Privacy

Using Tacca requires an account (with an invite code you can also join as a guest, with no email: see “If you join as a guest”). The phone does the maths, so the app works without a connection too, but what you write is copied to our server as soon as there is one: that is what keeps your groups safe even if the phone breaks, and what carries them to the people you share them with.

We collect your email address so you can log in, and the data of your groups in order to sync them. No ads, no profiling, no selling data — this is not a statement of good intentions, it is that no code exists to do it.

The Personal section is optional. Accounts, transactions, budgets, schedules and personal receipts stay on this device and are not synced to our server. A group’s recurring expenses are a different thing: they live in the group and sync like its other expenses (see “What we collect”). CSV is for reading your data; JSON backups can restore it and include personal receipt photos. When exporting or sharing a file, you choose its destination and recipients. Files contain readable data: protect them. Personal backups exclude group receipt photos. Signing out, clearing data or uninstalling the app may erase local data: keep a backup first.

The data controller is IPGS ENERGY SRL, registered at Via Ugo Ojetti 7, 20151 Milano, Italia, VAT number 07006920966.

For any question, or to exercise your rights, write to privacy@usetacca.com. We answer within thirty days, as the European Regulation requires.

Usage statistics, if you accept them, are processed for us by Supabase: see “Usage statistics”.

Before sign-in, the contents you write stay in the database on your phone. The example group is not synced. If you choose optional statistics, only the minimal events described in their section may be sent, including during the introduction; never the contents you write.

Until you sign in and agree to anything, none of the content you write leaves the phone. A few technical requests remain that the app makes on its own and that, like any connection, show the contacted service your IP address: Expo Updates, for app updates; Frankfurter, for exchange rates (only the currencies requested); and, if you grant location permission, Open-Meteo, for the home-screen weather. After sign-in, the ones listed below also start: what is needed to sign you in and to carry your groups to you and to the people you share them with, two small technical logs on our server (see “Technical data on our server”) and — only if you say yes — usage statistics (see “Usage statistics”), which also apply if you have no account.

If you open an invite code without signing up, the app lets you in as a guest: an anonymous user is created on our server, with no email and no password, only a random identifier. It is used to claim your seat in the group, sync it and bring you the group’s alerts, if you grant notification permission. For everything else, what this document says applies to you too.

As a guest you can be in at most two groups; to join a third you have to sign up. If you sign up, the identifier stays the same and so do your groups: there is nothing to transfer. If you don’t sign up and change phone, there is no way to find them again, because there is no email to link you to.

If you have granted notification permission, three days after you join the app schedules on your phone — without going through our server — a reminder that you can sign up. There is only one, and it disappears if you sign up in the meantime.

A guest sign-in has no command to delete it from the app, and we do not delete it ourselves after a period of inactivity: signing out or uninstalling the app does not remove it from the server. If you want it gone, write to privacy@usetacca.com telling us which group you are in and under what name, so we can recognise it: we delete it within thirty days. If you sign up, from then on you can use “Delete your account” like anyone else.

The account serves three purposes: keeping your groups safe beyond this phone, finding them again on another one, and sharing them with other people. To do that we collect:

Syncing is per account, not per group: as soon as there is a connection, every group on this phone is copied to the server, including the ones you have never shared with anyone. There is no switch to keep one out, and we would rather write that here than let you find out.

It is the other side of what the account gives you: if the phone breaks or you replace it, your accounts are still there. What other people can read stays limited to the groups they belong to — a group that is only yours is seen only by you — and that limit is enforced by the database rules, not by the app.

Two photographs can leave this phone, and you choose them both: your profile portrait and a group cover. You pick them from your library — a cover you can also take on the spot — and before they leave, the app shrinks and compresses them here, never sending the original. Your portrait is seen by the people who share a group with you; a cover is seen by whoever is in that group. You can remove them from your profile or the group whenever you like and they go from the server too; delete the account or the group and they go with it.

