Download Start free trial
← Back to home

Privacy Policy

Effective October 2, 2026 · For privacy questions about Tipper, contact [email protected].

The short version

Tipper has no account and no server that collects your data, and the app doesn't send your deliveries, tips or earnings to me unless you choose to email me a log from its Settings. The addresses, tips, offers, locations and wait times the app records are stored in a local database on your phone. The app has no cloud sync. I receive only: payment and license-key information (handled by my payment processor), emails you send me (including any log you choose to send from the app's Settings), routine technical data when the app checks my site for updates, and the website visit data described below.

A few things do leave your phone, and I would rather say them plainly than let you assume otherwise. These are the things the app itself sends off your phone, and when:

The address lookup service comes with your phone, not with Tipper. On most Android phones it is Google Play services and works over the internet, so treat those lookups as going to Google under Google's privacy policy. Details in Third parties below.

What the app records, and where it stays

When you enable Tipper's accessibility service, the app reads information displayed on your screen in the DoorDash Dasher app — store names, restaurant pickup addresses, customer drop-off addresses and customer names as DoorDash shows them, tip and pay amounts, offer details, and DoorDash's wait estimates. If you allow location, it also records your phone's location while you dash; see Location below.

Location. If you allow location, Tipper records where your phone is while you dash, mostly at moments the Dasher app is on screen while Tipper runs in the background: where you were when each offer arrived, where you wait between offers (up to one position a minute while the Dasher app is updating, including while you drive between spots, and starting from your last drop-off or wherever you turned on your dash), and where you were when DoorDash showed a zone wait estimate. If Tipper never sees a wait end, it closes it about an hour later and may record where your phone is at that point. These three — offer, wait and zone positions — come from the last location your phone's location services already have. Offer locations and wait-trail positions are saved with how fast you were moving whenever Tipper could work that out; the spot where a wait ends is kept only if you were stopped, and zone readings carry no speed. If you also turn on "Time & miles per delivery" in Settings (called "California Prop 22" before version 2.1; it works in every state), Tipper asks your phone for live high-accuracy GPS while it sees you on a delivery — from when Tipper sees the order's pickup or drop-off screen until it sees the delivery finished, you get unassigned, or you're back to looking for offers — to add up the miles you drive: it does this with Google Play services' location and, if you allow Physical activity access, its driving-versus-walking detection (without that permission, all movement is counted), shows a notification while it runs (unless Tipper's notifications are blocked or turned off), and saves each delivery's times, miles and base and peak pay, not the route. Those timed deliveries feed what an offer pays per hour, Offer strategy and Where to wait in any state, and, if most of your recent deliveries are in California, the Prop 22 estimate. You can turn the switch on when you first set up Tipper or later in Settings; turning it off applies from your next delivery. All of these are saved only in Tipper's data on your phone, in its automatic backups and in any backup file you export. Google Play services is run by Google under its own privacy policy. You can turn location off in your phone's settings at any time; tip capture keeps working without it.

While capture is on, Tipper also keeps a recon log: a timestamped text copy of each changed Dasher screen it sees, with all of the on-screen text, which includes customer names, addresses, and tip and pay amounts as DoorDash shows them, plus short notes of its own each time it taps open the tip row or saves a tip automatically. It's kept to diagnose capture problems and to help add new features, and it stays on your phone unless you send it. It has no on/off switch of its own; it's written whenever capture is on. The app has no screen for reading it: Settings shows only how big it is, with "Send recon log" and "Clear recon log" buttons. Older parts of the log are compressed. Each time the log fills another 2 MB, compressed parts whose newest entry is more than 12 months old are deleted, and the oldest compressed parts are also deleted if they add up to more than 50 MB (a part can also be lost early if compressing it fails). If the log isn't growing, nothing is deleted, and the two newest parts are never deleted for age, however old they are, so if you stop dashing the log stays until you clear it or uninstall the app. "Clear recon log" erases it; "Clear all data" does not. If you've used "Send recon log" before, the copy the app prepared for sending isn't erased by "Clear recon log."

"Help improve Tipper" in Settings is off unless you turn it on. When it's on, the app keeps a diagnostics log of crashes and of what capture did, with timestamps, durations and miles; a report you send also names your phone model and Android version. It is built to leave out tip and pay amounts, customer names, addresses, store names and locations, though a crash report includes the technical details of the error, which could occasionally contain some of that information. A "Send diagnostics" button also appears. That button opens your share menu with my email address and a report filled in: the log, plus your app version and your phone's make, model and Android version. Nothing is sent unless you send it, and "Clear log" erases it. Turning the switch off stops new entries but keeps what is already logged, and hides both buttons until you turn it back on.

