TarnUpdated Oct 27, 2026

Privacy Policy

Tarn is an iOS app and a website for splitting a bill. One person pays, scans the receipt, assigns the lines to the people who shared it, and sends each of them a text with a link to their share. Tarn is run by Evan Richards, a sole proprietor in Washington State (“we”). This policy says what information Tarn holds, why, who else touches it, and what you can do about it. It covers the Tarn app, tarnit.app, and the pages behind the links in request texts.

Three kinds of people appear in a split. The splitter has an account and runs the split. The people on the split may or may not have an account. A recipient opens a link to a page about their share. Each section says who it is about.

Your account

If you have an account, we hold:

  • Your phone number.You sign in with your phone number and a one-time code sent by text through Clerk, our sign-in provider. We store the number, and a keyed hash of it (see “Phone numbers” below) so that splits you were added to can be connected to you.
  • Your name. The name you type when you sign up. It is the name people see on the pages you send them.
  • A profile image address supplied by Clerk. The app has no photo upload.
  • Your payment usernames for Venmo, Cash App or PayPal, if you add them. We check only that a username is well formed, never that it is yours. They appear as pay links on the pages of the people who owe you.
  • Your session. The app keeps your sign-in session and your account details on your device, in encrypted storage.

Your splits

When you split a bill, Tarn stores:

  • The split: the total you typed, a label if you gave one, the currency (US dollars), and when the split was created, finalized, reopened or discarded.
  • The people on it:the name you gave each person (typed, or taken from your Contacts), their share preset, who is covering whom, who paid, and the adjustments you made. For a person you added with a phone number, a keyed hash of that number and never the number itself (see “Phone numbers”). A person added by name alone has no number stored at all.
  • The receipt, as the app read it:each printed line (its text as printed, a name, quantity, unit price and total), the merchant’s name, address and phone as printed, the receipt’s date and time, the last four digits of the card if the receipt shows them, tax, tip, service charge, fees and discounts, how confident each reading was, which reader produced it, and a fingerprint (a hash) of the image. Not the image itself (see “Receipt images”).
  • Every correction you make to that reading: the field, the value before, the value after, when, and from which device. Corrections are a permanent record. Undoing one adds another; nothing is erased.
  • Claims: which lines, and how many units of each, you assigned to whom, with when and from which device each tap came.
  • Requests: the amount each person owes you (or you owe them) and its history: created, sent, nudged, marked paid and how (Venmo, Cash App, PayPal or cash), settled in cash at the table, or voided when you reopen.
  • One unguessable link per person, created when you finalize, which is what their request text carries.

Your list of recent people is computed from your splits each time you look at it. It is not a stored contact list, and it looks the same whether or not those people use Tarn.

Receipt images

  • The app reads the receipt on your devicewith Apple’s text recognition and checks the lines against the total you typed. Our server receives the reading described above and a fingerprint of the image, and never stores the image. The image reaches our server only in the case below, where it passes through without being kept.
  • When your device cannot make a receipt add up, the app may send that receipt through our server to a receipt-reading service that processes it for us. The service receives the receipt and nothing else: not your name, your number or the names of the people on the split. Our server passes it along and keeps no copy. Which service that is, and whether it receives the image or only the text read from it, is named here before Tarn is released to testers.
  • A receipt carries other people’s details:a merchant’s name, address and phone, your card’s last four digits, sometimes a server’s name. Merchant and item data is never sold, never shared with the merchant, and never used to profile you. It leaves Tarn only as this policy describes: in a receipt sent to the reading service above, and as the split’s label in the note on a Venmo pay link. We never ask for your location.

Phone numbers

This section is about the people a splitter adds, whether or not they use Tarn.

