Privacy policy

4.1Information you give us

Account information. Your email address, your first name, your last name, your password, your two-step verification secret, and a profile picture if you add one. We store your password as a hash, never in clear text. We store the two-step secret and the recovery codes encrypted. We never send a password by email.

Mobile phone number. Every account uses two-step verification. You choose an authenticator app or a text message. If you choose a text message, we collect your mobile phone number. We use it only to send a 6-digit sign-in code when you sign in or when you change the number. The only other message we ever send to it is a reply to HELP. A code expires after 3 minutes. We store the number once and show it only as its last 4 digits. Before the first text, you consent with a separate, unticked checkbox. We record the consent with its date and version, and we record a withdrawal, never delete it. Section 19 states the consent wording, how to stop texts, and who carries them. Mobile phone numbers and text-message consent are used only to send sign-in verification codes. They are not sold, and they are not shared with third parties or affiliates for marketing purposes.

Workspace information. The name, type (personal or business), currency, time zone, fiscal year start and default tax place of each workspace. A business workspace can carry a logo. A business workspace can also state whether it is registered for GST/HST and whether it is registered for QST. The 2 answers decide what part of a receipt's sales tax the workspace can treat as recoverable. Only the owner can change them. A personal workspace is never asked.

Financial records. Everything you type or import into a workspace. This includes accounts and their balances, transactions, expenses and their categories, splits and sales tax. Sales tax is kept as the named parts a receipt prints, such as GST and QST, with the place the purchase was made for tax purposes, and a tip when the slip shows one. It includes debts and their interest terms, budgets, goals, assets and their valuations. It includes reimbursements, shares between members, mileage and per-diem claims, recurring series, and rules. A transaction can carry a foreign-currency original amount.

Receipt lines and items. When a receipt is read, we store each line printed on it. A line holds the description as printed, the quantity, the line amount and the tip. Each line is matched by its name to an item in your own workspace. The item shows how often and at what cost you buy it. A tie is left unmatched. You can switch "Keep these items" off on the review dialog. Receipt lines and items stay inside the workspace they belong to. We never share them across workspaces or between people. We never use them to compare prices between people, and never for advertising. They are in the workspace export and are erased with the workspace.

Receipts, statements and photos. Receipt images you upload, photograph or forward by email. Statement files in PDF or image form that you upload for reading. Photos you attach to assets. We keep the AI reader's raw answer with the receipt or statement it belongs to, for fault finding. It is erased with that record. No staff screen shows its contents.

Imported statement files. CSV, TSV, OFX and QFX files are read inside your browser. The file itself is never uploaded. Only the rows you confirm reach our server. We remember your column mapping per bank so that you do not map it twice.

Support messages. What you write to us by email and the details you include.

Preferences. Your notification settings, your dashboard layout, and similar settings.

Do not enter government identification numbers, full card numbers or bank passwords into any field. Tally Tame does not need them and does not ask for them.

4.2Information from your bank through Plaid (Premium)

When you connect a bank, you sign in to your bank inside Plaid's own flow. Plaid Inc. then sends us the account details and the transactions for the accounts you chose. For each account: its name, type, masked number, currency, balance and available balance, and for a credit account its limit. Plaid does not send an interest rate; you can type one in. For each transaction: the date, description, merchant, amount, currency, a pending flag and a category hint. We translate the category hint into our own category words, and drop it unless Plaid reports high confidence. We keep no location and no counterparty details.

We also keep a small fixed extract of Plaid's own record of each transaction, for one purpose: to find out why an import went wrong. It holds Plaid's identifiers, the original amount and currency, the dates, the pending flag and the payment channel. It also holds the bank's transaction code, Plaid's category, the merchant identifier and the merchant category code. Nothing else from Plaid is kept. A field Plaid adds later is not kept unless we add it to this list. The extract is erased with the transaction.

The same fields are collected for a bank in Canada and a bank in the United States.

We hold a read-only access token for each connection. We never see or store your bank password. We cannot move money. Section 8 explains Plaid in detail.

4.3Information other members add about you

A workspace can have more than 1 member. Another member can record an expense you paid, a share you owe, or a settlement between you. That record is personal information about you. The workspace owner decides who is a member and what each member can see.

