Tab
PRIVACY

Privacy policy

A short, plain-English account of what Tab does and doesn't collect, and what your rights are. This document is a starting template — have a lawyer review it before going live in your jurisdiction.

Effective date: the date you read this. We version this page on GitHub so you can diff any change.

The short version

  • Your wallet's private key is generated on your device and encrypted with your PIN. We never see it.
  • We see your public wallet address, your handle, and the on-chain payments you make through Tab.
  • We do not sell your data, run ads, or share it with brokers.
  • You can wipe your wallet from a device at any time. The on-chain history is permanent — that's how the chain works.

What we collect

  • Account. The handle you claim and the wallet address it resolves to. Optionally an email you provide for invoices or webhook test confirmations.
  • Usage. Server logs (timestamp, IP, request path, response code, user-agent) retained for 30 days for abuse detection and debugging.
  • Transaction metadata. Orders you create through the API, the chains they settled on, and any metadata you attached. We don't see the buyer's identity unless they're also a Tab user.
  • Cookies. One HMAC-signed session cookie when you sign into the dashboard. No third-party trackers.

What we don't collect

  • Private keys, PINs, or anything that could be used to move funds.
  • Browsing behaviour outside Tab — no Google Analytics, no Meta pixel.
  • Phone numbers, government IDs, or social handles unless you explicitly link them.

Where data lives

Server logs and the orders table live in our infrastructure (US regions, encrypted at rest). Your wallet blob lives in your browser's IndexedDB and, if you opt in, in your Google Drive encrypted with a key only you hold.

Your rights

  • Export every record we hold about you — email privacy@thetab.bar.
  • Delete your handle and all server-side records about you. The on-chain history can't be deleted from the chain.
  • If you're in the EU/UK, you have GDPR rights including objection and complaint to a supervisory authority.

Contact

Email privacy@thetab.bar and a human will reply within five business days.