Privacy policy

Last updated 3 August 2026

Tip Tip Hooray! processes gratuity on behalf of venues and the people who work in them. That puts us in the middle of somebody's income, so this page tries to be specific rather than reassuring.

Who this covers

Three different kinds of person use this service, and we hold very different amounts of data about each.

• Guests — someone who scans a code and leaves a tip. We hold almost nothing about you. See "Guests and anonymous identities" below.
• Earners — staff, contractors, and performers who receive tips. We hold what is needed to pay you and to report what you were paid.
• Venues — businesses that collect gratuity through us, and their managers and administrators.

Guests and anonymous identities

To leave a tip you do not create an account, choose a password, or give us your name. Your browser generates a random device identifier and exchanges it for a short-lived credential so the payment can be authenticated. That identifier is random, is not derived from your device's hardware, and tells us nothing about who or where you are.

We store, for each tip you leave:

• the amount, the venue, and which code you scanned;
• a payment-processor reference — never your card number;
• a message or rating, if you chose to leave one;
• your name and email only if you asked for a receipt;
• the network address of the request, for fraud and abuse investigation.

Anonymous identities that never resulted in a tip are deleted on a rolling schedule. Ones attached to a tip are retained, because they are part of a payment record. If you later sign in with an email address, you can link the two so your own receipts are visible to you.

Earners

To pay you and to report correctly, we hold:

• your name, and separately the display name guests see;
• contact details, and a photo if you upload one;
• your role, the venues you work in, and shifts recorded against you;
• your taxpayer identification number, encrypted at rest — only the last four digits are ever displayed, including to your venue;
• a bank account reference obtained through Plaid, plus the bank's name and the last four digits. We never receive or store a full account number, a routing number, or your online-banking credentials. A copy of our database could not move a dollar of your money;
• every tip routed to you, every pool share allocated to you, and every payout sent.

Venues

Business name and legal name, address and contact details, EIN (encrypted at rest), payout configuration, and the payment-processor account reference. For each administrator, the same identity records as any other user.

What we never store

• Card numbers, expiry dates, or security codes. Payment details go directly to our processor and never touch our servers.
• Full bank account or routing numbers.
• Online-banking usernames or passwords.
• Passwords of any kind — sign-in is a one-time emailed code, so there is no password to leak.
• Location data. We do not track where a guest was when they tipped, beyond the venue whose code they scanned.

Who sees what

Access is enforced per record, not per page. Concretely:

• An earner sees their own tips, shifts, pool shares, payouts, and tax documents — not a colleague's.
• A manager sees the venue's tips and staff, but cannot send payouts or link bank accounts unless separately granted that authority.
• A venue sees that an earner has a verified bank account and its last four digits. It cannot see the number and cannot change it.
• Guests are never shown other guests' tips, and an earner is never shown a guest's payment details.

Actions that move money or change who receives it — closing a pool, adjusting hours, sending a payout, granting a role — are recorded in an append-only log with the actor, the time, and the amount. Corrections are new entries; existing entries are never rewritten.

Who we share with

We do not sell personal information, and we do not share it for advertising. We use these processors:

• Payment processing — to charge cards and originate ACH transfers.
• Plaid — to verify bank accounts you choose to link.
• Amazon Web Services — hosting and storage, in the United States.
• Email delivery — sign-in codes, receipts, and reports.

We also share what a venue needs to run its own room, as described above, and what the law requires — a lawful subpoena, a tax authority, or a regulator. We will tell you when we are permitted to.

How long we keep things

• Payment and payout records — seven years, to satisfy tax and financial recordkeeping obligations.
• Tax documents — at least four years after filing.
• Audit log entries — seven years, alongside the records they explain.
• Unused anonymous identities — deleted on a rolling schedule, by default after 90 days.
• Everything else — deleted or anonymised when it is no longer needed.

Your choices

You can ask us to show you what we hold, correct it, or delete it. Two honest limits:

• Records of money that actually moved cannot be deleted on request. A payment record is evidence in somebody else's accounts as well as yours.
• Deleting an earner record would orphan payouts already sent and break a tax form already issued. We deactivate instead, and tell you exactly what is retained and why.

Depending on where you live you may have additional rights — access, portability, correction, deletion, and the right not to be discriminated against for exercising them. Write to privacy@tip-tip-hooray.com and we will respond within the period the applicable law requires.

Security

Data is encrypted in transit and at rest. Taxpayer identification numbers and EINs carry an additional layer of application-level encryption, so they are unreadable even to someone holding the database. Sign-in uses one-time codes rather than passwords. Access to production systems is limited and logged.

No system is perfect. If we discover a breach affecting your information we will notify you and the relevant regulators as required, and we will tell you what happened rather than what we would prefer had happened.

Children

This service is not directed at children under 13 and we do not knowingly collect their information. Many venues using it are age-restricted premises.

Changes

If we change this policy materially we will update the date above and notify account holders by email before the change takes effect. We will not quietly widen what we collect.

Contact

privacy@tip-tip-hooray.com for anything on this page, or hello@tip-tip-hooray.com for everything else.