Receipt photos and recognized text stay on the device. Recognition runs locally using Apple Vision on iOS and Google ML Kit on Android; on Android the model is downloaded by Google Play Services, which sends Google usage and performance metrics, but not the photos or the text read. On iOS 26, if you have turned on Apple Intelligence, the recognized lines — not the photo — are also passed to Apple’s language model running on the phone, to suggest the total, merchant, date and category: no data leaves the device and we do not use Apple’s Private Cloud Compute. These are only suggestions: you review and correct them before creating an expense. Groups sync the confirmed expense details, not the photo or full receipt text. The photo is kept with the draft or expense on this device and is removed when local data is cleared or you sign out. On iPhone, if iCloud Backup is on or you back up to a computer, Tacca’s local data — receipt photos included — is part of your backup, which stays yours: we cannot see it.

If the receipt is an Airbnb or Booking stay confirmation, the photo is not kept, not even on the phone: it is only used to read the property, address, dates and amount, and is discarded as soon as it has been read. The booking code and any PIN on the confirmation are not saved anywhere.

If we ever offer a paid cloud archive, it will be a separate and explicit choice, and this document will be updated before it exists.

The camera reads invitation and payment QR codes, takes group cover photos and photographs receipts. QR codes are read without retaining images; an IBAN or payment link that is read stays on screen while you look at it, and we neither save it nor send it to anyone. If you tap “Paste an IBAN”, we read the phone’s clipboard at that moment and only for that. We never use the microphone.

Your library opens when you choose a profile photo, group cover or receipt: we receive only the selected file. The motion sensor hides amounts when you turn the phone face down; motion data is neither saved nor sent.

Location is optional and is requested only “while using the app”: if you turn it on, when you open the home screen we read where you are to show the temperature and sky under the greeting. The coordinates, rounded to about one kilometre, go to Open-Meteo for the forecast, and the city name comes from your phone’s location service (Apple on iPhone, Google on Android). We don’t save them on our server, they don’t go into expenses and nobody else sees them; we never read location in the background. A stay’s address read from a confirmation is a different thing: to put it on the group’s map, your phone’s location service (Apple on iPhone, Google on Android) turns it into coordinates. It is an address, not your location: on Android the system still asks for location permission to do this, but we don’t read where you are. You can turn it off at any time from Profile or from your phone’s settings.

Some reminders come from time passing — a debt left open, the end-of-month recap — and they are built and scheduled by your phone, without going anywhere.

Alerts about what other people do are a different matter, and it deserves spelling out. If you have an account and grant permission, your phone registers a device token with us, together with platform, language, time zone and quiet-hours preferences. When somebody adds or edits an expense in a group you share, our server writes the text and hands it to Expo, which routes it to Apple (on iPhone) or Google (on Android) for delivery.

Two more reminders come from our server, and they hang on a group’s dates: the day it ends — “you’re back, add the last expenses” — and a few days later, if the accounts are still open. The server prepares them rather than the phone because they have to reach people who have not opened the app in days, and they travel the same road as the other alerts.

A notification’s visible text contains the first name of whoever performed the action, the group name, expense description and amounts. The message also contains an internal technical identifier to open the right screen in the app. Never surnames, never your email address, never an IBAN or a payment handle — because a notification is read on a lock screen, in the hands of whoever picks it up.

We remove the token when you sign out or delete the account; if the app is uninstalled, Expo may later tell us that the device is no longer registered and we then remove it. You can switch off any kind of alert — or all of them — under "Notifications" in "You". With no permission we do not register the token, and Tacca still works in full.

If your account has an email address, we write to you when someone signs in to your account: it is how you notice in time a sign-in you did not make. We do not write for the sign-in that creates the account, nor twice in a day for the same device from the same IP address.

The email contains the technical data our server receives anyway at every sign-in: the IP address and the type of device (the iPhone or Android app, or browser and system), with the time in your phone’s time zone. We do not work out a location from the IP. Resend delivers the email.

The IP and device are kept for thirty days and then deleted automatically. The legal basis is our legitimate interest, and yours, in keeping the account safe (Art. 6(1)(f) GDPR).

Feedback is optional. Every message becomes a numbered ticket: our support team reads it together with your account identifier and email address to handle the request, and can reply from the administration panel. Replies reach you by email, with the ticket number in the subject, and if you reply to that email your reply goes into the same ticket. If you don’t write for 48 hours after one of our replies, the ticket closes by itself and we let you know by email; if you reply later, it reopens. The ticket emails are delivered and received by Resend. If you choose to include diagnostics, check the text before sending: the latest technical messages may contain information you entered in the app.

