Privacy Policy

This information is stored on your device and is not collected by us:

• Your records. Jobs, shifts, tips, hours, sales, pay, goals, notes and settings are stored in the app's own storage on your iPhone (shared with Tipio's widgets so they can show your week). They're included in your normal iPhone and iCloud device backups.
• Files you create or open. Spreadsheets, PDF reports and backup files are made only when you tap Export, Share or Save a backup, and go only where you send them. When you import, Tipio reads only the file you pick.
• Daily copy to a folder (optional). If you turn it on, Tipio saves dated copies of your shifts in the folder you pick (for example in your iCloud Drive) and keeps the last 7, plus the copy with the most shifts. The folder's provider (such as Apple's iCloud Drive) stores them under its own policy. Nothing is sent to us.
• Reminders, widgets and the Live Activity are created on your iPhone. No server of ours is involved.
• Face ID lock (optional). iOS checks your face or passcode. Tipio only learns whether the check passed and never receives face data.

Deleting the app deletes all of its data on your iPhone.

With Tipio Pro, your jobs and shifts are also saved to the private database of your own iCloud account (Apple's CloudKit) a few seconds after each change, so they come back on a new iPhone signed in to the same Apple Account. Only your Apple Account can read that copy. We can't, and it never reaches a server of ours. Apple stores it under Apple's Privacy Policy. You can turn iCloud backup off in Settings › Backups › iCloud backup. When you turn it off, you choose whether to keep or delete the copies already in iCloud.

You never need an account to use Tipio. If your version of Tipio shows Settings › Account and you choose to sign in:

• Who handles sign-in. You sign in with Apple or Google, and they handle the sign-in itself under their own privacy policies (Apple, Google). With Apple you can hide your email address behind a private relay address.
• What we keep on our account server. Your email address (or Apple's relay address), your name if Apple or Google share it, an account ID, which sign-in method you used and the ID Apple or Google gives you for it, when the account was created and last signed in to, and your sign-in sessions. For Sign in with Apple, we also keep an encrypted token from Apple so we can revoke Tipio's access when you delete the account.
• Why. Only to run your account and keep it secure. We never use it for advertising or tracking, and we never sell it or share it with advertisers.
• What we don't receive. Your jobs, shifts, tips, hours and notes are not uploaded. They stay on your iPhone whether or not you sign in.
• Server logs. Our server's logs record account IDs and whether requests succeeded, never tokens, email addresses or names. To prevent abuse, the server counts recent requests per IP address in memory and doesn't store IP addresses with your account. Server logs are kept for no more than 30 days.
• Your choices. Sign out anytime. Delete the account anytime in Settings › Account › Delete account. See Deleting your information.

The free version of Tipio shows one ad, at the end of your shifts list, from Google AdMob (the Google Mobile Ads SDK). It never appears in Tipio Pro. Ads start only after you've finished setup, and before the first ad Tipio shows Google's consent form where the law requires one (Google's User Messaging Platform), and then Apple's App Tracking Transparency question.

What Google's ads software collects, to choose, show and measure ads, limit how often you see them, and prevent fraud:

• your device's advertising identifier (IDFA), only if you allow tracking when asked; otherwise Google can't access it;
• your IP address and the approximate location it indicates;
• the ads you see and tap, and how you interact with them;
• device and app information, and crash and performance data from the ads software.

Google never receives your shifts, tips, hours, notes or anything you type into Tipio. Your consent choices are stored on your iPhone. If you allow tracking, Google and its ad partners may use this information to show you ads based on your activity across apps and websites (targeted or personalized advertising). If you don't, you'll still see ads, but they won't be based on your activity elsewhere. Ads may also use Apple's SKAdNetwork, which measures ad results without identifying you.

How Google uses information from apps that use its services: policies.google.com/technologies/partner-sites. Google's privacy policy: policies.google.com/privacy.

Your ad choices:

• Tipio › Settings › Privacy & security › Ad privacy choices opens Google's form to change your consent or opt out of the sale or sharing of your information for targeted ads, where Google's rules apply to you.
• iPhone Settings › Privacy & Security › Tracking: turn off Tipio, or turn off Allow Apps to Request to Track. Tipio › Settings › Privacy & security › Ad tracking shows your current answer and opens that setting.
• Tipio Pro removes ads completely, so Google's ads software no longer runs.

Subscriptions and the Lifetime unlock are processed entirely by Apple through the App Store. We never see your name, payment details or billing address. Tipio checks on your iPhone whether you have Pro, using Apple's StoreKit, and shows your purchase history from Apple there. Apple handles purchase data under Apple's Privacy Policy. Manage or cancel subscriptions in iPhone Settings › your name › Subscriptions.

If you send feedback from Settings › Help & feedback or write to us, it's an email you send yourself. Tipio fills in its version, your iOS version, your iPhone model and whether you have Pro, so we can help; you see all of it before you send. No shifts, tips or notes are included unless you add them. We receive your email address and whatever you write, and use them only to answer you and improve Tipio.

