCash collects (account, payment, and usage data), why (to run tables and process payments through Stripe), who it is shared with (Stripe, Anthropic, Meta on our website, and the people at your tables), and the rights you have over your data, including deletion.

TableCash LLC ("TableCash", "we", "our", or "us") operates a mobile application that enables creators to collect contributions from friends for group trips, events, and shared goals. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.

1. Information We Collect

1.1 Identity Information

• Email Address: Required for account creation, sign-in, and account recovery
• Apple Account: If you sign in with Apple, we receive the identifier Apple provides (and the email you choose to share)
• Google Account: If you sign in with Google, our profile of you keeps your user ID, your email, and your date of birth. Supabase Auth, the service that runs our sign-in, stores the identity data Google sends: your Google account ID, your email, and usually your name and profile picture
• User ID: A unique identifier assigned to your account
• Date of Birth: We collect your date of birth at sign-up to confirm you are at least 18 years old (TableCash is an 18+ service). We store this date to enforce the age requirement.
• Identity Verification Data: When required for regulatory compliance, we may collect government ID, name, and address through our payment processor
• Identity Fingerprint: When you complete identity verification, we generate and store a one-way cryptographic identifier derived from your identity verification data. This identifier cannot be reversed to recover your personal information. Apart from your date of birth (above), no raw government-ID data (ID document numbers, full address from your ID) is stored by TableCash, only the irreversible identifier

1.2 Financial Information

• Payment Methods: Credit/debit card details, bank account information (collected and stored by Stripe, not by us)
• Saved Cards for Commitment Tables and Autopay: When you save a card to commit to a table or turn on autopay, Stripe stores the card and gives us a token that refers to it. We store that token, the amount you committed, the fee quoted to you, and a record of the consent wording you saw. The last 4 digits and expiry the app shows are read from Stripe when needed, not stored by us. We never see or store the full card number.
• Transaction History: Contributions, commitments, withdrawals, and settlements within tables
• Account Balances: The balance shown for each table you create or join

1.3 Security Information

• Two-Factor Authentication (2FA): If you turn on 2FA, we store the secret key that makes your codes, and your one-time recovery codes, which we store only as hashes. Only our servers can read them; they are never shown to other users. A code is then needed for cash outs and other sensitive account actions.

1.4 Table Data

• Table Memberships: Which tables you create or join
• Table Names: Names assigned to cash tables
• Member Relationships: Your role (creator, moderator, or member) in tables
• Transaction Notes: Optional notes you add to transactions
• Receipts: A receipt attached to a money event on a table (the photo, and the merchant, date, total, and items read from it) is stored with the table and visible to its members
• Bills on a goal: A bill the organizer attaches to a goal (the photo, and the merchant, date, total, and items read from it) is stored with the table and visible to its members, for that goal and month. The photo is first sent to Anthropic to read it. When that reading finds a card or account number, a Social Security number, an address, a phone number, or an email address in the photo, the photo is not stored; the fields read from it still are. When the organizer removes a bill, the photo is deleted and a note that it was removed, and by whom, stays
• House votes: When you vote, we store which option you picked so each person has one vote and can see and change their own pick until the vote closes. Nobody, the organizer included, is shown another person's pick; the house sees how many voted while it is open, and the totals after it closes
• Badges: Whether you are the creator or a moderator of a table, whether Stripe has verified your identity, and whether you still hold a TableCash Plus subscription bought before September 30, 2026. These are shown as small marks next to your name, only to members of that table
• Settings Audit Log: When the goal, the Creator's part, the deadline, shares, the PIN requirement, or request defaults on a table are changed, we record which account made the change, the table, and the value before and after. Money events on a table (chip-ins, requests, approvals, sends, cash outs) are recorded the same way. This log is kept as part of the table's records and is not directly viewable in the app

