In development
Privacy
TipPortion collects nothing. There is no account, no server and no analytics, and the app makes no network requests of its own. What you enter stays in the app's private storage on your iPhone.
What we receive
Nothing. We are not sent your names, your amounts, your nights, your device identifier or any usage statistics, because the app has no way to send them. It contains no analytics library, no advertising identifier and no crash-reporting service of ours.
If you email support, we obviously receive what you choose to write. Please do not send real staff names or real earnings — see Support.
What the app stores on your iPhone
Everything you record is written to the app's own private storage, in the app's container: night names, service dates, the currency, the people's names you type, each portion's cash and card amounts, which people were in each portion, and a revision number and saved timestamp. Files are written with the system's file protection.
Device backups
That storage is part of the normal iPhone backup. If you back your iPhone up, or have iCloud device backup switched on, your saved nights can be included in that backup. That is your setting and Apple's mechanism — TipPortion does not perform it, cannot see it, and does not disable it. We do not claim your records never leave the phone; we claim the app never sends them anywhere itself.
The copy of your previous save
For each night, the app keeps one copy of the save before last, so that a file which later turns out to be damaged can be put back. It is one generation, not a history: it is never listed, never opened on request, and only used when the current file will not read.
Files it could not read
If a saved file cannot be read, the app does not delete it and does not pretend your library is empty. It moves those bytes aside, unchanged, and tells you. Those kept files can still contain the names and amounts that were in them.
The app re-checks for kept files each time it opens and reports what it finds, so a notice does not appear once and vanish. We cannot promise a notice in every possible case: if the system will not let the app list that folder at all, the app reports the failure it hit rather than the contents it could not read. Removing kept files is a deliberate, confirmed action you take; deleting a night removes that night's own kept and recovery copies with it, and if part of that cannot be done the app says so instead of claiming the night is gone.
Sheets waiting to be shared
When you share a sheet, the app writes a PDF or text file into its own private temporary area and hands it to the iOS share sheet.
The app attempts to clear those temporary copies: everything when you next open the app, and older ones when it goes to the background. Clearing is best effort and is not a guaranteed deadline. It happens on those app lifecycle events, not on a timer, and a deletion the system refuses can leave a copy in the app's private temporary area for longer. Nothing about this is secure erasure.
Where a shared copy goes is entirely your choice in the iOS share sheet. Once it has gone — to Messages, Mail, Files, a printer, anywhere — that copy is outside the app, and correcting the night afterwards does not change it. Whatever you sent it through has its own privacy policy, not ours.
Deleting things
- A night: open it, tap Edit, then delete. That removes the night, its previous-save copy and any of its kept-aside bytes. If something cannot be removed, the app tells you what is still there rather than reporting success.
- Kept unreadable files: remove them from the notice on the nights list. Deliberate and confirmed.
- Everything: delete the app. That removes its storage, including saved nights, recovery copies and kept files. Copies you exported and sent elsewhere are not affected — they are yours to manage.
- Backups: if a device backup already includes your saved nights, deleting the app does not reach into that backup. Manage backups in iOS Settings.
Permissions the app does not ask for
No contacts, no photos, no camera, no microphone, no location, no calendar, no notifications, no health data and no advertising permission. The app does not read anything outside its own storage. It declares the one required-reason API it uses — reading a file's modification date, to work out which temporary export copies are old enough to clear — in the privacy manifest inside the app.
Children
TipPortion is a work tool for hospitality staff. It is not directed at children and collects no personal information from anyone.
This website
This site is static files served by Cloudflare Pages. It sets no cookies, runs no JavaScript, loads no web font, embeds nothing from a third party and contains no analytics or tracking. The one image is served from this site and is a band cropped out of a PDF the app itself generated. Cloudflare processes the request needed to serve you the page, as any host must.
Changes
If this policy changes in a way that matters, the change goes here and the app's own privacy screen keeps describing what the shipping version actually does. This page was last updated on 6 September 2026.
Questions: support@codedrealities.com.