1. Who we are
TipRiver ("we", "us") operates a platform for direct, recurring tips from regulars ("Givers") to individual service workers ("Receivers"). This policy explains what personal data we handle, why, who can see it, and the choices and rights you have. We design by privacy-by-design principles: we collect only what a feature needs and keep it only as long as needed.
2. What we collect
| Category | Examples | From |
|---|---|---|
| Account | Email, password (stored only as a bcrypt hash), display name, first and last name, optional profile photo, role (giver, receiver or both) | You |
| Security | 2FA method and encrypted secret, hashed recovery codes, sessions (device label, approximate location, last activity), sign-in attempts | You and your device |
| Subscriptions (Givers) | Receiver, monthly amount, start and next charge dates, status, visibility choice | You |
| Payment references (Givers) | Payment Partner customer ID and token, card brand, last four digits, expiry month/year, method status | Stripe Connect |
| Transactions | Gross amount, each fee, net amount, status, dates, refund details | Generated by the Service |
| Payouts (Receivers) | Payout method type, masked account label, verification status, payout amounts, fees, dates | You and providers |
| Identity and tax (Receivers) | Legal name, date of birth, address; when required: SSN or EIN, photo ID and proof of address, source-of-funds declarations | You via our Payment Partner or KYC provider |
| Support | Messages you send us and our replies | You |
| Technical | IP address, browser type, essential cookies, security logs | Your device |
3. What we never collect or store
- Full card numbers, card security codes or magnetic-stripe data. These are entered directly into our Payment Partner's fields and never pass through our servers.
- Your bank login credentials or full bank account numbers. Accounts are linked inside the provider's own interface, and we keep a token and a masked label.
- Identity document images, wherever possible. They stay with the verification provider, and we store only status, tier, timestamps and a reference.
4. Why we use it
- To provide the Service (performance of our contract with you): creating subscriptions, charging monthly tips, crediting Receivers, running payouts and showing your history.
- To keep accounts and money safe (legitimate interests and legal obligation): authentication, fraud and abuse prevention, daily ledger reconciliation and dispute handling.
- To meet legal obligations: identity verification, anti-money-laundering monitoring, sanctions screening, record-keeping and tax reporting (such as Form 1099-K).
- To communicate with you: receipts, payment and payout notices, security alerts and support replies. These service emails can't be turned off while you have an active account. Any optional updates will be opt-in.
- To improve the Service (legitimate interests): aggregated, de-identified usage measures.
We do not sell personal data, use it for third-party advertising, or build profiles to rank Givers or Receivers.
5. What Givers and Receivers can see about each other
The relationship is one-to-one, and each side sees only what it needs.
A Receiver can see
- Your chosen display name, or an alias such as Anonymous Supporter #1234
- Your monthly amount (always shown, so income can be planned)
- The date your support started
- The total you've given them (successful payments, less refunds)
A Receiver can never see
- Your card, PayPal or Venmo details
- Your email or any contact information
- Your real name if you chose anonymity
- What you give to anyone else
- Why a payment failed
Your choice. When you subscribe, you choose explicitly whether to be named or anonymous for that Receiver. You can change it later, and you can choose differently for each Receiver. Anonymity is enforced on our servers: an anonymous Giver's name and identifiers are never sent to the Receiver's device, and the same alias is used in Receiver notifications and exports. Anonymity changes who is shown, never the amount, the fees or the money flow.
Givers see a Receiver's public profile (display name, workplace context they choose to add, optional message and photo), never their payout details. Receivers are not listed or searchable. They can be reached only through a code or link they share.
TipRiver itself retains the real identity of every Giver for legal, audit and dispute purposes, even when the Giver is anonymous to the Receiver.
6. Employers
Employers are not users of TipRiver accounts and receive no access, dashboard, report or notification about any worker's tips, balances or supporters. We will not disclose this information to an employer unless legally compelled.
7. Who we share data with
- Stripe Connect: to process payments, hold funds pending payout, make payouts, and perform verification and 1099 services.
- PayPal and Venmo: when you choose them to pay or to be paid.
- Identity verification and AML providers: to verify Receivers and monitor for unlawful activity.
- Service providers (hosting, email delivery, security tooling) under contracts that limit use to providing services to us.
- Authorities: tax agencies and regulators where required, and law enforcement in response to valid legal process.
- A successor: in a merger or acquisition, with notice to you.
8. Cookies and analytics
- Essential cookies: session cookies marked HttpOnly, Secure and SameSite, plus anti-forgery tokens. They keep you signed in and protect forms. Sessions end after 30 minutes idle or 24 hours (7 days with "Remember me", which still requires re-authentication for sensitive actions). Trusted-device cookies last 30 days.
- Preferences: for example remembering a dismissed notice.
- Analytics: limited, aggregate measurement of how pages are used, where permitted and with consent where required. Analytics and any third-party tags are excluded from pages where payments are entered.
We do not use advertising cookies. You can control non-essential cookies through your browser or our cookie settings.
9. Security
- TLS 1.2+ for all data in transit. AES-256 encryption at rest for sensitive data, with keys managed separately from the data.
- Mandatory two-factor authentication. Passwords hashed with bcrypt (12 rounds). Lockout after 5 failed attempts.
- Role-based, logged access for staff, on a least-privilege basis. Support staff can never retrieve payment tokens.
- An append-only financial ledger that records money movements by pseudonymous identifiers, not names.
- Annual third-party security testing and regular internal reviews.
No system is perfectly secure, but these controls are designed so that even a database incident would expose no usable card or bank credentials.
10. Retention
We keep account data while your account is open. Financial and transaction records, identity verification records and tax records are kept for the periods required by financial, anti-money-laundering and tax laws, even after an account closes. When you ask us to delete your data, we remove personal details from user records. Ledger entries keep only pseudonymous references so the books still balance. Support messages and security logs are kept only as long as needed for their purpose.
11. Your rights
Depending on where you live (including under the GDPR and the CCPA/CPRA), you may have the right to:
- access the personal data we hold about you, and receive a portable copy (Receivers can also download yearly CSV statements);
- correct inaccurate data;
- delete data, subject to legal retention duties;
- object to or restrict certain processing;
- opt out of any "sale" or "sharing" of personal data (we do neither);
- withdraw consent where processing relies on it;
- not be discriminated against for exercising these rights;
- complain to a data protection authority.
To make a request, use the contact form and choose "Privacy request". We'll verify your identity before acting and respond within the time the law requires.
12. Breach notification
If a breach affects your personal data, we'll notify affected users within 72 hours of discovery, explaining what happened, what data was involved and the steps taken, including any credential resets. Our notices will never ask you to reply with a password or code.
13. Children
TipRiver is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a minor has an account, contact us and we'll close it.
14. Changes
We'll post updates here and notify you by email or in the app at least 30 days before material changes take effect.
15. Contact
Privacy questions and requests: use our contact form (choose "Privacy request") or write to privacy@tipriver.com.
TipRiver provides a platform for direct support and does not offer financial advice or investment recommendations.