Effective July 13, 2026
TipJar is built on a simple idea: your money is your business. This policy describes what the app does — and mostly, what it deliberately doesn't do.
Every shift you log — tips, hours, sales, notes, jobs, goals — is stored locally on your iPhone using Apple's on-device database. We do not operate servers that receive, store, or process your shift data. We cannot see your data, and neither can anyone else through us.
TipJar has no sign-up, no login, and no passwords. We do not collect your name, email address, phone number, or any other identifying information.
TipJar shows no advertising inside the app, and we never sell or share your data with data brokers.
We run ads for TipJar on services like Apple Search Ads, Meta, and TikTok, and to know whether they actually work, we measure which ones led to an install. This is handled by AppsFlyer, an attribution provider, and on iOS it can use your device's advertising identifier (IDFA). Because that counts as tracking under Apple's rules, TipJar asks your permission first with the standard App Tracking Transparency prompt. If you decline, no advertising identifier is used and attribution falls back to Apple's privacy-preserving signals. Either way, this only ever concerns how you arrived at TipJar — never your tips, earnings, sales, or any shift data, which stay private on your device as described above. See AppsFlyer's privacy policy.
So we can see which features people use and where they get stuck — and make the app better — TipJar records anonymous, aggregate usage events, for example: a screen was opened, the paywall was shown, a shift was logged. These events are tied to a random per-install identifier, never to you, and they never include your tip amounts, earnings, sales, job names, notes, or any other shift data (a logged shift is recorded only as a coarse range like "$100–200", never the real figure). This is handled by PostHog, hosted in the European Union. See PostHog's privacy policy. Session replay is off by default; on rare occasions we may briefly enable an anonymized replay (a reconstruction of taps and screens, with typed text masked) for a small sample of sessions to diagnose a specific usability problem.
If the app crashes, TipJar sends an anonymous diagnostic report — your device model, iOS version, and the technical stack trace — to Sentry (European Union) so we can find and fix the bug. Crash reports contain no shift data and no information that identifies you. See Sentry's privacy policy.
If you subscribe to TipJar Pro or buy the lifetime unlock, the payment is processed entirely by Apple through your App Store account. We use RevenueCat, a subscription-management service, to validate purchases; it receives an anonymous purchase receipt and a random app-install identifier — never your name, email, or shift data. See RevenueCat's privacy policy.
If you enable a shift reminder, the notification is scheduled locally on your device. No notification data is sent to us.
If you import a CSV from another app, the file is read on your device and the shifts are stored locally, like everything else.
Delete any shift in the app, or delete the app to remove everything. Because we hold no copies, deletion is immediate and complete.
TipJar is not directed at children under 13 and collects no personal information from anyone.
If this policy changes, the updated version will be posted at this address with a new effective date.
Questions? Email support@tipjarapp.app.