We use Expo Updates to distribute app updates; its service may receive the technical data needed to select a compatible version. For visual currency conversion, the app queries Frankfurter with the requested currencies only; it does not send groups, expenses or account identifiers, although the network provider may still see ordinary technical request data such as an IP address.

They are optional and off until you say yes. You can choose at the start of the introduction and change your mind in You › Privacy and data. Without consent we collect no events, including retrospectively; Tacca still works.

We collect statistics directly on our Supabase server, without Google Analytics. Only consenting devices are represented.

These events contain no amounts, descriptions, personal categories, names, emails, photos, location or contacts. Profile photos are separate profile data.

Supabase processes this data on our behalf. Infrastructure can receive network data including IP addresses: we do not promise that providers never see them. For abuse prevention we retain a daily IP HMAC for two days, rather than an IP address in events.

When signed in, the server temporarily checks account role and classification to exclude staff, test and demo use. No account identifier is stored in events; dashboard reports contain aggregates.

Consent is optional and can be withdrawn. Switching off stops sending immediately and requests deletion of events linked to this device code. Offline requests stay pending and are retried next time the app enters the foreground. Enabling again uses a new code. Events expire after 90 days, with daily cleanup.

If you have an account, our server (Supabase, in the European Union) keeps two small technical logs. They need no separate consent and are not used to profile you.

Devices. For each installation you sign in on: a random installation identifier, your account, the platform, the phone model (for example “iPhone 16”), app version and build, the system version, the identifier of the update in use, the first and last time it was opened, and the gap between your phone’s clock and our server’s. They help us see which versions are out there — to warn you about or block ones that are too old — and to diagnose date errors. They stay as long as the account exists and are deleted with it; installations we have not seen for 12 months are removed.

Sync rejections. When the server rejects a change: your account, the type of data and of operation, the reason for the rejection, the app version and the date. Never the content of the change. We keep them for 90 days.

The basis is our legitimate interest (art. 6.1.f GDPR) in keeping the service working and secure, diagnosing faults and making sure app versions and the server stay compatible.

There is no anti-bot check in the app: email and password are all it takes to sign in, and abuse is held back by limits on how many attempts our server accepts from the same network address.

On the website, the page for requesting account deletion uses Turnstile, from Cloudflare: an automatic check that tells a person apart from a program. To do this, Cloudflare looks at a few technical signals of the request — not the content of what you write, just things like the IP address and device characteristics — under its Turnstile Privacy Addendum (www.cloudflare.com/turnstile-privacy-policy). It exists to stop anyone from using that page to send codes in bulk to other people's addresses.

This document covers usetacca.com too, where you may well be reading it right now. The site is made of pages written in advance, with no process running behind them. By itself it sets no cookies and loads nothing from anyone else: the only exception is the website’s usage statistics, described below, which start only if you accept them. They are not the app’s statistics, which live on our own server, without Google, and have their own consent (see “Usage statistics”).

When you open the site (if statistics are switched on) a banner offers three choices: Accept, Decline or Choose. Accept and Decline carry the same weight and sit in the same place; Choose opens the panel with the statistics switch. Until you choose, or if you decline, no Google script is loaded and no measurement cookie is saved (Google Consent Mode: every signal stays on “denied”). Your choice stays in your browser, not on our servers, for six months: then we ask you again. You can change it any time from the “Cookies” link at the foot of every page: withdrawing it stops the measurement and deletes the Analytics cookies.

If you accept, we load Google Analytics 4, from Google Ireland Limited, which tells us, in aggregate, how many people visit which pages and on what kind of device. The basis is your consent (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code, following the Italian Data Protection Authority’s guidelines on cookies and other tracking tools). The data may also be transferred to Google LLC in the United States, under the safeguards the Regulation provides: the adequacy decision of the EU-US Data Privacy Framework or, failing that, standard contractual clauses; you can ask us for a copy of the safeguards by writing to privacy@usetacca.com. Inside Analytics the data is kept for the period set in our Google Analytics property, which does not exceed 14 months. We do not use Analytics for advertising or to profile you.