4.4Information from people who email receipts

A workspace has a receipt email address. It accepts mail only from verified members and from up to 10 senders that the owner lists. From an accepted email we keep only the attachment. We discard the sender, the subject and the body. We discard mail from any other sender. We log every delivery, accepted or refused, for 90 days. The log holds the outcome, a reason code, the attachment count and a hash of the message identifier. Mail to a receipt address passes through our email supplier before it reaches us.

4.5Information collected automatically

Session information. A session cookie that keeps you signed in. Your IP address, browser type and operating system reach our server with every request. We do not keep them, except a hashed address after a failed sign-in.

Referral cookie. Tally Tame has a referral programme. Each member has a referral code and a link. If you open a member's link, a cookie named tallytame.ref stores that code for 30 days. We read the cookie once, when you create an account, to credit the referral. Scripts cannot read it. It does not track you. If you arrive any other way, it is never set. You can also enter a member's code yourself, in Settings, Plan, within 14 days of creating your account. That path sets no cookie.

The referrer sees 2 counts: friends who joined, and rewards earned. The referrer never sees your name, your email address, your plan or a payment. You see only the code you used. Nobody outside Tally Tame receives anything about a referral. Section 16.4 describes the reward.

Text-message delivery records. For every text we send, we keep the date and the delivery outcome. We keep your number with all but the last 4 digits masked. We keep no message content. Our text-message supplier reports the delivery outcome to us.

Server logs. The app keeps no request log. The server keeps at most 30 MB of error output per app and overwrites it as it fills, in practice within days. A failed sign-in is recorded as a hashed address for 90 days.

Activity log. Each workspace records every change with who made it and when. It never records an amount. Entries expire after 1 year by default.

Push subscription. If you turn on push notifications, your browser gives us a subscription address and encryption keys. We store them so that we can send you messages. We encrypt every message before it leaves our server, by the web push standard (RFC 8291). The push service of your browser maker carries the message but cannot read it.

Device storage. The installed app caches only its offline page. It stores your sign-in session and your display preferences. No financial record is stored on your device. Sign-out clears the app's local preferences, except the theme.

Measurement. The site and the app measure use with Umami, an open-source analytics engine that we run ourselves on our own server in Toronto. It has no public address. Your browser sends each measurement only to our app. Our app checks it and passes it to the engine over an internal network. No script from another company loads. No measurement goes to another company. No supplier is involved, beyond the encrypted backups in section 10.

For each page view or event we record:

• The screen name, with every identifier removed before it leaves your browser. We record "accounts.detail", never the address of a specific account. Our server refuses anything that still carries an identifier.
• The referring site (domain only), the campaign tags on a link to the marketing site, and your browser, operating system, device type, screen size and language.
• Your country, region and city, derived on our server from your IP address with a local database. The IP address itself is not stored.
• A visitor number: a hash of your IP address and browser under a secret salt that changes every month. The same person is a different number next month. The number is never linked to an account.
• Named events from a fixed list: sign-up completed, address verified, two-step enrolled, workspace created, first account added, first expense added, bank connected, receipt uploaded, trial started, subscription started, subscription ended, referral qualified, and a click on the sign-up button on the marketing site. An event can carry only a category value, such as the workspace type or the plan name. An amount cannot be recorded. The list is enforced in code and by tests.

Measurement sets no cookie. It records no user identifier, no email address, no page address with an identifier in it, no page content, no amount, no balance, no financial record and no precise location.

If your browser sends the "Do Not Track" or the Global Privacy Control signal, you are not measured at all. Our server discards the measurement before reading it.

Staff see the result in the staff portal, as counts and charts only. The same screen shows counts from our own database: active accounts per day, how many people from a sign-up week came back, use per module, and trials that converted. Every figure is a count. No staff screen shows an individual visitor.

We do not run advertising trackers. We do not load scripts from other companies. We do not collect precise location.

4.6Payment information

Stripe, Inc. handles payment. When you buy Premium, you enter your card on a page that Stripe hosts. We never receive your full card number. From Stripe we store a customer identifier and your plan: its status, billing interval, price, currency, period and trial dates. We also store the identifiers of your invoices, with links to Stripe's hosted invoice and PDF. We do not store the card brand, the last 4 digits, the expiry or a billing address. Stripe holds them. Stripe's privacy policy is at https://stripe.com/privacy.

