Privacy

Draft pending legal review. Nothing here is legal advice.

What we collect

Workers: your email address, the name, job and workplace you enter, your tip link, and your tip, crew and payout records.

Workers taking real tips: Stripe, our payments partner, collects your identity and bank details directly on its own pages. Gratuvo doesn't receive your Social Security number, ID documents or bank account number. We store your Stripe account ID, whether Stripe has approved it, your balance, and your payout amounts and dates.

Guests: no Gratuvo account. Card and wallet details go directly to Stripe and never reach Gratuvo. We store the amount, time and fees of each tip, the card brand, and Stripe's reference numbers. Stripe's own privacy policy covers what it collects from you.

Usage: we count page visits and steps such as opening a tip page, starting a payment, or starting a crew, using PostHog. Workers are linked by their sign-in ID. These counts never include card details, names, email addresses, crew codes or payment reference numbers, and we don't record screens.

What people can see

Anyone with your tip link sees your name, job and workplace. Crew members see each other's names, jobs and shares.

Who processes it

Stripe handles payments and payouts, Clerk handles sign-in, Convex stores app data, PostHog measures usage, and Vercel hosts this site.

Deleting your data

Delete your account from Edit profile in the app. If a crew you belong to is still open, including one you left, you can delete once it closes, which can take up to 24 hours. If you take real tips, you can delete once money has finished moving and your Stripe balance is zero.

Deleting removes your profile and any demo tips and cash-outs. Past crew records keep a row with no name, so other people's payouts still add up. If you recently entered wrong crew codes, we keep a count of those attempts for up to 10 minutes to prevent abuse, then remove it.

What we keep after you delete: records of real payments, refunds, disputes, transfers and payouts, your Stripe account ID, and the sign-in ID linked to them. We need these for tax, accounting, disputes and fraud prevention. We also keep your link name tied to your sign-in ID permanently, so a printed QR code can never start paying someone else. Your Stripe account stays with Stripe under Stripe's own terms.