SlyTab Privacy Policy
Last updated: October 25, 2026 · Data controller: Electric RV, Ontario, Canada
SlyTab is a private expense-sharing app made for families and friends. Our privacy position is simple: your data is yours, it stays on our server in Canada, and we never sell it, share it for advertising, or run analytics on it. The website only counts page views, as described below.
What we collect
- Account: your email address, display name, and a hash of your password (we can never see the password itself).
- Expense data: the groups you're in, expenses, splits, settlements, and any notes you enter — visible only to members of the same group.
- Payment handles (optional): an Interac e-Transfer email, PayPal.Me, or Venmo username you choose to save so group members can pay you. SlyTab never processes, holds, or has access to money or banking credentials.
- Receipt photos (optional): stored with the expense, visible only to the group.
- Sign-in identity, if you use it: if you sign in with Google or with Apple, we receive the email address that provider gives us (which may be Apple's private relay address) and store it as your account email, along with an identifier linking the account. We never receive your Google or Apple password.
- Devices you're signed in on: a device label and timestamps, so you can review and revoke sessions from your profile. If you allow notifications, a push token for your device.
- Bug reports (optional): what you write, any screenshot you attach, and your app version and device type, when you use Profile → Report a bug. See below.
Bug reports and support
A report from Profile → Report a bug is stored on our server and sent, as an email with a reference like ST-261025-AC34, to Electric RV's support mailbox. Your account email goes with it so we can reply to you. Support mail may be read and sorted by software Electric RV runs itself, and a person decides what happens to every report before you get an answer. If that software ever uses an outside service to read your message, this policy will name the service before it does. A report is used to answer you and fix the problem, and for nothing else. It is never published: if it leads to a public bug report, we write that in our own words, with nothing that identifies you. To have a report deleted, email privacy@electricrv.ca quoting its reference.
What we don't collect
No analytics beyond the website page-view count described below, no telemetry, no advertising or tracking SDKs, no contact-list access, and no selling or sharing of anything for advertising.
Website page-view count
The SlyTab website, including the web app, keeps a cookie-free count of page views so we can see how many people reach each part of it. For each view we store the time, the page path (never the query string), the referring site's domain, your screen width, and a hash that changes every day so a visit can't be followed from one day to the next. We don't store IP addresses, set cookies, write anything to your browser, or use any third party for this. If your browser sends Do Not Track or Global Privacy Control, nothing is recorded. The iPhone and Android apps don't do this.
About location
We don't track your location and we never store it. One narrow exception, which happens on your device: when you attach a receipt photo, the app reads the photo's GPS tag (if the photo has one) purely to guess which currency you were spending in. Only the resulting three-letter currency code is sent to us — never the coordinates. The photo itself is uploaded with whatever tags your camera wrote into it, so if you'd rather not include them, strip the photo's metadata before attaching it.
Third parties we use
- Receipt scanning runs on our own hardware. Photos are itemized by a vision model we host ourselves — they are never sent to any third-party AI service. (A Claude API fallback exists in the code but is disabled unless we explicitly enable it; this policy will be updated first if that ever changes.)
- Frankfurter/ECB: currency codes only, to fetch daily exchange rates. No user data is sent.
- Google and Apple, only if you choose to sign in with them: they tell us an email address and an account identifier. Signing in with Apple lets you hide your real address behind Apple's private relay, and that works fine here.
- Expo push service, only if you turn on notifications: delivers the notification to your device. It receives the device token and the text of the notification (for example "Dave added an expense"), not your account data.
- Splitwise, only if you choose to import from it: you paste a Splitwise API key, we use it to read the group history you asked to import, and we don't keep the key afterwards.
Where your data lives
On our server hosted for electricrv.ca, with encrypted transport (HTTPS), hashed credentials, and nightly backups retained for 30 days.
Your rights
Under PIPEDA you may access, export, correct, or delete your personal information at any time. CSV export is built in — open a group on the web app and choose Export CSV. (There is no Profile → Export; this page said so, and it was wrong.) Deleting your account removes your personal data; your share of historical group expenses is anonymized so other members' balances stay correct.
Contact
Privacy questions: info@electricrv.ca.