Privacy Policy

1. Who We Are

tippos Technologies, Inc. (“tippos”) operates tippos.app, a U.S. service that lets a giver leave a private gratuity for the individual who provided a lawful service, and lets that individual claim it. tippos is a technology platform: the charge for a tip is made on the recipient’s own Stripe connected account, and tippos does not receive, hold or transmit tip funds.

This policy covers tippos.app (the tippos app, where you give and claim tips) and discover.tippos.app (the tippos website, with free tip calculators, tipping guides, sourced U.S. tipping statistics and a blog). Leaving or claiming a tip happens only in the app.

Questions about this policy go to contact@tippos.app.

2. What We Collect

From a giver.

The tip amount, the Service fee and total you authorized, the optional message you wrote, and the date and time of each step.
Your email address and, if you provide it, your phone number, for the transactional notices described below. A giver does not need a tippos account.
Your authorization: the exact text you agreed to, its version, and when you agreed.
Stripe’s reference to the card you set up (never the card number or security code), the card’s issuing country and funding type, the billing country, state and ZIP code you entered, and a keyed, non-reversible hash of Stripe’s card fingerprint used to detect abuse. The billing state decides whether tippos is available to you; tippos keeps the state code and the result of Stripe’s postal-code check, not the ZIP code or a street address.
If you leave more than one tip in one visit, or choose “Save this card for future tips” while signed in, the saved-card reference: Stripe’s identifier for the card, its brand and last 4 digits, and the keyed hash of Stripe’s card fingerprint. It lets you pay with the same card again without re-entering it; it is never the card number or security code.
A first-party cookie that lets this browser see the tips it created and link them to an account you later sign in to.
Your approximate location when you create a tip: the country and, in the United States, the state, derived from the network address of your request. Only the country and the state are kept with the tip; the network address is not stored with them, and tippos never keeps coordinates or any location more precise than a state with a tip.

From a recipient.

Your account email address and the credentials used to sign in.
The service category you selected for each claimed tip, your confirmation that you provided the service, your acceptance of the Terms (text, version and time), and the state in which the service was performed.
Stripe’s identifier for your connected account and the status Stripe reports for it (verification, charges and payouts enabled, requirements due). Stripe collects your identity, address, date of birth, tax identifiers and bank account directly, under Stripe’s own terms and privacy policy; tippos does not store them.
Your Stripe balance and payout status, read from Stripe to show them to you.

From everyone.

Technical data needed to run and protect the service: IP address (used in keyed, non-reversible form for rate limiting), request time, browser type, and security event records.
Support correspondence you send us.

If you allow analytics.

Usage data collected through Google Analytics. Nothing here is collected unless you allow analytics in the privacy choices. It covers the pages you view in the app; the actions you take, by category (viewing the home page, opening the give page, choosing an amount, starting and finishing a tip, claim started, failed or completed, setting up payouts, signing in, using a referral link, and your privacy choice), with the tip amount where one applies, a short coded reason when a step fails, the referral code on a referral link, and the tip calculator page you came from, if a calculator link brought you to the give page; whether the data comes from the live app or a test version; your device and browser type; your approximate location, which Google determines from your network address; and Google Analytics cookie identifiers. It never includes names, email addresses, phone numbers, card details, claim codes, Stripe identifiers, message text or tip identifiers, and a value that looks like one is dropped before anything is sent. A page whose address carries a one-time token or personal data is never measured.

When you first open the app.

When a browser opens the app for the first time and someone interacts with the page, a short note about the visit: the page you landed on and the website that sent you, any campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and whether the link carried an ad-click marker (never its value), your approximate location as country, state or region, city, continent and time zone, which our hosting provider derives from your network address, your browser, operating system, device type, preferred languages and the browser’s full user-agent string, the time, and the random identifier in the visitor cookie. It never includes your network address, any keyed form of it, or coordinates. The note is emailed, through our email provider, to tippos’s internal operations mailbox (hosted by Google Workspace), and the same facts are stored in tippos’s database, where tippos staff can see them in an internal admin tool. Crawlers and other automated visits are left out, and a visit is noted once per browser.