We don't sell personal information for money, and we don't share the account information we hold with advertisers. Information reaches these parties:

• Google collects the ad information described in Ads in the free version directly from the free version of the app, as an independent company under its own policies. Google also handles Sign in with Google if you choose it.
• Apple handles App Store purchases, iCloud backup, iCloud Drive (if you choose it for the daily copy) and Sign in with Apple.
• Our hosting provider runs the account server for us and may process account information only to provide that service. It is bound to use that information only to run the service for us.
• Authorities, only if the law requires us to disclose information we hold, or to protect the rights and safety of our users or others.
• A successor, if Tipio is ever sold or transferred, in which case this policy continues to apply to information collected under it.

Third parties other than Google (its ad partners, through Google's systems) don't collect information about your activity in Tipio over time or across other apps and websites.

• On your iPhone, in your folder and in your iCloud: until you delete it. You control it.
• Account: until you delete it. Sign-in sessions end after 60 days without use. Deleting the account removes it from our database right away. Backup copies of the database are kept for no more than 30 days, so a deleted account is gone from them within 30 days.
• Support email: as long as we need it to help you and keep a record of the conversation; ask us to delete it anytime.
• Google: under Google's own retention policies.
• This website: it has no forms, analytics or cookies of its own. Like any website host, ours may briefly log visits (such as IP address and browser type) to run and secure the site. This website is hosted on GitHub Pages; see GitHub's privacy statement for how it handles visit logs.

• Delete all data (Tipio › Settings, the last row) erases your jobs, shifts, goals, reminders and settings from this iPhone. If you have Pro copies in iCloud, you choose whether to delete them too. Copies in your backup folder stay where they are (delete them in the Files app).
• iCloud copies: Settings › Backups › iCloud backup lets you delete every Tipio copy in your iCloud.
• Account: Settings › Account › Delete account deletes your account, its sign-in methods and sessions from our server, and revokes Tipio's access to your Sign in with Apple. It doesn't cancel a Tipio Pro subscription, which belongs to your Apple Account. If you can't reach the app, email us and we'll delete it for you.
• Deleting the app deletes everything it stored on your iPhone.

Residents of California (CCPA as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with consumer privacy laws have rights over their personal information. We honor the requests below for every Tipio user in the United States, whether or not a particular law applies to us.

What we collect (the last 12 months). The categories of personal information, their sources and purposes are:

We don't collect sensitive personal information (such as precise location, financial account numbers or biometric data). Your earnings records stay on your iPhone and are never collected by us.

Targeted advertising, "sale" and "sharing". We don't sell personal information for money. When the free version shows Google ads, Google's collection of device identifiers and ad activity may count as "sharing" for cross-context behavioral advertising under California law, as "targeted advertising" under other states' laws, and, under some states' broad definitions, as a "sale". You can opt out anytime, with any of the ad choices above: Settings › Privacy & security › Ad privacy choices, iPhone Settings › Privacy & Security › Tracking, or Tipio Pro. You can also email us and we'll walk you through it. We don't knowingly sell or share the personal information of anyone under 16. Opting out doesn't change how the app works or what it costs.

Your rights. You can ask us to:

• Know and access the personal information we hold about you, and get a copy in a portable format;
• Delete it;
• Correct it if it's inaccurate (your name and email come from Apple or Google, so you can also update them there and sign in again);
• Opt out of targeted advertising and of any sale or sharing.

Information that stays on your iPhone or in your own iCloud isn't held by us, so you can view, change, export and delete it yourself in the app. For information Google collects through its ads software, Google's tools at myadcenter.google.com also apply.

How to make a request. Email victor.kurilo@gmail.com with "Privacy request" in the subject and say what you'd like us to do. If you have an account, send it from the email address on the account (or tell us the address shown in Settings › Account) so we can confirm it's yours; we'll ask only for what we need to verify you. An authorized agent may make a request for you with your signed permission. We'll confirm we received it within 10 days and answer within 45 days. If we need more time (up to another 45 days), we'll tell you why. We won't discriminate against you for using these rights.

Appeals. If we decline your request, you can appeal by replying with "Appeal" in the subject. We'll answer within 45 days and explain our decision. If you're not satisfied, you can contact your state's Attorney General.

Some web browsers send a "Do Not Track" signal. This website has no ads, analytics or cookies of its own, so there is no tracking to turn off and it treats every visit the same. The app doesn't receive browser signals; on iPhone the equivalent choice is Settings › Privacy & Security › Tracking, which Tipio and Google respect: if tracking isn't allowed, the advertising identifier isn't available to Google.

Tipio is made for adults who work for tips. It isn't directed to children under 13, and we don't knowingly collect personal information from children under 13 (the Children's Online Privacy Protection Act, COPPA). If you believe a child under 13 has created an account or sent us personal information, email us and we'll delete it.

Your records are stored in the app's protected storage on your iPhone, which iOS keeps encrypted after a restart until you first unlock the iPhone. You can add a Face ID or passcode lock in Settings › Privacy & security. The account server is reached only over encrypted connections (HTTPS), sign-in tokens are kept in the iPhone's Keychain, and the server stores refresh tokens only as one-way hashes and Apple's token encrypted. No system is perfectly secure, but we work to protect what we hold and keep it to a minimum.

When this policy changes, we'll post the new version on this page with a new effective date, and the policy inside the app is updated with the next app update. If a change is significant, we'll also say so in the App Store release notes of the update that brings it, and ask for your consent first where the law requires it. Earlier versions are available on request.

Questions or requests about privacy: victor.kurilo@gmail.com. You'll get a reply from the developer. Help with the app: Support.