1.5 Device Information

• Device Type: iOS or Android
• App Version: Version of TableCash installed
• Device ID: A random identifier the app creates when it is first opened and keeps in your phone's secure storage. It is sent with the app's requests to our servers and used for sign-in security (Active Sessions, remembered devices) and to keep banned accounts from returning. It is not your phone's advertising identifier
• Sign-in Sessions: For each device signed in to your account, we keep the device name, the app version, its IP address, an approximate location (city and region), and when it was last active, so you can see and end sessions in Active Sessions and we can tell you about a new sign-in. The approximate location is looked up from the IP address by ipwho.is, a geolocation service that receives only the IP address
• Signed-out Sessions: When a device is signed out, from Active Sessions, from the link in a new sign-in email, or on the device itself, we keep that session's record (device name, location, when it was signed out and how) with your account's security records until your account is deleted
• Chip-ins by Card: When you chip in by card in the app, the IP address and device ID the payment was made from are saved with that payment's record at Stripe. When you accept a table's contribution agreement, we save the IP address it was accepted from. Both are used only if the payment is disputed (Section 3.3)

1.6 AI Feature Content

• Content you submit to AI features: AI features are available on every table. When you use them, the content you submit to them, such as a photo of a bill you scan, or a description you type for the planner, is processed to produce a result (see Section 9.3). We do not use this content to train AI models or for advertising.
• Bill scans: When you scan a bill, the photo is sent to Anthropic to read the merchant, date, total, and line items, and the result comes back to you to check. We do not keep the photo unless it is attached to the table as a receipt or a bill (Section 1.4), and not even then when it shows a card or account number, a Social Security number, an address, a phone number, or an email address. We record that a scan happened (your account, the table, and the time) to limit how many scans a table and a person can make.

1.7 Website Table Drafts (tablecash.app/start)

• Draft contents: If you build a table on tablecash.app/start before installing the app, we store the draft you typed (table name, purpose, table type, goal, and deadline) under a 6-character code so you can pick it up in the app.
• Where you came from: If the link you arrived on carried campaign tags (utm_source, utm_medium, utm_campaign, utm_content) or a Meta click id (fbclid), they are saved with the draft so we can tell which campaign led to a table.
• Hashed IP address: To limit how many drafts one visitor can create (20 per hour), we store a one-way hash (SHA-256, without a salt) of your IP address with the draft. We do not store the IP address itself.
• A reserved $name: If you pick a $name while building the draft, it is held for you for 45 minutes.
• RSVPs: If you tell an organizer you're in from their draft's page, we store the name you typed (up to 20 characters), a random ID your browser keeps for our site, and a hash of your IP address, with that draft.
• Website steps and tests: We record some steps on our website pages with that browser ID, the name you typed when there is one, and which version of the page you saw (we sometimes test two versions). Nothing deletes these records on a schedule; we keep them.
• In your browser: The page keeps the draft and the campaign tags in your browser's local storage so you can return to it. Clearing site data removes them.
• Retention: A draft can be claimed once and becomes unusable 7 days after it is created. A draft and its RSVPs are deleted once it expires, or a day after it is claimed.

1.8 Support Chat

• What is saved: When the in-app support chat answers you with AI, your question and the answer are saved to your account. When you tap "Send to support", we save your question, the conversation so far (up to 1,000 characters), and your app version, so a person can follow up. Ideas you send are saved too. Questions answered from the chat's written answers are not saved. Demo accounts are not recorded.
• Account summary used to answer: Each AI answer is made from a read-only summary of your account: your first name, each of your live tables (its name, your role, its balance, and how many members it has), your payout setup status, and how many requests are open on your tables. It never includes bank, card, or ID details. The summary and the last 10 turns of the chat are sent to Anthropic with your question (Section 9.3).