On discover.tippos.app.

When you finish a free tip calculator, an anonymous record of the calculation: which calculator, the options you picked, the amounts involved, and whether you tapped through to tippos. It contains no IP address, cookie, account or anything you typed, and nothing links one calculation to another visit.
If you signed up for Early Access before launch (signup is now closed): your email address, the audience type you selected (tip giver, tip recipient, or both), your marketing consent for Early Access communications, the landing page you signed up from, the source and UTM parameters in the link you arrived with, the referring page, your browser’s user-agent string, and signup timestamps.
Your cookie-preference choice, so the website knows whether optional measurement and advertising are allowed.
Usage data through Google Analytics, only if you allow analytics on the website, of the same kinds as described above for the app.

tippos does not intentionally collect raw card numbers, card security codes, bank account or routing numbers, identity documents, precise location, or passwords in plain form. Optional messages are screened for links and contact details and may be hidden or blocked.

3. Why We Use It

To run the tip: create the claim code, let the intended recipient claim it, verify eligibility, and let Stripe make the charge on the recipient’s account at the right time.
To send transactional notices about a tip you gave or claimed (tip ready, claimed, paid, expired, receipt, payout and dispute notices). These are not marketing.
To keep records of authorizations, acceptances and payment events that card-network rules, Stripe’s rules and law require tippos to retain.
To prevent fraud and abuse: rate limits, self-tipping checks, velocity limits, geographic availability checks, and review of unusual activity.
To apply the geographic controls of the tippos pilot: when you create a tip, tippos reads the approximate location of your request (the country and, in the United States, the state; never the network address, which is not stored, and nothing more precise than a state) and stops the tip if it comes from a state where tippos is not available. If you are in a different state you may say so, and that choice is kept with the tip. tippos also compares the state with the state where the recipient says the service was performed and records whether they match; that comparison alone does not decide anything. The recipient never sees your location.
To meet legal and provider requirements, respond to disputes and refund requests, and keep the service secure.
To improve the service using aggregated, non-identifying measurements.
To review a claim with service type “Other” before the giver is charged: the description the recipient writes is read by an automated check. The check sees only the description, the service category and the tip amount; it never sees a name, an email address, a card or an account. When the check does not approve, a person at tippos reads the same description.
To understand and improve how the app is used, using the Google Analytics measurement you allowed. It is not used to decide who can give or claim a tip.
To learn how people find tippos, which pages they land on and where new visitors come from, through the one-time new-visitor note and visit record. It is not used to decide who can give or claim a tip.
To keep the list of people who signed up for Early Access before launch, and to send the tippos emails they consented to when they signed up.
To learn what real visitors choose in the free tip calculators, so calculator guidance can reflect it.
To measure how tippos ads perform and to show them to people who may be interested, only if you choose “Accept all” in the cookie banner on discover.tippos.app or tippos.app.

tippos does not sell personal data, does not use transactional contact details for marketing, and does not build advertising profiles.

4. Who We Share It With

Stripe, Inc. processes card setup, the charge on the recipient’s connected account, payouts, refunds and disputes, and verifies recipients. Stripe is an independent controller of the data it collects directly from you.
The other party to the tip. A recipient sees the tip amount, the optional message and the service category, never the giver’s name, contact details or location. A giver’s receipt names the recipient as the party that charged them, as card-network rules require.
Service providers that host and operate tippos under contract: Vercel (hosting), Supabase (database and authentication), Resend (email), and, only if you allow analytics, Google (Google Tag Manager and Google Analytics). They process data only on tippos’s instructions.
Banks, card networks and authorities where a refund, dispute, legal process, sanctions check or tax rule requires it.
Anthropic, PBC runs the automated check on the description a recipient writes for service type “Other”. tippos sends only the description, the service category and the tip amount, under a contract that does not permit training on that text. No identifiers are sent.
Google LLC (Google Analytics and Google Tag Manager) receives the usage data described above, only if you allow analytics, and processes it for tippos as a service provider for analytics, under Google’s terms.
Supabase stores the Early Access signup data collected before launch and the anonymous calculator records from discover.tippos.app, and Resend sends the emails people consented to when they signed up.
Google (Google Ads) and Meta (Facebook and Instagram) receive information about your visit to discover.tippos.app or tippos.app only if you choose “Accept all” in the cookie banner, and never when your browser sends Global Privacy Control, and handle it under their own privacy policies.

