Privacy Policy

To provide the Tab expense tracking service, we collect:

• Google account information — your email address and name, obtained when you sign in with Google OAuth.
• Gmail read access — we read bank notification emails from OCBC and DBS (and other supported banks) to extract transaction amounts, merchants, and dates. We read only emails that match bank sender addresses. We do not read any other emails.
• Telegram user ID — your numeric Telegram ID, linked to your account to deliver real-time alerts.
• Transaction data — the parsed fields from bank emails: merchant name, amount, date, card last 4 digits, and your chosen category.

• Sending you real-time Telegram alerts when a transaction is detected.
• Displaying your spending history and analytics on your dashboard.
• Storing parsed transactions in Tab's secure database to power the bot, dashboard, budgets, and splits.
• Mirroring transactions to a Google Sheet in your own Google account so you always have your own editable copy.
• Generating spending summaries and budget alerts.
• Storing anonymised email-format templates — with all personal and financial details removed — to improve transaction detection across the service.

We do not sell your data. We do not use your transaction data for advertising.

Parsed transaction records are stored in Tab's secure database (Supabase) to power all features — the bot, dashboard, budgets, bill splits, and spending insights.

Every transaction is also mirrored to a Google Sheet in your own Google Drive. You own that sheet and can edit, export, or delete it at any time. Disconnecting from Tab does not delete the sheet.

Your Google OAuth refresh token, Telegram ID, Google Sheets ID, and account metadata are also stored in Supabase, used solely to operate the service on your behalf.

When a bank email is not recognised by our built-in rules, we may store an anonymised email-format template — the structure of the email with amounts, names, card numbers, references, and other personal and financial details removed — in a shared corpus. These templates carry no identifier linking them to you, and are used solely to improve how accurately Tab detects transactions for everyone.

We request the following Google OAuth scopes:

• gmail.readonly — read your Gmail messages (used only to detect bank emails).
• spreadsheets — read and write to your Google Sheet.

Tab's use of Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

To run the service, we share limited data with the following processors:

• Google — to fulfil Gmail and Sheets API calls on your behalf.
• Telegram — to deliver alerts to your Telegram account.
• Supabase — our database provider (stores your OAuth token, Telegram ID, and parsed transaction records).
• Railway — our application hosting provider.
• Groq — an AI inference provider. When a bank email does not match our built-in rules, the relevant email text is sent to Groq to extract the transaction fields; transaction details (amount, merchant, date, time) are also sent to generate the short spending messages you see in Telegram. See section 8.
• PostHog — our product-analytics provider, used to fix failures and improve the product. We send your Telegram ID, Telegram username and first name, and email address, together with product events: which bot commands you use, onboarding steps you reach, error reports, and — when a transaction is logged or we ask you to categorise one — that transaction's merchant name, amount, category and bank. PostHog processes this on our behalf; it is not used for advertising and is never sold.

We use PostHog for our own product analytics, as described above. We do not share your data with advertisers or data brokers, and we do not sell your data.

You can disconnect Tab at any time from the Settings page. Disconnecting revokes our OAuth access and deletes your stored refresh token and Telegram link. It does not delete your transaction records from Tab's database.

To delete your stored transaction records from Tab's database, run /cleardata in the Telegram bot. This also clears the mirrored Sheet rows.

Your Google Sheet remains in your Google Drive and is not affected by disconnecting. You can delete it yourself at any time from Google Drive.

OAuth refresh tokens are stored encrypted at rest in Supabase. We use HTTPS for all data in transit. We do not store the full or raw body of your emails. When an email is not recognised by our built-in rules, we may retain an anonymised structural template of it (see section 3) — with all personal and financial details removed — and otherwise discard the message.

If you have opted in to telemetry, and an email is handled by our AI fallback, we record only the sender's email domain (e.g. notify.ocbc.com) and whether parsing succeeded — never any email content, subject line, or transaction details.

Most bank emails are read by built-in pattern rules on our own servers. When an email is not recognised, its text is sent to Groq, an AI inference provider, which returns the extracted fields. Transaction details are also sent to Groq to generate the short, cheeky spending messages shown in Telegram.

We instruct our AI processor not to retain this data to train its models, and we do not use your data to build or improve general-purpose AI. Automated parsing can make mistakes — always verify figures against your official bank statements.

If you use bill-splitting, you may enter other people's names, Telegram handles, PayNow handle or the amounts they owe. You are responsible for ensuring you are allowed to share that information with us. We use it only to record and settle the split you created, and the other person can ask us to remove it.

Our service providers (Google, Supabase, Groq, Railway, Telegram) may process data outside Singapore, including in the United States. Where personal data is transferred overseas, we take steps intended to ensure it receives a standard of protection comparable to that required under Singapore's Personal Data Protection Act (PDPA).

You may request access to, or correction of, the personal data we hold about you, and you may withdraw your consent at any time by disconnecting (section 6). To make a request, contact our Data Protection Officer (section 14). We will respond within a reasonable time as required by the PDPA.

If a data breach occurs that is likely to result in significant harm to you, or that meets the notification threshold under the PDPA, we will notify the Personal Data Protection Commission and affected users as required by law.

Tab is intended for users aged 18 and over and is not directed at children. We do not knowingly collect data from children.

If we make material changes, we will notify you via Telegram or email before the changes take effect.

Our Data Protection Officer can be reached at joshualawbh@gmail.com for any privacy questions, access/correction requests, or to withdraw consent. You can also reach us on Telegram: the Tab bot on Telegram.