1.9 Calendar Link

• What we store: If you make a calendar link (Account > Calendar), we store the word you picked to title its events (for example "House"), a one-way hash (SHA-256) of the link's secret, when the link was made, and when a calendar app last read it. The link itself is shown to you once and is not stored.
• What the link shows: Only tables you are an active member of: when the main goal is due, the last day to commit, your own cleaning turns, events you made or are invited to (unless you said you can't make it), your bookings, your away days, and when extra goals are due.
• Event titles: Every title starts with your word. Amounts written with $, €, or £ are taken out, and we never add the table's name. Names people type themselves, such as a job, an event, or a goal name, are shown as typed.
• Who can read it: Anyone who has the link. The calendar app you add it to (for example Apple Calendar or Google Calendar) reads it and keeps the events under that company's own policy. Making a new link, leaving a table, being removed from one, or a table being deleted turns the old link off.

1.10 Action Links (tablecash.app/a/...)

• What they are: An organizer can send you a link from their own phone (or we can email you one) so you can answer one thing without opening the app: mark your turn done, say whether a payment reached you, or chip in toward a goal. Each link is for one person and one thing.
• What we store: A one-way hash (SHA-256) of the link, the table, who it is for, what it is about (and the amount and fee, when there is one), the version of the wording you agreed to, how it was sent, when it expires, and when it was opened and used. When a link is opened we store a hash of the IP address with that event, never the IP itself. We do not store anyone's phone number for this: a text is sent from the organizer's own phone.
• If you pay through a link: The payment goes through Stripe like any other chip-in. The IP address it was made from is saved with that payment at Stripe, along with the email your receipt goes to.
• Codes: Saying whether a payment reached you needs a 6-digit code we email to your account address, so a forwarded link can't answer for you. We store only a hash of the code.
• What the page shows: Only that one ask: the table's name, the organizer's $username (or their display name if they have none), your $username, a hint of your email (its first letter, then •••, then the domain), and the amount or job. Never other people's money. Leaving a table, being removed, the table being deleted, or your account being deleted turns its links off.

1.11 Rooms

• A room you post: The monthly price, deposit, and bills, the room and bath, furnished, parking and laundry, the move-in date and how long, the zip code, the house rules you picked from the app's list, the questions you ask, and your short note. We also record when you confirmed that you live there and that your lease lets you add someone. Rooms has no photos.
• Who sees a room: Anyone, in the app and on tablecash.app, while it is open. A room shows its area and about how far away it is, never its address.
• Your room search answers: Your budget, your move-in date, and how you live (smoking, quiet or social, tidiness, guests, pets, bedtime, and time at home). A poster sees them, and how they fit their house rules, only when you ask about their room. The zip code you search from is kept on your phone and sent with each search; we don't store it, and we don't use your phone's location. To limit how fast the room list can be loaded, we use your IP address; those records are cleared daily.
• Requests, messages, and viewings: What you write in a request or a chat, and the viewings you set up (the time, in person or video, and for an in-person viewing the address the poster types). Only the two people in a chat see it, and the address only once the time is agreed. If you share a viewing with someone you trust, the share link shows the other person's first name, the area, the time, and the address to anyone who has the link, until 3 hours after the viewing time.
• What the other person sees about you: Your first name and whether your ID is verified. Not your $username, your email, or anything from your tables.
• Safety checks: Messages are checked for words about money and ID, and for rude or sexual words, so the app can warn you and mark the message. Phone numbers, emails, links, handles, and $cashtags are blocked in a chat until a viewing is agreed. When you report something, we keep the report: who sent it, the reason, your note, and what it was about. To keep Rooms safe, for example to review a report, our team can read Rooms chats in our admin tool; every time they open one, we record who opened it, when, and their IP address and browser.

2. How We Use Your Information

We use collected information to:

• Authenticate your identity via your email and password, Sign in with Apple or Google, and optional two-factor authentication
• Process financial transactions: Contributions and creator payouts via Stripe
• Comply with regulations: KYC (Know Your Customer), AML (Anti-Money Laundering), and tax reporting requirements
• Provide core functionality: Create tables, collect contributions, manage members
• Prevent fraud: Monitor for suspicious activity and enforce platform bans, including using identity fingerprints to prevent banned individuals from creating new accounts
• Sync data across your devices
• Charge saved cards you authorized: Charge a card you saved for a commitment table or autopay, only under the terms you agreed to
• Answer card disputes: When a chip-in is disputed with the card's bank, send the bank, through Stripe, what our records show about that payment (Section 3.3)
• Show your calendar: Serve the calendar link you made (Section 1.9)
• Run Rooms: Show rooms, pass requests and messages between the two people, and review reports (Section 1.11)
• Pick a partner store for a goal: Suggest a store that fits what a goal is for (Section 9.5)
• Answer support questions: Run the in-app support chat, including AI answers about your own account
• Keep records: Maintain an audit log of money events and money-related settings changes on tables
• Measure ads: Tell which ad or link led someone to our website, to build a table, or to sign up (see Section 9.4)

We do NOT sell your data. The app contains no advertising trackers. The ad measurement we do is with Meta: the Meta Pixel on some of our web pages, and one sign-up event our server sends, both described in Section 9.4.

3. Payment Processing

3.1 Stripe

All payment processing is handled by Stripe, Inc. ("Stripe"). When you pay or cash out:

• Your payment information is collected directly by Stripe
• Stripe is a licensed money transmitter and holds the money
• The money is held in Stripe's regulated accounts, not ours
• See Stripe's privacy policy: https://stripe.com/privacy

3.2 Who Holds the Money

TableCash doesn't hold your money; it sits in the Table Creator's Stripe account, held by Stripe Payments Company (SPC), a U.S. state-licensed money transmitter and federally registered money services business. TableCash only takes from it what our Terms of Service say: the TableCash fee, money taken back for a dispute or refund, and amounts due.

3.3 Evidence for Card Disputes

If a chip-in is disputed with the bank that issued the card (a chargeback or an inquiry), we may answer it through Stripe. Stripe passes the answer to the card issuer and the card network. The answer contains only what our records show about that one payment and the person who made it:

• The payment: The amount, the date, the table's name and purpose, when it was recorded on the table, and the last 4 digits of the card
• Who paid: Your $username, when your account was created, your email address, and the name on the card. For a guest chip-in: the guest name, the email given, and when (and from which IP address) the guest confirmed they are 18 or older
• Where it was made: The IP address and device ID the payment was made from (Section 1.5)
• What you agreed to: Which version of the table's contribution agreement you accepted, when, and from which IP address. For autopay or a promise: which version of those terms you agreed to, and when, and the notice we sent you before the automatic charge
• Receipt: That Stripe emailed a receipt for the payment, and the address it went to
• Sign-ins after the payment: Sign-in sessions on your account after the payment (device name, IP address, and when each was last active)
• Earlier payments: Payments from the same card and the same TableCash account to the same table in the year before, that were never disputed or refunded: their dates, amounts, and payment IDs, and, when the card network's rules ask for them, the IP address and device ID each was made from
• Bank approval: Whether the card's bank authenticated the payment (3D Secure)

We never include anything about other members of the table, or anything from your other tables. We answer only when the records include your agreement, your consent, or a charge notice from before the payment. We don't answer chargebacks of $50 or less.

4. Data Storage and Security

4.1 Storage

Your data is stored securely using:

• Supabase: PostgreSQL-based backend with encryption at rest (AES-256) and in transit (TLS 1.3)
• Stripe: PCI-DSS Level 1 compliant payment processing
• Row-level security policies: Ensuring data isolation

4.2 Data Location

Data is processed and stored in secure data centers in the United States.