Until 9 October 2026 the site let you leave an email address to find out when Tacca would come out (the “waiting list”); since that day it collects no addresses. Anyone who left one in the past did so on the basis of their own consent (art. 6.1.a GDPR). The addresses already collected sit in a table nobody can read from outside, together with the language the person was reading in and the day they left it; no name, no IP. We use them for nothing else and give them to no one: if and when we send the announcement email, it will be a single one, and right afterwards we delete the address. To ask for deletion sooner, write to privacy@usetacca.com: we do it within thirty days.

We process the data of synced groups to perform the service you asked for (GDPR art. 6.1.b): without it, syncing cannot work.

We process your email address for the same reason: it is how we authenticate you. Voluntary feedback is processed to handle your request and for service security and improvement; where needed, the legal basis is our legitimate interest (GDPR art. 6.1.f).

Some things we process only on the basis of your consent (art. 6.1.a GDPR): the app’s usage statistics and the website’s with Google Analytics, location and notifications (which you give through your phone’s system permission) and, for anyone who left one in the past, the website’s waiting-list address. You can withdraw any consent at any time (art. 7.3 GDPR), from the app or phone settings, from the website banner or by writing to us: withdrawal does not affect what happened before.

Usage statistics, if you accept them, rest on your consent (art. 6.1.a GDPR), which you can withdraw at any time under “You › Privacy and data”. The two technical logs on the server (devices and sync rejections) rest on our legitimate interest (art. 6.1.f) in keeping the service working and secure, diagnosing faults and keeping the app and the server compatible.

Profile and group photos, payment handles and the budget are your own choices and you remove them whenever you like: we process them to perform the service you asked for (art. 6.1.b). Your nickname serves to make you recognisable in groups, and we process it for the same reason. Direct invites rest on our legitimate interest (art. 6.1.f) in making invites work between people who know each other; you can object at any time by turning them off in the notification settings, under “Direct invites”. Friendships rest on the same legitimate interest; you can object by turning off “Accept requests” in “You › Tabmates”, and remove a friend whenever you like.

Giving your email address is mandatory to have an account: without it we cannot sign you in or sync your groups (as a guest you don’t need one). Everything else is optional and Tacca works without it: photos, location, notifications, statistics, feedback, budget and payment handles.

We do not profile you and we make no automated decisions about you.

Synced application data lives on Supabase, hosted on Amazon Web Services infrastructure. The database is configured in the eu-west-1, Ireland region.

Supabase acts as data processor: it processes data on our behalf and on our instructions, never for its own purposes.

Every table is protected by access rules enforced by the database itself: an authenticated person can read only the data of groups they belong to. This is not a check written in the app — which could be bypassed — but in the database.

For sign-in we use Supabase Auth and, if you choose them, Google and Apple; Supabase Auth sends the emailed sign-in codes through Resend. Resend delivers all our service emails: sign-in codes, sign-in alerts, account-deletion receipts, replies to feedback tickets (and it receives your replies) and service notices. For the website’s anti-bot check and to host the website and the administration panel we use Cloudflare; for notifications and updates, Expo and, for push delivery, Apple or Google; for the app’s usage statistics, if you accept them, Supabase; for the website’s, if you accept them, Google Analytics; for the weather, Open-Meteo; for exchange rates, Frankfurter; to read receipts on Android, Google, through Google Play Services, which downloads the recognition model and receives usage and performance metrics (not the photos or the text read).

The database is in the European Union. Some service providers — email (Resend), notifications (Expo, Apple, Google), sign-in with Google and Apple, Cloudflare and, on the website, Google Analytics — may process technical data outside the European Economic Area, under the safeguards the Regulation provides (adequacy decisions such as the EU-US Data Privacy Framework, or standard contractual clauses) and their own terms: so we do not claim an absolute absence of third-country transfers. You can ask us for a copy of the safeguards by writing to privacy@usetacca.com. There is no advertising network in between.

Other people can read only the data of the groups they belong to, and that is enforced by the database rules. On our side, the data can be accessed only by authorised staff of IPGS ENERGY SRL, and only for support, security and running the service.

