Privacy Policy for BlendTab

Last updated: 29 September 2026

1. Controller

Markus Radlbrunner
Unterhofkirchen 65, 84416 Taufkirchen
Email: kontakt@blendtab.com

For any question about data protection, a message to this address is enough.

2. What this is about

BlendTab settles expenses between people who pay for something together — a household, a group of friends on holiday, a shared flat. For this, the app processes information you enter yourself, and information about other people that you enter.

What BlendTab does not do: there is no advertising, no tracking, no analysis of usage behaviour, no crash reports and no tracking pixel. The interface loads nothing from third-party servers — no script, no font, no image. This is not a statement of intent; it is enforced by a Content-Security-Policy.

3. What data is processed

3.1 For your account

The password is never stored in plain text, but as a scrypt hash with its own random salt. Of your session, only a sha256 hash is kept on the server, not the session token itself.

3.2 For settling expenses

The IBAN is optional. Without it, everything works except the transfer code. It is only visible to people you share a group with — never to all users.

Of the PIN, only a scrypt hash is kept on the server. It protects your personal area against flatmates, not against the provider: whoever has control of the server can see the data.

3.3 Data about other people

When you share an expense with others, you enter their names, in some cases their IBAN, and a receipt may contain information that does not concern you. You are jointly responsible for these entries. Only enter what the person concerned knows about and wants entered — and do not upload receipts that show third-party information unrelated to the shared expense.

3.4 What is expressly not collected

Location, address book, phone number, date of birth, device identifiers, advertising IDs, crash reports, usage statistics. The server logs no IP addresses and no page views.

3.5 Language of the landing page

When you open the landing page, the server briefly compares your IP address against a table stored locally on the server to suggest German or English — visits from Germany, Austria and Switzerland in German, all others in English. The address never leaves the server, is not stored and is not logged: what remains from the comparison is only a country code for this one response, not the IP address itself afterwards. Legal basis is Art. 6(1)(f) GDPR — the legitimate interest in showing the page in the likely language right away instead of asking everyone first. The underlying country table comes from DB-IP (see the credit in the page footer).

4. Receipt scanning by a third party

When you upload a receipt, BlendTab can read the merchant, date, total and individual line items from it. For this, the image or PDF is transmitted to Anthropic PBC, San Francisco, USA (api.anthropic.com). What comes back is exactly these values.

This only happens with your explicit consent. Before the first receipt, the app asks; without a yes, no receipt leaves our server. Your answer applies to your account — on every device, in every household — and is stored together with the time it was given.

**You will find the option to withdraw consent in the same place as the consent itself:** Account → Receipt scanning. It takes effect immediately and for the future; the lawfulness of processing carried out before that remains unaffected.

Without scanning, the app remains fully usable: the receipt is saved and attached to the expense, and you enter the line items yourself.

Legal basis: Art. 6(1)(a) GDPR (consent). Transfer to a third country: receipts are sent to a service based in the United States. This rests on the data processing agreement with the provider, including the European Commission's Standard Contractual Clauses agreed there, as well as, based on your explicit consent to receipt scanning, Art. 49(1)(a) GDPR. If you do not want this, leave receipt scanning off — the app works fully without it, and nothing is transmitted without your consent.

4a. Notifications on your phone

When you flip the switch under "Notifications" in the app, your phone asks you for permission. Only then does your operating system give you a device token, which is saved to your account — on an iPhone from Apple, on an Android phone from Google. It is tied to this one phone and this one installation of the app; whoever had it could send the app a notification, but could not read anything.

Notifications are only sent in three cases, and always only to people who are entitled to see the content anyway:

• someone else in your household enters an expense,
• someone else settles a balance,
• someone joins a household you invited them into.

The content of a notification is the same you would see in the app: name, expense title, amount, group. It travels over your operating system's own service — on an iPhone via Apple (Apple Push Notification service), on an Android phone via Google (Firebase Cloud Messaging). This is technically unavoidable: on both systems, notifications only travel this one route. With Google, the data is also processed in the USA; the transfer rests on the European Commission's Standard Contractual Clauses. No notification is ever sent for purely personal expenses.

Legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time: in the app under "Notifications" or in your phone's settings. The device token is then deleted immediately. BlendTab remains fully usable without notifications.

5. Recipients

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen — operates the server your data lives on (data processing under Art. 28 GDPR). Data centre location: Germany.
• Anthropic PBC, San Francisco, USA — receipts only, only with your consent, see section 4 (data processing under Art. 28 GDPR).
• Apple (Apple Distribution International Ltd., Cork, Ireland) — delivers push notifications, only if you have enabled them, see section 4a. The device token and the notification text are transmitted.
• Google (Google Ireland Ltd., Dublin, Ireland) — delivers push notifications on Android phones, only if you have enabled them, see section 4a. The device token and the notification text are transmitted. Processing also takes place in the USA; it rests on a data processing agreement under Art. 28 GDPR including Standard Contractual Clauses.
• Scaleway (Scaleway SAS, Paris, France) — sends the messages that belong to your account: confirming your address and resetting your password. For this, your email address is transmitted, nothing else (data processing under Art. 28 GDPR). Scaleway offers no open- or click-tracking for these emails — not even as an option.

There are no other recipients. No data is sold, rented out, or passed on for advertising purposes.

6. How long data is kept

• Account data and expenses: for as long as the account exists.
• Device tokens for notifications: until you turn notifications off, sign out, or Apple or Google report the token as invalid. After 90 days of disuse at the latest.
• Sessions: 90 days without use, after which you need to sign in again.
• Invitation codes: seven days, and each can only be redeemed once. Only their hash is ever stored, never the code itself.
• Receipts without an associated expense are deleted after a grace period.
• Backups: 24 hourly and 14 daily copies per household. A deletion takes effect immediately in the live data; it only disappears from the last few days' backups once those copies expire.

7. If you delete your account

You can delete your account in the app at any time: Account → Delete account, with your password and in two steps. In doing so:

• Your login, your password hash, your sessions, your PIN and your IBAN are removed.
• Your purely personal expenses and fixed costs are removed.
• Shared expenses remain, with your name shown for reference only. They also belong to the other people involved: a shared statement from which an entry disappears afterwards would no longer make sense to them. This rests on Art. 6(1)(f) GDPR — the legitimate interest of the other people involved in a complete statement.

If you additionally want your name removed from shared expenses, write to kontakt@blendtab.com.

8. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw any consent you have given at any time.

Two of these the app handles itself, without you having to write to anyone:

• Access and portability: Account → Your data → Request access. You receive a ZIP file with all data from every household your account belongs to, plus your receipts and an explanation in plain language. It requires your password, because it also includes what is behind your PIN.
• Erasure: Account → Delete account (see section 7).

For everything else: kontakt@blendtab.com.

You can also complain to a data protection supervisory authority, for example the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach — it is responsible for the non-public sector in Bavaria, which covers the provider's place of residence.

9. What stays on your device

BlendTab stores some things locally on your device so the app can be used without a connection: a copy of the current state, an unfinished draft, the chosen view, the theme, and your login session token.

Your PIN is explicitly not among these. It is entered once and unlocks this session with that; what is saved is the unlock on the server, not the PIN on the device. The unlock only applies to this device and ends as soon as you sign out.

This data belongs to your device, not the server. It disappears when you sign out or clear the site's data.

10. Security

Passwords and PINs are derived with scrypt and their own salt, tokens are only stored as a hash, and login attempts are rate-limited. Response times are kept such that they do not reveal which addresses are registered. Every household has its own data directory. IBANs are additionally stored encrypted on disk (AES-256-GCM), not just access-restricted.

When you set or change a password, your device — not our server — asks haveibeenpwned.com whether it appears in a known data breach. Only a short partial hash of your password leaves your device (five characters of a SHA-1 hash, using the so-called k-anonymity method); that service never learns your password or your address, and we never learn about this request either — it bypasses our server entirely. If the service is unreachable, the password is set anyway; the check is a hint, not a requirement.

11. Changes

If this policy changes materially, you will be notified in the app. If a change affects a consent, it will be obtained again.