4.3 Retention

• Active accounts: Data retained while your account is active
• Closed accounts: Transaction records retained for 7 years for regulatory compliance
• Deleted accounts: Personal data (except legally required records) deleted within 30 days
• Identity fingerprints: Cryptographic identity hashes associated with platform bans are retained indefinitely to prevent banned individuals from re-registering. These hashes cannot be used to reconstruct personal information
• Website table drafts: Usable for 7 days from creation, deleted after they expire or a day after they are claimed, with their RSVPs. Website step records are kept (Section 1.7)
• Support chat: Kept with your account and deleted when your account is deleted
• Audit log: Kept with the table's transaction records (see "Closed accounts" above)
• Calendar link: The link's hash and when it was last read are removed when you make a new link, leave a table, are removed from one, or a table is deleted. The record with the word you picked is kept until you delete your account
• Bill scans: The photo is not stored unless it is attached as a receipt or a bill. The record that a scan happened is kept to enforce scan limits
• Saved card tokens: Each commitment has its own record, one per goal you commit to. The token that refers to the card you saved for that commitment stays on that record with the table's transaction records, and is cleared when the Creator drops a failed card. Stripe keeps the card itself under its own policy
• Rooms: A closed chat is deleted 60 days after it closes. A room that expired, or that its poster took down, is deleted 90 days later, with its chats and viewings. A filled room, and a room we took down, is kept. Room search answers you turned off are deleted 180 days later. Reports are kept; when what a report was about is deleted, the report no longer points to it. When you delete your account, your rooms come down
• Partner link taps: Deleted when your account is deleted (Section 9.5)

5. Data Sharing

5.1 We Share Data With:

• Table Members: Other members can see table balances, transaction activity, and your badges (creator, moderator, verified, Plus) within shared tables. On a commitment table, the Creator can see, for each goal, each member's commitment amount to that goal and whether a card is saved; members see only their own
• Stripe: Payment processing, saved cards, identity verification, and holding the money
• Card issuers and card networks, through Stripe: When a chip-in is disputed, the evidence described in Section 3.3
• Anthropic: The optional AI features, the support chat's AI answers, and picking a partner store for a goal (Sections 9.3 and 9.5)
• People in Rooms: When you ask about a room or chat in Rooms, the other person sees what Section 1.11 says
• Meta: Ad measurement from our website, and one sign-up event when you claim a $username (Section 9.4)
• Regulatory Authorities: When required by law (e.g., tax reporting, subpoenas, AML compliance)
• Service Providers: Supabase (database hosting) - bound by data processing agreements

5.2 We Do NOT:

• Sell your personal information to third parties
• Share what happens in your tables with advertisers. The app has no ad trackers. What we send Meta for ad measurement is listed in Section 9.4
• Use your data for marketing without explicit consent
• Share your email address with other members of your tables

6. Your Rights

6.1 Access Your Data

Export all your personal data directly from the app: Profile > Export My Data.

6.2 Delete Your Account

Delete your account at any time through Profile > Delete Account. This permanently removes:

• Your user profile
• Your table memberships
• Access to shared tables

Note: Transaction records may be retained for regulatory compliance.

Stripe Connected Account: If you set up payouts, Stripe created a Connected Account in your name to hold and move your money. Deleting your TableCash account does not automatically delete that Stripe Connected Account or the financial records Stripe is legally required to keep. Stripe processes that data as its own controller under Stripe's privacy policy and applicable financial-records laws (typically retained for several years). To close your Stripe Connected Account or request deletion of data Stripe holds, contact support@tablecash.io and we will help you initiate the request with Stripe; some records cannot be deleted while legal retention obligations apply.

6.3 Data Portability

Your data export is provided in a human-readable format.

6.4 Withdraw Consent

You may stop using the app and request account deletion at any time.

7. Regulatory Compliance

7.1 Know Your Customer (KYC)

For certain transaction thresholds or activities, we may require identity verification through Stripe Identity to comply with financial regulations.

7.2 Anti-Money Laundering (AML)

We monitor transactions for suspicious activity as required by law. Suspicious activity may be reported to relevant authorities.

7.3 Tax Reporting

We may issue tax forms (e.g., 1099-K) as required by the IRS for users who exceed reporting thresholds.

8. Children's Privacy

TableCash is not intended for users under 18 years of age. We do not knowingly collect information from minors. Financial services require users to be legal adults.