5. How Long We Keep It

The card reference for a tip is detached from Stripe once the tip is paid or closed and the card is no longer kept for you. During one visit tippos keeps the card ready for more tips for 24 hours after you set it up, or until you sign out or choose “Use a different card”. If you chose “Save this card for future tips”, the saved-card reference is kept until you remove the card from your profile, close your account, or 12 months after your last tip with it. tippos keeps only the Stripe identifiers needed for reconciliation.
A giver’s approximate location is kept as part of the tip record and is deleted or de-identified with that record.
A claim code expires 7 days after creation; an unverified claim closes 60 days after it was claimed. Contact details collected only to deliver a claim code are deleted 30 days after the code expires if no account was created.
Authorization, acceptance, payment, refund and dispute records are kept for as long as card-network rules, Stripe’s rules, tax law and dispute windows require, then deleted or de-identified.
Security and rate-limit records expire automatically after a short period.
Account data is kept while the account is active and for the period required after closure.
The description written for service type “Other”, the outcome of its review and the short reason recorded for it are kept with the tip record as evidence that the review took place, and are deleted or de-identified with that record.
Usage data collected through Google Analytics, if you allowed it, is kept for the period set in our Google Analytics property and then deleted by Google.
New-visitor notes are kept in tippos’s internal mailbox for up to 12 months and then deleted. The stored visit records are kept for up to 400 days and then deleted.
Early Access signup records are kept until you ask us to delete them. Anonymous calculator records contain nothing that identifies you.

A legal hold or security investigation can suspend deletion for a documented, time-limited period.

6. Your Choices and Rights

You can ask what personal data tippos holds about you, ask for corrections, or ask for deletion where no legal or security purpose remains, by writing to contact@tippos.app.
You can stop future non-required transactional messages; notices required to complete, refund or dispute a tip may still be sent.
A recipient can close their tippos account; records that must be kept for payment, tax or dispute purposes are retained for the required period.
Residents of states with consumer privacy laws may have additional rights, including to appeal a decision; tippos honors them and does not discriminate for exercising them.
Analytics is off unless you allow it. You can allow or reject it, and change your choice at any time, under “Privacy choices” on the Profile page or in the cookie banner in the app, or in the footer of any page on discover.tippos.app.
You can delete the visitor cookie in your browser settings at any time; the new-visitor note is sent only for a browser that does not have it.

7. Cookies and Security

tippos uses first-party cookies to keep you signed in, carry a tip or claim through its steps, remember the tips this browser created, count a browser as new only once (a visitor cookie, tp_v, kept for one year, and a pending visitor cookie, tp_vp, that lasts 30 minutes until the visit is counted), credit a friend’s referral link, and remember your privacy choice on tippos.app and discover.tippos.app (the tippos_measurement_consent cookie, which records your analytics choice; a second cookie, tippos_ads_consent, is set on tippos.app and discover.tippos.app only if you choose “Accept all”, and never when your browser sends a Global Privacy Control signal). Stripe’s payment form sets its own cookies for fraud prevention. Only if you choose “Allow analytics” or “Accept all”, in the app or on discover.tippos.app, Google Analytics sets cookies that show us how the app and the website are used. Advertising cookies are described under “Advertising” below.

Personal data is encrypted in transit and, where stored by tippos, encrypted or keyed so that contact details, messages and claim credentials cannot be read without the appropriate key. Access is limited to what operating the service requires and is logged.

