The short version
The free local app works without an account. Receipt photos, guest names, check details, and payment handles stay on your device unless you publish a live check. Pro adds an organizer account, a server copy of the structured check, and a private copy of its attached receipt image so the organizer can recover the check on another signed-in Pro device. Guests can use the live itemized check but never receive the receipt image. We do not sell this data or use it for advertising.
Information on your device
Stiffed stores check names, guest names, line items, prices, tax, tip, claims, paid status, saved payment details, and receipt photos on your device. It uses that information to calculate shares, preserve local history, prepare payment instructions, and show what remains unresolved.
Camera, photos, and receipt recognition
Camera and photo access are used only when you choose a receipt image. Recognition runs on your device. A local check does not upload the receipt image or recognized text. When a signed-in Pro organizer publishes a check, Stiffed uploads its attached receipt image to private storage for organizer-only recovery. Guests receive the itemized check, not the image. A camera capture may also be saved to your Photos library as a separate backup that follows your photo service’s settings.
Live checks and links
A live check uses one QR code or join link for the intended table. Anyone who has that link can see the structured check, choose an existing guest, or add a guest while sharing is open. After choosing a name, that browser or app receives a session scoped to that guest and check so it can claim items, see its total, and use the organizer’s listed payment options. Treat the link like an invitation to the group. It stops working after the organizer stops sharing or deletes the check.
Notifications
If you allow notifications, Stiffed sends the device’s push token and an app-installation identifier to our server. It binds that device only after an organizer signs in or a guest explicitly chooses or adds their identity for one check. Browser-only guests are not registered for native push.
Reminder notifications identify the check and the next action. They do not contain receipt lines, totals, payment destinations, contact details, invitation links, or session credentials. Apple Push Notification service or Firebase Cloud Messaging delivers them. You can turn notifications off in system settings without losing local checks or live participation.
Information stored when you publish
- Your account identifier and sign-in provider.
- The published check, including its name, guests, items, claims, totals, lock state, payment status, and any payment destination the organizer chooses to include.
- The receipt image attached to a published check, if one exists. It is available only to the signed-in organizer and is not included in guest responses.
- A hashed join token, guest sessions, and a short-lived route-specific digest derived from connection information to prevent abuse and enforce rate limits.
- Native push tokens, installation identifiers, the organizer or guest/check binding you authorized, and delivery status when notifications are enabled.
- Security events such as corrections, locking, and payment-status changes.
- Verified Pro status and a store transaction reference. Stiffed does not receive your card or bank login.
This data is used to host the check, keep simultaneous claims current, recover published checks, restore Pro, send enabled check reminders without duplicating them, limit abuse, and answer support requests.
Services and people who receive data
Neon hosts Stiffed’s database, account service, live-check functions, and private receipt-image storage in AWS us-east-2. Apple or Google handles sign-in and the Pro purchase on its platform. Apple Push Notification service or Firebase Cloud Messaging delivers native reminders when you allow them. Proton Mail receives support messages. Invitees see the dinner data for the check whose link they received, but not its receipt image. Messaging and payment apps receive only what you choose to send to them.
Retention and deletion
Local checks and receipt images stay on your device until you delete the check or remove the app. A copy saved to Photos or a device backup follows that service’s rules.
Published checks and their private receipt images remain online until you stop sharing, delete the check, or complete account deletion. Guest sessions expire after 7 days of inactivity. Rate-limit digests remain for up to 7 days, and security and push-delivery records remain for 90 days. Invalid push tokens are disabled immediately and deleted after 90 days; installations with no authorized organizer or guest/check binding are removed by lifecycle cleanup. An account deletion request has a 30-day recovery window. After the purge, Stiffed keeps a minimal deletion record for 90 days, and provider backups can lag by up to 1 day. Support mail is retained for up to 24 months after a ticket closes.
You can use Stop sharing to remove the online copy and keep the local check. You can also delete the full check, or delete your account in the app. Email support@stiffed.app if you cannot access the app.
Children and security
Stiffed is not directed to children under 13. Organizer accounts and live checks are for people 18 or older. Invitations are hashed after issue, guest sessions are scoped to one check, and connections use HTTPS. No service can promise perfect security. We will notify affected account holders if required after a breach.
Your rights and contact
Depending on where you live, you may have rights to access, correct, delete, or export personal information. Email support@stiffed.app. We may need to verify that the request comes from the account holder. Material changes will appear here with a new effective date.
Creative Lid LLC