App privacy policy
Updated . This covers the Tillslip app for Android. The website and its launch list have their own notice.
Who we are
Tillslip is made by Work Betta Ltd, registered in England and Wales, company 17542754, registered office 20 Wenlock Road, London N1 7GU. It’s the controller for anything this policy says we handle, which is very little: Tillslip has no account and no server. Questions, or to use your rights: hello@tillslip.co.uk.
Your receipts stay on your phone
Tillslip reads your receipts on your phone. The text recognition, the sorting and, where your phone has it, Google’s on-device AI (Gemini Nano) all run there. Your receipt photos, what’s read from them, your categories, notes, mileage trips and settings are never sent to us.
The camera scanner is part of Google Play services on your phone. If you set up a receipt inbox, Tillslip opens your own email app with the photos attached, and you send it.
Sync and backup to your Google Drive
This is off until you turn it on, in Settings › Sync and backup. Then you choose a Google account, and Tillslip copies your records and receipt photos to it, so you can get them back on a new phone.
Tillslip asks Google only for its own hidden app-data folder in your Drive (the drive.appdata permission). It can’t see your other files, and the folder doesn’t show among them. Google keeps the copy in your account, under Google’s privacy policy; we can’t reach it. Google Play services holds the sign-in on your phone, and Tillslip keeps only a scrambled form (a hash) of the account’s email address, on the phone, to tell accounts apart.
To stop, turn off Sync with Google Drive. That stops the copying and takes back Tillslip’s access to your Drive. The copy already there stays until you remove it: use Delete all my data (below), or on a computer go to drive.google.com, then Settings › Manage apps › Options next to Tillslip, and delete its hidden app data.
Android’s own backup
If Android’s backup is on, Android may copy Tillslip’s records and settings, not the photos, to your Google account. Tillslip allows this only when Android encrypts the backup end to end with your phone’s screen lock; on a phone that can’t, Tillslip’s data is left out. This is Android’s service, run by Google, and you can turn it off in your phone’s backup settings. Moving straight from one phone to another can bring the photos too; that copy goes nowhere else.
The app lock
You can lock Tillslip with your phone’s screen lock, in Settings › Your data. It then asks for your fingerprint, a face unlock your phone rates as secure, or your screen lock’s PIN, pattern or password when you open it, and again after you’ve been away for a minute, and hides your receipts in the recent apps view; on Android 10 to 12 it also stops screenshots of the app. Android checks your fingerprint, face or screen lock and tells Tillslip only whether it matched.
Deleting your data
Your records stay until you delete them. Settings › Your data › Delete all my data removes every receipt, photo and trip from your phone and, if the phone has ever synced, from your Drive, even with sync off since; it also takes back Tillslip’s access to your Drive. If your Drive can’t be reached, Tillslip says so, clears the phone only, and tells you how to remove the Drive copy yourself.
If Android’s own backup is on, your Google account keeps its copy of your records until Android next backs up, usually overnight, when an empty one replaces it. Leave Tillslip installed until then. Uninstalling clears the phone, but not your Drive copy or Android’s backup.
Usage counts
When you set up Tillslip, it asks whether to send anonymous usage counts. It’s your choice, the app works the same either way, and you can change your answer in Settings › Privacy and usage. If you say yes, the counts are how often things happen, such as a receipt filed or an export made, and which version of Tillslip and of Android you have: never amounts, shops, dates, anything you type, photos, or anything that says who you are. They’re for TelemetryDeck, which counts them for us. Our reason is your consent.
Not sent yet: this version of Tillslip sends nothing, whatever you answer; your answer is kept for when it can. See what’s sent, in the same place, shows the report exactly as it would leave your phone. We’ll update this policy before anything is sent.
Payments
Not active yet: Tillslip doesn’t take payments today. When subscriptions start, Google Play will take the payment, and we won’t see your card details. RevenueCat, which manages subscriptions for us, will keep a record of your purchases under an anonymous ID, so the app knows your plan. You’ll be able to email us to have that record deleted. We’ll update this policy before payments start.
Emailing us
If you email hello@tillslip.co.uk, we use your address and message only to answer you, and keep them no longer than we need to.
Your rights
Under UK data protection law (UK GDPR) you can ask for a copy of what we hold about you, ask us to correct or delete it, object to how we use it, and withdraw your consent at any time. Almost everything is on your phone, so you can export or delete it yourself in the app; for anything else, email hello@tillslip.co.uk. If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office.
Children
Tillslip is for adults keeping their own tax records. It isn’t meant for anyone under 18.
Changes
If this policy changes, so does the date at the top.