Tally
Privacy Policy
What Tally stores, where it goes, and how to get rid of it.
Last updated 18 August 2026
Tally is a shared expense ledger for a household. It is not free because you are the product — it is free because it is a small app with no premium tier, no advertising and nothing to sell. There is no analytics SDK in it, no tracking, no advertising identifier, and nothing here is shared with data brokers.
What Tally stores
Your account
You sign in with Apple. Tally receives whatever Apple chooses to share — typically an anonymised relay email address — and stores an account identifier against it. Tally never sees your Apple password.
Your profile
A first name, an avatar colour, and optionally a Venmo handle. The handle is stored so the app can open Venmo pre-filled when you settle up; Tally does not transmit it anywhere else, and it is not required.
Your ledger
- Expenses: an amount, a date, a category, and whatever you type in the description — usually a merchant name.
- Who paid, and how each expense divides between the people on it.
- Payments recorded between members, and the periods they cover.
- Groups and the guests you add to them. A guest is a name you type; guests have no account and are never contacted.
Receipt photographs
Only if you scan one. Images are stored in a private bucket and served to your own devices through links that expire after two minutes. They are never public and never indexed.
Notifications
If you allow them, a device token from Apple and your notification preferences. Turning notifications off removes the token.
Where it goes
Supabase — hosting, database and file storage. Everything above lives here. Every table has row-level security, tested to prove one household cannot read another's ledger.
Anthropic — receipt scanning only. When you scan a receipt, that image is sent to Anthropic's Claude API to read the line items, and is not used to train models. If you never scan a receipt, no image ever leaves your phone.
Apple — Sign in with Apple, and push notification delivery if you enable it.
Sentry — crash and error reports. See below, because this one is deliberately narrow.
frankfurter.app — a public exchange-rate lookup for groups kept in another currency. It is a rate request and carries nothing about you.
Tapping "Pay in Venmo" opens the Venmo app or website with an amount and a handle filled in. Tally sends nothing to Venmo itself — it hands off to an app you already have, and what happens there is between you and Venmo.
What crash reports contain
Tally reports crashes and handled errors so that faults surface without somebody having to notice and describe them. That reporting is configured to carry as little as possible:
- No screenshots and no view hierarchy — a crash on the settle screen would otherwise photograph your rent.
- No names, amounts, email addresses, Venmo handles or receipt contents.
- No usernames and no IP addresses.
- Network breadcrumbs are stripped of their URLs, because a database URL carries table names and identifiers.
What is left is the kind of error, where in the code it happened, and which build it happened on.
What Tally does not do
- No advertising, and no advertising identifier.
- No analytics or product-usage tracking of any kind.
- No selling or sharing of personal data. No data brokers.
- No location, contacts, calendar, photos library or microphone access. Scanning a receipt uses the camera, at the moment you ask it to.
- No tracking across other apps or websites.
Who can see your ledger
The people in your household, and nobody else. A guest on a group is a name on your ledger — they are not users, get no access, and are never contacted. Household data is isolated at the database level rather than by application logic alone.
Deleting your account
Settings → Your profile → Delete account. This revokes Tally's Sign in with Apple authorisation first, then removes your email address, Venmo handle, device tokens and notification settings.
Your first name stays against the money, and this is deliberate. A balance is what one person is owed less what they have paid, so removing one side of a shared ledger would rewrite what the other person is owed. If you are the last member of your household, the whole household and its ledger are deleted outright.
Receipt images you have uploaded are removed with the household. You can export your entire ledger to a file at any time from Settings, whether or not you intend to delete anything.
Children
Tally is not directed at children and is not intended for anyone under 13.
Changes
If this policy changes in a way that affects what is collected or where it goes, the date at the top changes with it.
Contact
Questions about any of this: support@splitwithtally.app