SlyTab Privacy Policy
Last updated: July 27, 2026 · Data controller: Electric RV, Ontario, Canada
SlyTab is a private expense-sharing app made for families and friends. Our privacy position is simple: your data is yours, it stays on our server in Canada, and we never sell it, share it for advertising, or run analytics on it.
What we collect
- Account: your email address, display name, and a hash of your password (we can never see the password itself).
- Expense data: the groups you're in, expenses, splits, settlements, and any notes you enter — visible only to members of the same group.
- Payment handles (optional): an Interac e-Transfer email, PayPal.Me, or Venmo username you choose to save so group members can pay you. SlyTab never processes, holds, or has access to money or banking credentials.
- Receipt photos (optional): stored with the expense, visible only to the group.
- Sign-in identity, if you use it: if you sign in with Google or with Apple, we receive the email address that provider gives us (which may be Apple's private relay address) and store it as your account email, along with an identifier linking the account. We never receive your Google or Apple password.
- Devices you're signed in on: a device label and timestamps, so you can review and revoke sessions from your profile. If you allow notifications, a push token for your device.
What we don't collect
No analytics, no telemetry, no advertising or tracking SDKs, no contact-list access, and no selling or sharing of anything for advertising.
About location
We don't track your location and we never store it. One narrow exception, which happens on your device: when you attach a receipt photo, the app reads the photo's GPS tag (if the photo has one) purely to guess which currency you were spending in. Only the resulting three-letter currency code is sent to us — never the coordinates. The photo itself is uploaded with whatever tags your camera wrote into it, so if you'd rather not include them, strip the photo's metadata before attaching it.
Third parties we use
- Receipt scanning runs on our own hardware. Photos are itemized by a vision model we host ourselves — they are never sent to any third-party AI service. (A Claude API fallback exists in the code but is disabled unless we explicitly enable it; this policy will be updated first if that ever changes.)
- Frankfurter/ECB: currency codes only, to fetch daily exchange rates. No user data is sent.
- Google and Apple, only if you choose to sign in with them: they tell us an email address and an account identifier. Signing in with Apple lets you hide your real address behind Apple's private relay, and that works fine here.
- Expo push service, only if you turn on notifications: delivers the notification to your device. It receives the device token and the text of the notification (for example "Dave added an expense"), not your account data.
- Splitwise, only if you choose to import from it: you paste a Splitwise API key, we use it to read the group history you asked to import, and we don't keep the key afterwards.
Where your data lives
On our server hosted for electricrv.ca, with encrypted transport (HTTPS), hashed credentials, and nightly backups retained for 30 days.
Your rights
Under PIPEDA you may access, export, correct, or delete your personal information at any time. CSV export is built in — open a group on the web app and choose Export CSV. (There is no Profile → Export; this page said so, and it was wrong.) Deleting your account removes your personal data; your share of historical group expenses is anonymized so other members' balances stay correct.
Contact
Privacy questions: info@electricrv.ca.