8. Advertising

We use advertising tools from Google (Google Ads) and Meta (Facebook and Instagram) to measure how our ads perform and to show our ads to people who may be interested. These tools can load on discover.tippos.app and on tippos.app, only if you choose “Accept all” in the cookie banner; “Reject optional” and “Allow analytics” do not load them, and they never load when your browser sends a Global Privacy Control signal. They may collect information such as the pages you visit on our sites and whether you clicked one of our ads, using cookies or similar technologies. On tippos.app they may also learn that a tip was created, its total and a one-way coded reference used to count it once, never your name, email address, phone number, card details, claim code or message. If you allowed analytics when you left a tip, then when that tip is paid, tippos tells Google Analytics that it was paid, with its total and the same one-way coded reference (never your name, email address, card details or claim code), so we can measure how tippos and our ads perform; Google may use it for our ads only if you chose “Accept all”, and nothing is sent if your browser sent a Global Privacy Control signal. Google and Meta handle that information under their own privacy policies.

9. Your choices, including California residents

Under California law, sharing information with advertising partners for cross-context behavioral advertising may count as “sharing.” You can opt out at any time using “Privacy choices” (on the Profile page and in the cookie banner in the app, and in the footer of every page on discover.tippos.app), or by choosing “Reject optional” or “Allow analytics” in either banner. We do not sell personal information for money.

10. Global Privacy Control

If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of advertising cookies on tippos.app and discover.tippos.app, and we do not load them for that browser.

11. Children and Location

tippos is for adults in the United States. It is not directed to anyone under 18, and tippos does not knowingly collect their data. Data is processed in the United States.

12. Changes

Each version of this policy is dated and kept available. A change that affects how data already collected is used will be notified to account holders in advance where the law requires it.

1. Who We Are

Questions about this policy go to contact@tippos.app.

2. What We Collect

From a giver.

The tip amount, the Service fee and total you authorized, the optional message you wrote, and the date and time of each step.
Your email address and, if you provide it, your phone number, for the transactional notices described below. A giver does not need a tippos account.
Your authorization: the exact text you agreed to, its version, and when you agreed.
Stripe’s reference to the card you set up (never the card number or security code), the card’s issuing country and funding type, the billing country, state and ZIP code you entered, and a keyed, non-reversible hash of Stripe’s card fingerprint used to detect abuse. The billing state decides whether tippos is available to you; tippos keeps the state code and the result of Stripe’s postal-code check, not the ZIP code or a street address.
If you leave more than one tip in one visit, or choose “Save this card for future tips” while signed in, the saved-card reference: Stripe’s identifier for the card, its brand and last 4 digits, and the keyed hash of Stripe’s card fingerprint. It lets you pay with the same card again without re-entering it; it is never the card number or security code.
A first-party cookie that lets this browser see the tips it created and link them to an account you later sign in to.
Your approximate location when you create a tip: the country and, in the United States, the state, derived from the network address of your request. Only the country and the state are kept with the tip; the network address is not stored with them, and tippos never keeps coordinates or any location more precise than a state with a tip.

From a recipient.

Your account email address and the credentials used to sign in.
The service category you selected for each claimed tip, your confirmation that you provided the service, your acceptance of the Terms (text, version and time), and the state in which the service was performed.
Stripe’s identifier for your connected account and the status Stripe reports for it (verification, charges and payouts enabled, requirements due). Stripe collects your identity, address, date of birth, tax identifiers and bank account directly, under Stripe’s own terms and privacy policy; tippos does not store them.
Your Stripe balance and payout status, read from Stripe to show them to you.

From everyone.

Technical data needed to run and protect the service: IP address (used in keyed, non-reversible form for rate limiting), request time, browser type, and security event records.
Support correspondence you send us.

If you allow analytics.

Usage data collected through Google Analytics. Nothing here is collected unless you allow analytics in the privacy choices. It covers the pages you view in the app; the actions you take, by category (viewing the home page, opening the give page, choosing an amount, starting and finishing a tip, claim started, failed or completed, setting up payouts, signing in, using a referral link, and your privacy choice), with the tip amount where one applies, a short coded reason when a step fails, the referral code on a referral link, and the tip calculator page you came from, if a calculator link brought you to the give page; whether the data comes from the live app or a test version; your device and browser type; your approximate location, which Google determines from your network address; and Google Analytics cookie identifiers. It never includes names, email addresses, phone numbers, card details, claim codes, Stripe identifiers, message text or tip identifiers, and a value that looks like one is dropped before anything is sent. A page whose address carries a one-time token or personal data is never measured.

