Tab App privacy
Last updated 21 September 2026
This page covers Tab App, the iOS app. It does not cover the rest of this website, which has its own privacy page.
Who we are
Tab App is made by Triniti Labs, a registered business name of Triniti House Pty Ltd (ABN 30 688 280 882). For anything on this page, write to tabapp@trinitilabs.com.au.
You can use the app without giving us anything
Tab App starts as an account that lives only on your phone. Your tabs sit in a database on the device, nothing is sent to us, and we have no way to see any of it. There is no email address, no password, and no record of you on our servers at all. If that is how you use the app, the rest of this page is about a service you never touch.
Securing your account is what changes that. It asks for an email address and a password so your tabs survive a lost phone and follow you to a new one, and it copies what is already on the device up to our server.
What a secured account holds
- Your email address. It identifies the account and is where a password reset code goes. We do not send marketing to it.
- Your password. Stored only as a hash, using the password hashing built into ASP.NET Core Identity. We cannot read it, and neither can anyone who takes the database.
- Your name, if you give one. Optional, and only used to label you on your own tabs.
- Your profile photo, if you add one. A small JPEG, resized on your phone before it is sent.
- Your tabs. The names of the tabs, the people on them, every entry with its amount and description, and the history of how each entry got to where it is.
The names on a tab are worth calling out. When you add someone to a tab you are typing a name, not inviting a person. Those names are stored with the tab, so a name you type is a name we hold. Nobody is contacted, nothing is sent to them, and they are not looked up against anyone else's account.
What stays on your phone
Your sign-in tokens are kept in the iOS Keychain, not in ordinary app storage. The app also remembers your theme, your display currency, and whether your account is a device-only one. Those three are plain settings, they hold nothing about you, and they never leave the phone. A copy of your tabs also stays on the device so the app works without a connection.
Passwords and resets
A password reset sends a six-digit code to your email address. Only a hash of that code is stored, it expires, and the record is deleted once the password is set or the reset is abandoned. The email itself is delivered by Resend, which handles the sending on our behalf.
Server logs
Sign-in and password reset attempts are counted against the IP address they come from, so that neither can be hammered. Those counts are held in the server's memory for the length of the window and are not written to the database.
Where it is kept
The app's server and its database run on Railway, a hosting provider, and the data is held in the region that account is configured for, which may be outside Australia. Traffic between the app and the server is encrypted in transit.
What we do not do
There are no analytics in the app, no advertising or tracking software, and no third-party software development kits that report back to someone else. We do not sell anything to anyone, and nothing in your tabs is used for any purpose other than showing it back to you. The App Store's own download and crash reporting is Apple's, and is covered by Apple's terms rather than by us.
Deleting your account
In the app, open Settings, then Account, then Delete account. It removes the account, its tabs and its entries from our server, and from every device signed in to it. It cannot be undone and we cannot bring it back.
A device-only account has nothing on our server to delete. Removing the app from your phone removes it.
Getting a copy, a correction, or a deletion
Email tabapp@trinitilabs.com.au and ask. We will tell you what we hold, correct it, or delete it. If you are not satisfied with how we have handled a request, you can raise it with the Office of the Australian Information Commissioner at oaic.gov.au.
Children
Tab App is not aimed at children and we do not knowingly hold information about anyone under 13. If you believe a child has created an account, email us and we will delete it.
Changes
If what the app collects changes, this page changes with it, and the date at the top moves.