Privacy policy

Last updated November 4, 2026

This policy explains how HarborWorks ("we", "us"), the maker of Tabitat, handles information when you use the Tabitat apps and tabitat.app (together, "Tabitat").

What we collect

• Account details: your first name, and the phone number or email address you sign in with. If you use Sign in with Apple or Google, we receive an account ID from them, and your name and email if you share them.
• What you add: your home's name, the roommates you add, expenses, bills, splits, payments you mark or confirm, notes, and any receipt photos you choose to attach.
• Payment usernames: the Venmo, Cash App or Zelle details you enter, so your roommates' Pay buttons work. We never receive or store bank, card or payment-app passwords.
• Device information: a notification token if you allow notifications, the device name and platform you sign in on, and your notification settings.
• Usage: basic events about how Tabitat is used, such as "expense added" or "request page viewed", to keep it working and improve it. These stay with us. We don't use third-party advertising or tracking tools.

What we don't collect

No bank or card numbers, no payment-app logins, no contacts list, no location, and no receipt text sent to us for scanning: receipts are read on your phone with Apple's or Google's built-in text recognition.

How we use it

• To run Tabitat: work out shares and balances, post recurring bills, make statements, and show your home's activity.
• To sign you in, by sending a one-time code by text or email.
• To send notifications and reminders you've allowed, respecting quiet hours and your settings.
• To keep Tabitat secure, prevent abuse, and fix problems.

Who can see it

• People in your home see what's shared in that home: names, expenses, bills, payments, statements and payment usernames.
• Anyone with a request link sees the requester's and recipient's first names, the amount and its breakdown. Links are long and random, and show nothing else.
• Our service providers process data for us to run Tabitat: Amazon Web Services (hosting, storage, email and text messages, in the United States), Expo (delivering notifications to Apple and Google), and Apple and Google (sign-in, if you use it). They may use it only to provide their service to us.
• Support staff at HarborWorks can look up an account to help you, for example to restore access. Every staff action is logged.
• If required by law, we may disclose information to comply with a valid legal request.

How long we keep it

We keep your information while your account is open. When you delete your account, we remove your name, phone number, email, payment usernames and sign-in methods. Shared expenses and payments stay in your former home's history so the other members' balances still add up, labeled "Former member". Database backups are kept for up to 35 days before they're erased.

Your choices

• Export: in Settings, download everything Tabitat holds about you, or your home's year as a spreadsheet.
• Delete: in Settings, choose Delete my account.
• Notifications: choose which ones you get, and set quiet hours, in Settings.
• Questions or requests about your data: email support@tabitat.app.

Security

Data is encrypted in transit and at rest. Sign-in codes expire after 10 minutes and are never stored in readable form. You can lock the app with Face ID or your passcode. No system is perfectly secure, so please tell us right away if you think your account has been misused.

Children

Tabitat is for adults managing a shared home. It isn't meant for anyone under 18, and we don't knowingly collect information from children.

Changes

If we change this policy in a meaningful way, we'll tell you in the app before the change takes effect.

Contact

HarborWorks · support@tabitat.app