4.7Sample data and templates

Sample data is a made-up household. It contains no real person. Workspace templates shape an empty workspace with categories and a budget structure. They never contain an invented amount.

9.1Members of your workspace

Members see what the owner allows. The owner sets a role (owner, editor, viewer) and per-member module permissions: accounts, debts, expenses, budgets, goals, assets, reports. Export is a separate permission. An editor can change or delete records, including records about you. If you leave a workspace, the records you entered stay in the workspace. The activity log shows who changed what.

Think before you invite. A member you add can see everything that their permissions allow.

9.2People you authorise

You can create a personal access token and give it to software you trust. The token is read-only and is scoped to the modules you choose. The software then sees the same rows that the CSV export defines. You can revoke a token at any time. A token dies with your membership.

9.3Our suppliers

The companies below process personal information for us, on our instructions, and only for the purpose stated. A data processing agreement is in force with every supplier: 6 by incorporation into their terms, and Plaid under its master agreement. We do not permit them to use your information for their own purposes. None of them receives your full financial records except where the table says so.

We do not use Flinks or any other bank data provider.

9.4Our staff

Tally Tame has a staff portal. Access requires two-step verification. Every change a staff member makes is audited. Staff look at your records only to answer a request you made, to fix a fault, or to investigate abuse. Every lookup of an account by staff is logged. Today 1 person has that access.

For customer support, a staff member with the organisation-manager role or higher can look up an account by email address or name. The lookup shows: your name, your email address and whether it is verified; when the account was created; your locale and time zone; your country and region; the versions of the terms and of this policy you accepted and when; whether two-step verification is on and since when; whether the account is locked after failed sign-ins; the number of active sessions and the country and city of the newest one; your plan and subscription status; the workspaces you belong to, with your role and the member count; the consents you gave or withdrew; your referral code and counts; and your notification channel preferences.

The lookup never shows a balance, a transaction, an expense, a receipt or an amount. It never shows a password, a two-step secret, a recovery code or a session token.

Every lookup is written to the staff audit log: who looked, at whom, and when. Staff can also end your sessions, clear a sign-in lockout, and write a support note. Each of those actions is logged. Resetting two-step verification and closing an account are not portal actions. A staff member runs them by command on the server, after confirming your identity through a second channel.

9.5When the law requires it

We disclose personal information when a law, a court order or a lawful request from a public authority requires it. We check every request. We tell you about it when the law allows us to.

9.6If the business changes hands

If Pixibiz sells Tally Tame, merges, or becomes insolvent, your information can pass to the new operator. We tell you by email before that happens, at least 30 days ahead where the law allows it. The new operator must honour this policy or give you a way to delete your account first.

9.7What we never do

We never sell personal information. We never rent it. We never share financial records with an advertiser, a data broker, a credit bureau, a lender or an insurer. We never receive a fee or a benefit for your information. No such arrangement exists. Mobile phone numbers and text-message consent are used only to send sign-in verification codes. They are not sold, and they are not shared with third parties or affiliates for marketing purposes. We never use the lines of your receipts to compare prices between people.

16.1Canada

The Personal Information Protection and Electronic Documents Act (PIPEDA) governs how we handle personal information. Where a province has its own private-sector privacy law, that law also applies to residents of that province.

You can complain to the Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca, 1-800-282-1376.

16.2Quebec

Tally Tame is not offered to residents of Quebec today. The app, this policy and the terms of service exist only in English, and Quebec law requires French. Sign-up asks where you live and refuses Quebec. If we learn that an account belongs to a resident of Quebec, we tell the person. We give them 30 days to export their records, and then we close the account.

If you are a resident of Quebec and you hold an account despite that rule, Quebec law still protects you, and we apply it:

• The person in charge of the protection of personal information at Pixibiz is Johan Teran, Founder. Reach that person at the privacy email in section 2.
• We ask for your consent separately, in clear words, before we collect sensitive information such as a bank connection or a receipt. The request is not hidden in the terms of service.
• Your information is stored outside Quebec (section 10).
• The app's default settings give the highest level of confidentiality. Nobody sees a workspace until you invite them. Push is off until you turn it on. We send no marketing email.
• Section 7 describes technology that could be seen as profiling. Tally Tame does not collect your precise location and does not identify you across other services.
• We make no decision about you by exclusively automated means.
• You have a right to portability, to ask us to stop disseminating information, and to ask for de-indexing.
• You can complain to the Commission d'accès à l'information du Québec: https://www.cai.gouv.qc.ca.

