← Back to home

Privacy Policy

Effective July 2026 · For privacy questions about Tipper, contact [email protected].

The short version

Tipper has no server, and I never see your delivery data. Everything the app records — addresses, tips, offers, locations, wait times — is stored in a local database on your phone. Your delivery history, tips and earnings are never uploaded anywhere. I receive only: payment information (handled by my payment processor), emails you send me, and routine technical data when the app checks my site for updates.

One thing does leave your phone, and I would rather say it plainly than let you assume otherwise: to put an address on a map, the app hands that address to your phone's built-in geocoding service, which on most Android phones is Google Play services and does the lookup over the internet. It is the same mechanism any app uses to turn an address into a pin. It sends the address text only, carries no account or identity from Tipper, and the result is cached on your phone so a given address is looked up once. Details in Third parties below.

What the app records, and where it stays

When you enable Tipper's accessibility service, the app reads information displayed on your screen in the DoorDash Dasher app — store names, restaurant pickup addresses, customer drop-off addresses and first names, tip and pay amounts, offer details, and DoorDash's wait estimates. With your separate permission, it also records your device's location while you dash, and a diagnostic log of Dasher screen layouts used to keep capture working (viewable and erasable in Settings).

All of it is stored only on your device, in the app's private storage, along with the app's automatic local backups. None of it is uploaded to Tipper, synced to an account, or shared with anyone, with the single exception of the address lookups described above. Uninstalling the app deletes its data (export first if you want to keep it). Because the data never reaches me, I cannot access, recover, sell, or disclose it.

What I actually receive

• Purchases. Subscriptions are processed by Lemon Squeezy, which collects your name, email, and payment details under its own privacy policy; I see your name, email, and subscription status — never your full card number.
• Update checks. The app periodically fetches a small version file from my website. Like any web request, this exposes your IP address and app version to my host. No delivery data is included — ever.
• Website visits & email. Standard web-server logs, cookieless visit analytics on this website (described below), and any correspondence you send to support.

I do not run ads, embed third-party trackers in the app, or sell any data.

Website analytics

This website — not the app — uses Cloudflare Web Analytics to count page views and see which sites link to the site, so I can tell whether anyone is actually finding Tipper. It is cookieless: it sets no cookies, stores nothing on your device, does not fingerprint you, does not track you across other websites, and does not build a profile of you. I see totals — pages viewed, referring site, country, device type — never individuals. Because no cookies or personal data are involved, there's no consent banner to click.

The app itself contains no analytics of any kind. Your deliveries, tips, locations and earnings are never measured, profiled, or reported back to me. They stay on your phone, as described above.

Third parties

My host and analytics provider (Cloudflare) and my payment processor (Lemon Squeezy) handle data as described in their own policies. The app shows map tiles from OpenStreetMap; loading tiles exposes your IP and the map area requested to the tile server, like any map app.

Address lookups (geocoding). To show a delivery on a map, the app needs coordinates, and it gets them by asking Android's built-in geocoder to resolve the address. That service is not part of the core Android system: on most phones it is provided by Google Play services, and the lookup goes over the internet, so the address text is sent to Google and handled under Google's privacy policy. This applies to the delivery addresses the app has recorded. What is sent is the address text alone, with no name, no tip or pay amount, and nothing identifying you or Tipper; each result is stored on your phone so the same address is not looked up again. If your phone has no geocoding service or is offline, the lookup simply returns nothing and the rest of the app carries on.

Your choices

Capture, location, and the diagnostic screen log are all controlled in the app's Settings — including a one-tap "Clear captured data." Cancel your subscription anytime; your on-device data is unaffected. To delete what I hold about you (name, email, subscription record, correspondence), email [email protected]. Payment records are retained as required for tax and accounting.

Children

Tipper is for working delivery drivers and is not directed at children under 18.

Changes

If this policy changes materially, I'll post the new version here and note it in the app's release notes.