  • Your number is never stored. When a splitter adds you with your phone number, our server turns the number into a keyed hash under a secret kept outside the database and discards the number. The number is never written to a log, a crash report or an error message.
  • What the key is for.It lets one splitter recognize the same person across their own splits, so you are not added twice and they can pick you again. It also connects splits to your account: if you already have an account when you are added, or you sign up with that number within 90 days of being added, the split is connected to you. Splits older than 90 days are not connected. The key stays with the split so the splitter’s recent-people list keeps working.
  • Nothing tells a splitter whether you use Tarn. Adding a number looks the same whether or not an account exists for it. A person connected to an account looks exactly like one who is not, to everyone except that person. The page a recipient opens is identical for users and non-users.
  • The name on a split is the splitter’s.They typed it or took it from their Contacts, and only they can change it. Your account’s name never replaces it.
  • A connected split appears in your own apponce it is finalized. You see your own lines, your share and your request, and never anyone else’s.
  • If you have never signed up and want the key made from your number cleared, email support@tarnit.app.

Contacts and texts

  • Contacts. With your permission, the app shows your Contacts so you can pick people; if you decline, you can still pick one person at a time with the system picker, which hands the app only that person. Your address book stays on your device. For each person you add, the app sends our server their name as it appears in your Contacts and their number, once: the name is stored on the split as the label everyone sees, and the number becomes the key described above and is discarded. The app remembers which contact you picked so it can address the text later.
  • Texts.Tarn never sends messages. When you send a request, the app opens your phone’s Messages app (or the share sheet) with the text filled in: the person’s name as you wrote it, the amount, the split’s label and their link. You tap Send, and the text goes from your phone and your number. The number it goes to is read on your device and is not sent to our server. We record that you sent it and when, not its contents or who received it.
  • Notifications. This version of Tarn sends no notifications and never asks for notification permission. If that changes, this policy will say what a device token is used for.

Pages behind the links

This section is about the page a request text links to.

  • What the page shows:the split’s label (usually the merchant) and date, the splitter’s name, what the splitter paid in total and how many people the shares were computed over, the receipt’s printed subtotal, tax, tip, service charge, fees and discounts, your lines with their units and amounts, your total and what the splitter asks you to pay (or owes you back), the names of anyone you are covering, every line of the receipt without who had what, and the splitter’s pay links with the amount filled in. It does not say whether anyone has paid, and it never shows another person’s share, anyone’s phone number, the receipt’s raw text, card digits, or the merchant’s address and phone.
  • The link is the key. Anyone who has it can open the page. There is no sign-in, and the page is the same whether or not you have an account. Keep the link to yourself. A link shows nothing until the split is finalized, and a link we do not recognize shows nothing either. The pages ask search engines not to index them. If a link of yours has spread beyond you, email support@tarnit.app.
  • A group link.A splitter texting one thread may send a single link for the whole split instead. It opens a page of names, as the splitter wrote them, and anyone holding it can open each person’s page by tapping their name. It is meant for a thread where everyone shared the bill.
  • Nothing about you is stored. Opening a page puts nothing on your device: no cookies and no local storage. Our server counts one anonymous view per page and one anonymous click on the TestFlight invitation, each with a hashed split id and a fresh random identifier that links to nothing else. No address, device, browser or link is recorded with them. The link preview Messages shows is the same for every link and carries no amounts or names.
  • Guessing is limited. To stop someone trying links at random, our server limits how often one network address or one link can be loaded. The count lives in memory for five minutes and nothing is stored.
  • The report linkopens your own mail app addressed to support@tarnit.app, with the page’s identifier in the subject and the page’s address in the body so we can find the split. Nothing is sent until you send it. We use your email address and message only to act on the report and reply to you, delete the mail within 90 days of closing the report, and never copy it into Tarn’s database.

Blocking

If you have an account and are on a finalized split, you can block its splitter. Their splits then stop connecting to your account and disappear from your app. Nothing changes for them, and nothing tells them. You see your blocks as a list, each named by that splitter’s name on the split you blocked them from, and you can lift one at any time. Your blocks are deleted with your account; a block someone made against you stays.