When you first open the app.

When a browser opens the app for the first time and someone interacts with the page, a short note about the visit: the page you landed on and the website that sent you, any campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and whether the link carried an ad-click marker (never its value), your approximate location as country, state or region, city, continent and time zone, which our hosting provider derives from your network address, your browser, operating system, device type, preferred languages and the browser’s full user-agent string, the time, and the random identifier in the visitor cookie. It never includes your network address, any keyed form of it, or coordinates. The note is emailed, through our email provider, to tippos’s internal operations mailbox (hosted by Google Workspace), and the same facts are stored in tippos’s database, where tippos staff can see them in an internal admin tool. Crawlers and other automated visits are left out, and a visit is noted once per browser.

On discover.tippos.app.

When you finish a free tip calculator, an anonymous record of the calculation: which calculator, the options you picked, the amounts involved, and whether you tapped through to tippos. It contains no IP address, cookie, account or anything you typed, and nothing links one calculation to another visit.
If you signed up for Early Access before launch (signup is now closed): your email address, the audience type you selected (tip giver, tip recipient, or both), your marketing consent for Early Access communications, the landing page you signed up from, the source and UTM parameters in the link you arrived with, the referring page, your browser’s user-agent string, and signup timestamps.
Your cookie-preference choice, so the website knows whether optional measurement and advertising are allowed.
Usage data through Google Analytics, only if you allow analytics on the website, of the same kinds as described above for the app.

3. Why We Use It

To run the tip: create the claim code, let the intended recipient claim it, verify eligibility, and let Stripe make the charge on the recipient’s account at the right time.
To send transactional notices about a tip you gave or claimed (tip ready, claimed, paid, expired, receipt, payout and dispute notices). These are not marketing.
To keep records of authorizations, acceptances and payment events that card-network rules, Stripe’s rules and law require tippos to retain.
To prevent fraud and abuse: rate limits, self-tipping checks, velocity limits, geographic availability checks, and review of unusual activity.
To apply the geographic controls of the tippos pilot: when you create a tip, tippos reads the approximate location of your request (the country and, in the United States, the state; never the network address, which is not stored, and nothing more precise than a state) and stops the tip if it comes from a state where tippos is not available. If you are in a different state you may say so, and that choice is kept with the tip. tippos also compares the state with the state where the recipient says the service was performed and records whether they match; that comparison alone does not decide anything. The recipient never sees your location.
To meet legal and provider requirements, respond to disputes and refund requests, and keep the service secure.
To improve the service using aggregated, non-identifying measurements.
To review a claim with service type “Other” before the giver is charged: the description the recipient writes is read by an automated check. The check sees only the description, the service category and the tip amount; it never sees a name, an email address, a card or an account. When the check does not approve, a person at tippos reads the same description.
To understand and improve how the app is used, using the Google Analytics measurement you allowed. It is not used to decide who can give or claim a tip.
To learn how people find tippos, which pages they land on and where new visitors come from, through the one-time new-visitor note and visit record. It is not used to decide who can give or claim a tip.
To keep the list of people who signed up for Early Access before launch, and to send the tippos emails they consented to when they signed up.
To learn what real visitors choose in the free tip calculators, so calculator guidance can reflect it.
To measure how tippos ads perform and to show them to people who may be interested, only if you choose “Accept all” in the cookie banner on discover.tippos.app or tippos.app.

tippos does not sell personal data, does not use transactional contact details for marketing, and does not build advertising profiles.