We plan to offer Tally Tame in Quebec once a French version of the app and of these documents exists. This section changes at that time.

16.3European Economic Area, United Kingdom and Switzerland

Tally Tame is not offered to residents of the European Economic Area, the United Kingdom or Switzerland today. We have no representative there, and the law of those places requires one. Sign-up asks where you live and refuses those places. If we learn that an account belongs to a resident of one of them, we tell the person. We give them 30 days to export their records, and then we close the account.

If you hold an account despite that rule, you keep every right in section 15. You can also complain to the supervisory authority of your country of residence. In the UK that is the Information Commissioner's Office, https://ico.org.uk.

We do not collect special categories of personal information. A transaction description can reveal a sensitive fact about you, for example a payment to a clinic. We do not analyse, categorise or infer any such fact. We treat every transaction the same way.

16.4United States

This section is for residents of California and of other states with a consumer privacy law. We describe our practices in the terms those laws use.

Categories of personal information collected in the last 12 months, and the source.

Purposes. Section 5. Disclosure to service providers. Section 9.3. Each supplier receives only the categories the table shows.

Sale and sharing. We do not sell personal information. We do not share it for cross-context behavioural advertising. We have not done either in the last 12 months. We have no plan to. We do not sell or share the personal information of anyone under 16, because nobody under 18 may use Tally Tame.

Sensitive personal information. We use it only to provide the service you asked for, to keep your account secure, and as the law permits. We do not use it to infer characteristics about you.

Opt-out preference signals. The app has no advertising and no sale or share to opt out of. We treat a Global Privacy Control signal as a valid request anyway. A browser that sends it receives an acknowledging header on every app page, and it is not measured at all (section 4.5).

Bank connections. If you connect a United States bank, Plaid handles your bank data in the United States under its end user privacy policy. You can see and remove the connections Plaid holds for you at https://my.plaid.com, and ask Plaid about its data through the form in section 8. We receive the same fields for a United States bank as for a Canadian bank (section 4.2).

Retention. Section 11 states how long we keep each category.

Notice of financial incentive. The referral programme is a financial incentive under California law, because it rewards an attributed sign-up. These are its terms.

• What you give. When you use a member's link or code, we record the code and the date you created your account. Later we record the date of your first Premium payment. Nothing else. The referrer sees only a count.
• What each side gets. The same number of days of Premium, 30 by default, for you and for the referrer. The reward is earned when you first pay for Premium, or at sign-up if we say so at the time. It is never money. A member who already pays for Premium receives the days as a credit against the next invoice.
• How to opt in. Open a member's link before you sign up. Or enter their code in Settings, Plan, within 14 days of creating your account.
• How to opt out. Do not use a link or a code. You can also ask us to remove a referral attribution at any time by writing to the privacy email. Removal ends any reward not yet used.
• The value of your information. We do not price personal information. We value the incentive at the cost of the days of Premium we give, 30 days at the Premium monthly price. That is the whole value we assign, and the method is the price list in the terms of service.
• If the programme ends. We can pause or end the programme. A reward already earned stays.

Your rights. Know, access, correct, delete, receive a portable copy, opt out of sale or sharing, limit use of sensitive personal information, and not be discriminated against. Section 15 says how to exercise them. We answer within 30 days, inside the 45 days that state law allows. If we refuse, you can appeal by replying to our answer. We answer the appeal within 30 days. If you still disagree, we tell you how to contact your state attorney general.

California "Shine the Light". We do not disclose personal information to third parties for their direct marketing purposes.

Children. We do not knowingly collect personal information from anyone under 13, or from anyone under 18. See section 17.

Washington My Health My Data Act. We do not collect consumer health data. We do not infer health from your transactions.

16.5Other countries

If you live somewhere not named above, the law of your country can give you rights beyond section 15. We honour them where they apply. Write to us.