All of it is stored on your device, in the app's own storage. The app doesn't upload any of it to Tipper, sync it to an account, or share it with anyone, except as listed in the short version above and anything you choose to send me yourself. From version 1.2.6, the data Tipper keeps inside the app is excluded from Android's automatic backup and from phone-to-phone transfer, so Android doesn't copy it to your Google account. Earlier versions allowed Android's backup, so if you used one with your phone's backup turned on, Android may have copied Tipper's data to your Google account back then. Version 1.2.6 stops new copies but doesn't delete old ones, which may stay in your Google account until Google removes them; you can delete them in your Google account's backup settings. Uninstalling the app deletes the data it keeps in its own storage on your phone (export first if you want to keep it). Unless you send it to me yourself, the data never reaches me, so I cannot access, recover, sell, or disclose it.

Automatic backups. When you open the app and a day has passed since the last one, Tipper saves a full copy of your recorded data (deliveries, offers, waits, zones) as a backup file on your phone, keeping the last three (it skips this while no deliveries are recorded). Each copy includes customer names, addresses, tips, pay and location history. The backups and the recon log are kept in Tipper's folder in your phone's storage; on Android 10 and older, or over a USB connection, they may be reachable outside the app. Uninstalling Tipper removes them, but proof photos and any backup files you exported stay.

Proof photos you take in the app are saved to your phone's gallery (in a Pictures/Tipper folder on Android 10 and later), with the date and time printed on the image, plus the GPS coordinates and street address when they're available. The time, and the coordinates when a location is available, are also saved in the photo's details. Photos in your gallery are backed up or transferred like any other photo. "Clear all data" doesn't remove them, so delete them from your photos if you want them gone. Export in Settings saves a backup file, with customer names and addresses in it, wherever you choose.

What I actually receive

I do not run ads, embed third-party trackers in the app, or sell any data.

Website analytics

This website — not the app — uses Cloudflare Web Analytics to count page views and see which sites link to it. It is cookieless: it sets no cookies, stores nothing on your device, does not fingerprint you, does not track you across other websites, and does not build a profile of you. I see totals — pages viewed, referring site, country, device type — never individuals. Because no cookies or personal data are involved, there's no consent banner to click.

The app itself contains no analytics of any kind. Your deliveries, tips, locations and earnings are never measured, profiled, or reported back to me by the app. They stay on your phone, apart from the exceptions described above.

Third parties

My host and analytics provider (Cloudflare) and my payment processor (Lemon Squeezy) handle data as described in their own policies. The app shows map tiles from OpenStreetMap; loading tiles exposes your IP address, the map area requested and the app's ID and version number to the tile server. If you enter a license key, the app also sends it to Lemon Squeezy, as described in the short version above; nothing about your deliveries is included. Email sent to [email protected], including any log you send, is forwarded by Cloudflare Email Routing to my inbox.

Address lookups (geocoding). To show a delivery on a map, the app needs coordinates, and it gets them by asking Android's built-in geocoder to resolve the address. That service comes with your phone, not with Tipper: on most phones it is provided by Google Play services, and the lookup goes over the internet, so the address text is sent to Google and handled under Google's privacy policy. This applies to the delivery addresses the app has recorded, which are looked up when you open the Tip map, and to addresses you type when you log a delivery by hand. The app sends the address text, with no name and no tip or pay amount. Once a recorded address has been found, its result is stored on your phone so it is not looked up again; one that isn't found is tried again the next time you open the Tip map. If your phone has no geocoding service or is offline, the lookup simply returns nothing and the rest of the app carries on. When you take a proof photo with location allowed, the app also asks the same service to turn your phone's last known location into the street address it stamps on the photo.

Location services. The app reads your location from your phone's own location services, and "Time & miles per delivery", when you turn it on, asks Google Play services for live high-accuracy GPS and, if you allow Physical activity access, uses its driving-versus-walking detection; see Location above. Apart from the proof-photo lookup above and the map area you view, the app doesn't send your location anywhere, but what those location services do on their side is outside Tipper's code.

Your choices

You can turn capture and location off at any time in your phone's settings, and the "Time & miles per delivery" switch in the app's Settings is off unless you turn it on (turning it off applies from your next delivery). The app's Settings also has "Clear recon log" and "Clear all data." Clear all data asks you to confirm, then erases your delivery history, tips, addresses, and wait and offer data; your settings and drawn zones stay. It does not erase the recon log (which contains customer names and addresses), the diagnostics log, the automatic backups (which still contain the cleared data and can restore it; they are replaced one at a time, and the last of them only after you've recorded new deliveries and three more daily backups have run, each on a later day you open Tipper), backup files you exported, any copy of the recon log prepared for sending, the map pictures Tipper has saved for areas you viewed, or your proof photos. Clear the logs with their own buttons. Uninstalling Tipper removes the recon log, diagnostics log, automatic backups and saved map pictures, but proof photos stay in your gallery until you delete them. Cancel your subscription anytime; your on-device data is unaffected. To delete what I hold about you (name, email, subscription record, correspondence, including any logs you've sent me), email [email protected]. Payment records are retained as required for tax and accounting.

Children

Tipper is for working delivery drivers and is not directed at children under 18.

Changes

If this policy changes materially, I'll post the new version here and note it in the app's release notes.