They do it from an administration panel, hosted on Cloudflare and protected by a sign-in. This is what the panel shows:

The panel does not show the names of your groups, or the descriptions or amounts of individual expenses, or anything you write inside the groups: we do not look at the content of your groups.

Direct access to the database, outside the panel, is reserved to the service’s technical administrators and is used only for maintenance and for fixing faults.

Every consultation of the account directory by staff (an account’s page, the export of the list) and the other actions by administrators in the panel are recorded — who, what, on which account, how many rows — in a log that cannot be edited and is kept for 24 months, then deleted.

The data of a synced group stays as long as the group exists. When deletion from the app succeeds, your profile, email address, device tokens, registered devices and associated feedback are deleted from the server; requests sent by email are handled within the statutory time limits.

Internal statistics events are retained for 90 days, with daily cleanup, or until deletion requested on withdrawal. Withdrawal concerns this device; repeat it on other devices. Technical devices unseen for 12 months are removed; sync rejections are retained for 90 days.

One consequence of working in groups deserves attention: expenses you entered in a shared group stay visible to the other participants after you leave. They are part of their accounting history too, not only yours, and deleting them unilaterally would falsify other people's balances.

Feedback tickets are kept as long as they are needed to handle the request and keep a support history: the automatic closing after 48 hours closes them but does not delete them, and there is currently no separate automatic deletion for these messages.

From "You → Data" you can empty this phone whenever you like, but that is a local clean-up: as long as the account exists your groups are still on the server and come back at the next connection. To delete them for good you have to delete the account, from "You → Profile".

Addresses left in the past on the website’s waiting list are kept until you ask for them to be deleted by writing to privacy@usetacca.com (we do it within thirty days) or until we use them for the one announcement email, after which we delete them.

The IP address and device of a sign-in are kept for thirty days — long enough to send you the alert and not repeat it — and then deleted automatically.

Some technical logs clean themselves up: the notification technical queue (with the alert text and recipient) seven days after sending; a direct invite nobody answers expires after thirty days and can no longer be accepted; the account-deletion request and the data of its receipt (address, language, date) stay until the account is deleted and go with it. The staff access log (see “Who can access the data”) is kept for 24 months.

This list is the most useful part of the document, because it is where apps are usually vague:

Over the data you entrust to us you may exercise the rights in GDPR articles 15-22: know what we hold, obtain a copy, correct it, erase it, restrict processing, object, and take it elsewhere in a readable format. You may also withdraw any consent you have given us at any time (art. 7.3 GDPR), without affecting what happened before.

To exercise them, write to privacy@usetacca.com. For erasure you do not need to ask: it is under "You → Profile → Delete your account", and if you no longer have the app installed you can start it at https://usetacca.com/en/delete-account/: confirm a one-time code sent to your email address, then receive a receipt. The request is irreversible and a scheduled job deletes the account and associated data within thirty days.

When you delete your account, your profile, your nickname, your email address and your devices’ identifiers are gone. In groups you shared with other people your seat stays — a name inside a list of expenses — with no account attached: those expenses are theirs too, and shares already split still have to add up. Groups where nobody else is left are deleted along with the account.

If you believe we are handling your data improperly you may complain to the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or to the authority of the country where you live — for example the CNIL in France or the AEPD in Spain.

To sign up you must be at least 14, the age at which Italian law lets you consent to the processing of your own data in digital services on your own. Below that age, the consent of a parent or guardian is required. Where the law of your country sets a higher age, that one applies.

The example group can be viewed without an account: in that case we ask you for no data and there is no age limit.

If we change anything in a way that matters to you — the data we collect, who receives it, your rights — we write to you by email saying what changes and, the next time you open the app, we ask you to accept the Terms again and to read this notice, which tells you how we handle data and is not a consent. Until you confirm you cannot keep using the app with your account. For small touch-ups that change nothing of substance, such as a typo, we neither write nor ask for anything. We do not treat a change as binding merely because we published it.

Every version carries its date, and the one you agreed to stays recorded on your device and, if you have an account, on our server too, with the date you accepted it and your phone's system (iOS or Android). If you delete your account, this goes too.