Diagnostics and analytics

  • Crash and error reports (Sentry).If the app or our server hits an error, we receive the error, the device model and operating system version, the app version, and on the server the request’s method, path (with any link identifier replaced by a marker) and status. Never a name, a phone number, what you typed, or your IP address.
  • Usage analytics (PostHog).In the app, we record a few events (sign-up started and completed, name entered) tied to your account’s internal id, with the basic app and system information the analytics library attaches. Never names, phone numbers or anything you typed. On the website, page views are counted without cookies and without storing anything in your browser, with link identifiers removed; your browser sends them to PostHog directly, as it does for any site you load.
  • Server logs. Our server keeps a request log with the method, the path (link identifiers replaced by a marker), the status, the timing and the connecting network address. Request contents and phone numbers are never logged. Our hosting provider keeps these logs for a limited time.

Who else touches your data

We use these companies to run Tarn. Each receives only what its line says.

  • Clerk: sign-in. It holds your phone number and sends the one-time code by text through its text-message delivery partner.
  • Railway: hosts our server and database.
  • Vercel: hosts tarnit.app, including the pages behind the links.
  • Sentry: crash and error reports, as described above.
  • PostHog: usage analytics, as described above.
  • Apple:distributes the app through TestFlight and the App Store. If you install through TestFlight, Apple shares with us the crash logs and the feedback you choose to send, under Apple’s TestFlight terms. Text recognition runs on your device with Apple’s frameworks and sends nothing to Apple.
  • A receipt-reading service,if one is chosen, as described under “Receipt images”.
  • Venmo, Cash App and PayPal:when a recipient taps a pay link, they leave Tarn for that service. The link carries the splitter’s username, the amount and, for Venmo, the split’s label as the note. What happens there is governed by that service’s terms. Tarn never moves money, never holds payment credentials, and never learns whether a payment was made.

We do not sell personal information, show ads, or share data with ad networks. Our providers process data in the United States. We never infer dietary, health, relationship or income facts about anyone from a receipt, and we store no labels about people beyond what the splitter typed.

How long we keep things

  • Splits are kept for as long as Tarn runs, so everyone on them can look up the record. Claims, corrections and request history are permanent records that are never edited or deleted; an undo adds a record.
  • A discarded split (one abandoned before it was finalized) is hidden from your lists and kept.
  • A re-scanned receipt keeps the earlier reading as history.
  • Your personal data goes when you delete your account (next section).
  • During the TestFlight beta, we may reset or delete beta data before the App Store release (see the Terms).

Deleting your account

You can delete your account from the app. When you do:

  • Finish first. Deletion is refused while you have an open split you started. Finalize or discard those splits, then delete.
  • What goes from your account: your name, your phone number and the key made from it, your profile image address, your payment usernames, the blocks you made and any notification tokens are deleted from our database, and your account at Clerk is deleted, so your phone number is gone there too.
  • What stays: the splits you started stay in our records, with your name removed and your claims kept as a nameless guest so the math holds, but the pages behind the links you sent stop working. On splits other people started, the name the splitter gave you and the key made from your number stay with their split, so nothing changes for them; only the connection to your account is removed.

To ask for a copy of your data, a correction, or the clearing of a key made from your number, email support@tarnit.app. We answer within 30 days.

Security

Everything travels over HTTPS. Phone keys use a secret kept outside the database, so the database alone cannot reverse them. Links are 128 bits of randomness. The app keeps your session in your device’s encrypted storage. No system is perfectly secure; if we learn of a breach that affects you, we will tell you.

Children

Tarn is for people 17 and older. We do not knowingly hold information about anyone younger, and Tarn’s App Store age rating reflects this. If you believe someone under 17 has an account, email support@tarnit.app and we will remove it.

Changes

When this policy changes, we update the date at the top. If a change matters to what we hold or who touches it, we say so in the app or on this site.

Contact

Evan Richards, Washington, United States. Questions about this policy or your data: support@tarnit.app.