9. Third-Party Services

9.1 Stripe

• Payment processing and holding the money
• Privacy policy: https://stripe.com/privacy
• Licensed money transmitter (see Stripe's licenses page: https://stripe.com/licenses)

9.2 Supabase

• Database and authentication services
• Privacy policy: https://supabase.com/privacy

9.3 Anthropic (AI Features)

• Powers the optional AI bill scanner and planner, reading bill photos attached to a goal (Section 1.4), the AI answers in the in-app support chat, and picking a partner store for a goal (Section 9.5)
• When you use these features, the content you submit (such as a bill photo or a planner description) is sent to Anthropic to generate a result, then returned to you. Anthropic does not use it to train its models, and keeps it only for a limited period under its commercial terms
• When the support chat cannot answer from its written answers, your question, the last 10 turns of the conversation, and the read-only account summary described in Section 1.8 are sent to Anthropic to generate a reply. The reply is text only; the model has no ability to act on your account
• We do not send Anthropic your identity documents, payment, or bank information
• Privacy policy: https://www.anthropic.com/legal/privacy

9.4 Meta (Ad Measurement)

• On our website: The pages below load the Meta Pixel. The app does not.
• The homepage (tablecash.app): a page view; when you check a $name that is free and when you start claiming it, an event with the name you typed; when you tap the App Store or Google Play button, which store; and when you tap the button to send the page to whoever runs your place.
• The join page (tablecash.app/join): a page view, a view of the join page, and when you tap the store button, which store (iPhone or Android).
• The table builder (tablecash.app/start): a page view; when you first type a $name (3 or more letters) and when you claim it, the name you typed; when you share your link or send it to whoever runs your place, and when someone says they're in (with how many are in so far), your $name; and when you tap the App Store or Google Play button, which store and the $name you reserved. Each of these also carries which version of the page you saw, since we sometimes test two versions.
• From our server: When you claim your $username, our server sends Meta one sign-up event with a one-way hash (SHA-256) of your email address in lowercase, and the Meta click id if one was saved with a website draft held for that $username. It does not include your IP address or browser details.
• Meta also receives the standard browser data its pixel collects, such as your IP address and cookies, under Meta's own policy.
• We do not send Meta anything from inside your tables: not table names, amounts, or who is in them.
• Privacy policy: https://www.facebook.com/privacy/policy

9.5 Partner Stores

• Some links in the app go to partner stores (like Vrbo). TableCash may earn a commission from the partner store. It never changes your price.
• Picking a store happens automatically: when a goal is created or renamed. A goal that has reached 80% of its target (or been reached) but has no pick yet, or was renamed since its last pick, is also picked when someone at the table opens the table and the app asks for its store links, up to 2 goals each time. To pick, we send Anthropic the goal's name and amount, the table's name, purpose, and type, the trip place if one is set, the month, and the names of up to 10 of that table's other goals. Anthropic returns a kind of thing (like "furniture") and a short search word. We don't send who is in the table, what anyone paid, or anything from other tables.
• The organizer can hide a goal's store link, which also stops future picks for that goal. Members can't turn this off for themselves.
• When you tap a partner link, we record that you tapped it: you, the table, the goal, the store, the kind of thing, how sure the pick was, where the goal was when you tapped (close to its target, reached, or being cashed out), and the time. The link carries only the search word, and for a place to stay the trip place and how many people are in the table. We do not send the store your name, email, or anything about the money on your table.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes through:

• In-app notifications
• Email (if provided)
• Updated "Last Modified" date

Continued use after changes constitutes acceptance of the updated policy.

11. California Privacy Rights (CCPA)

California residents have additional rights:

• Right to know what personal information is collected
• Right to delete personal information (subject to regulatory retention requirements)
• Right to opt-out of sale of personal information (we do not sell data)
• Right to non-discrimination for exercising privacy rights

12. International Users

TableCash is currently available only in the United States. If you access the app from outside the US, you consent to the transfer and processing of your data in the United States.

13. Contact Us

For privacy-related inquiries:

Email: support@tablecash.io

Response Time: We aim to respond within 48 hours.

---

By using TableCash, you acknowledge that you have read and understood this Privacy Policy.