Privacy policy
The short version. Tally reads the bank messages and notifications you choose to send it and turns them into transactions on your phone. Each message is read once by an AI service to create the transaction; Tally keeps no copy of it. Tally keeps an anonymised version to get better at reading banks, with every number replaced and merchant names removed, and you can turn that off any time. Tally also counts which category each shop is filed under. The count says nothing about who filed it. Receipt photos never leave your phone. There are no accounts, no ads and no tracking.
What stays on your phone
Everything Tally shows you lives in a database on your device: your transactions, your bank accounts, cards and mobile wallets as you set them up, categories, budgets, the people you split bills with, and the original text of each bank message. Tally has no sign-in and no server-side copy of your data, except what you share in a group (see Groups).
On iOS, if you turn on iCloud backup in Settings, Tally writes a copy of that database into your own iCloud Drive. That copy is governed by Apple's iCloud terms and is only ever read back by Tally on your devices. On Android, if your phone's backup is on, Tally is included in it, encrypted.
What leaves your phone, and why
| What | Where it goes | Why | Kept? |
|---|---|---|---|
| The text of a bank SMS, or of a notification from an app you chose | Tally's server on Cloudflare, then an AI model at OpenAI | To read the amount, merchant and type and create the transaction | No. Tally stores nothing from this request. OpenAI processes it under its API data policy, which does not use it to train models. |
| An anonymised copy of that message | Tally's server on Cloudflare | To improve how Tally reads messages from banks | Yes, with every number replaced by 111, merchant names replaced by the word MERCHANT, and no device, account or app identifier attached. You can turn this off in Settings under "Share anonymised messages". |
| The name of a shop you bought from and the category you left it in. Purchases only, never a transfer. | Tally's server on Cloudflare, about a week later, separately from the anonymised message | So Tally learns which category a shop belongs in | As a count per shop and category. No time, no address, no device or account identifier. A shop reported fewer than three times is deleted every three months. You can turn this off in Settings under "Share anonymised messages". |
| The recognised text of a receipt, as rows of words with their positions | Tally's server, then the AI model | To turn a receipt into item lines for splitting a bill | No. The photo itself is read on your phone by on-device text recognition and is never uploaded or stored. |
| A currency code, such as USD | A public exchange-rate service (open.er-api.com) | To convert amounts in other currencies | Nothing about you is sent with it: no message, amount or identifier. Like any web request, it reaches the service with your IP address. |
| The symbol of a stock, fund or coin, only if you add one under Investments | Public price services (Mubasher, Yahoo Finance, Starta, CoinGecko, TradingView) and Tally's own price service | To show what your holdings are worth today | Nothing about you is sent with it: no amount, quantity or identifier. Like any web request, it reaches the service with your IP address. |
| Your IP address | Tally's server | Rate limiting, to protect the service | Only as a one-way hash, for a short window. |
Notifications
On Android, if you give Tally notification access, Tally reads the notifications of the apps you switch on in Settings, Bank messages, Notifications from apps, and of no other app. Each such notification is sent to Tally's service once to be read into a transaction and is not kept. A notification that is not a payment is stored on your phone with no text.
For every other app that posts a notification, Tally keeps on your phone the app's name, its icon and when it last posted, so that you can choose it from a list. It does not read those notifications, and this list does not leave your phone. An app you have not switched on is forgotten after 30 days without a notification.
On iPhone, Tally reads what your Shortcut hands it: the text messages that mention your currency, and the notifications of the apps you chose in the Shortcut.
What Tally never collects
- No account, email address, phone number or name. Tally does not know who you are.
- No device identifier, advertising identifier or location.
- No analytics or crash-reporting SDKs. TestFlight and Google Play test builds use Apple's and Google's own crash reporting, which follows their terms.
- No contacts. Names you add for splitting bills are typed by you and stay on your phone.
- On iOS, no message that you did not route to Tally: it only sees messages your own Shortcut automation hands to it. On Android, Tally reads incoming messages with the permission you grant; a message that is not from a bank is dropped on the phone and its text is not kept.
Diagnostics you choose to send
Settings has a "Send diagnostics" screen. It builds a text file from your app logs and the recent bank messages, lets you untick any message, and masks amounts and merchant names unless you switch them on. Nothing is sent until you share that file yourself, to whoever you choose.
Bill splitting messages
When you split a bill, Tally composes a message for each person with their part and, if you added one in Settings, your InstaPay link. That message is handed to your phone's share sheet and sent by whichever app you pick. Tally does not send it and does not store the other person's number.
Groups
If you join a group, the purchases you mark for it are shared with the people in it. They are end-to-end encrypted, so Tally's server cannot read them.
Your choices
- Turn off Read bank messages in Settings. Tally then reads nothing and you can add transactions by hand.
- Turn off anonymised sharing in Settings. The parsing keeps working; the anonymised copy and the shop counts are no longer sent.
- Turn off iCloud backup in Settings, or delete the Tally folder from your iCloud Drive.
- Delete the app. Its database goes with it.
Early access list
If you leave your email on tally.tinqr.dev, it is stored on Tally's server and used only to send you the invite. Nothing else is stored with it, and you can ask for it to be deleted by writing to the address below.
Changes
If this policy changes, the effective date above changes with it and the app will say so on the setup screen for new installs.
Contact
Questions about this policy: privacy@tinqr.dev.