4. Who We Share It With

Stripe, Inc. processes card setup, the charge on the recipient’s connected account, payouts, refunds and disputes, and verifies recipients. Stripe is an independent controller of the data it collects directly from you.
The other party to the tip. A recipient sees the tip amount, the optional message and the service category, never the giver’s name, contact details or location. A giver’s receipt names the recipient as the party that charged them, as card-network rules require.
Service providers that host and operate tippos under contract: Vercel (hosting), Supabase (database and authentication), Resend (email), and, only if you allow analytics, Google (Google Tag Manager and Google Analytics). They process data only on tippos’s instructions.
Banks, card networks and authorities where a refund, dispute, legal process, sanctions check or tax rule requires it.
Anthropic, PBC runs the automated check on the description a recipient writes for service type “Other”. tippos sends only the description, the service category and the tip amount, under a contract that does not permit training on that text. No identifiers are sent.
Google LLC (Google Analytics and Google Tag Manager) receives the usage data described above, only if you allow analytics, and processes it for tippos as a service provider for analytics, under Google’s terms.
Supabase stores the Early Access signup data collected before launch and the anonymous calculator records from discover.tippos.app, and Resend sends the emails people consented to when they signed up.
Google (Google Ads) and Meta (Facebook and Instagram) receive information about your visit to discover.tippos.app or tippos.app only if you choose “Accept all” in the cookie banner, and never when your browser sends Global Privacy Control, and handle it under their own privacy policies.

5. How Long We Keep It

The card reference for a tip is detached from Stripe once the tip is paid or closed and the card is no longer kept for you. During one visit tippos keeps the card ready for more tips for 24 hours after you set it up, or until you sign out or choose “Use a different card”. If you chose “Save this card for future tips”, the saved-card reference is kept until you remove the card from your profile, close your account, or 12 months after your last tip with it. tippos keeps only the Stripe identifiers needed for reconciliation.
A giver’s approximate location is kept as part of the tip record and is deleted or de-identified with that record.
A claim code expires 7 days after creation; an unverified claim closes 60 days after it was claimed. Contact details collected only to deliver a claim code are deleted 30 days after the code expires if no account was created.
Authorization, acceptance, payment, refund and dispute records are kept for as long as card-network rules, Stripe’s rules, tax law and dispute windows require, then deleted or de-identified.
Security and rate-limit records expire automatically after a short period.
Account data is kept while the account is active and for the period required after closure.
The description written for service type “Other”, the outcome of its review and the short reason recorded for it are kept with the tip record as evidence that the review took place, and are deleted or de-identified with that record.
Usage data collected through Google Analytics, if you allowed it, is kept for the period set in our Google Analytics property and then deleted by Google.
New-visitor notes are kept in tippos’s internal mailbox for up to 12 months and then deleted. The stored visit records are kept for up to 400 days and then deleted.
Early Access signup records are kept until you ask us to delete them. Anonymous calculator records contain nothing that identifies you.

A legal hold or security investigation can suspend deletion for a documented, time-limited period.

6. Your Choices and Rights

You can ask what personal data tippos holds about you, ask for corrections, or ask for deletion where no legal or security purpose remains, by writing to contact@tippos.app.
You can stop future non-required transactional messages; notices required to complete, refund or dispute a tip may still be sent.
A recipient can close their tippos account; records that must be kept for payment, tax or dispute purposes are retained for the required period.
Residents of states with consumer privacy laws may have additional rights, including to appeal a decision; tippos honors them and does not discriminate for exercising them.
Analytics is off unless you allow it. You can allow or reject it, and change your choice at any time, under “Privacy choices” on the Profile page or in the cookie banner in the app, or in the footer of any page on discover.tippos.app.
You can delete the visitor cookie in your browser settings at any time; the new-visitor note is sent only for a browser that does not have it.

7. Cookies and Security

8. Advertising

9. Your choices, including California residents

10. Global Privacy Control

11. Children and Location

tippos is for adults in the United States. It is not directed to anyone under 18, and tippos does not knowingly collect their data. Data is processed in the United States.

12. Changes

Each version of this policy is dated and kept available. A change that affects how data already collected is used will be notified to account holders in advance where the law requires it.