Privacy Policy

1. What data we collect

When you use Tally, we collect:

• Account information: your email address and password (used only for authentication; we never see or store your password in readable form — it's handled by our authentication provider, Supabase, using industry-standard encryption).
• Financial data you enter: transactions, income, budgets, category names, and any notes you add. This may include merchant or person names you type in (e.g., for a PayNow transfer).
• Receipt and statement images, temporarily: if you use the receipt-scan or statement-import features, the photo or document you upload is sent to our AI provider to extract the transaction details. The image itself is not stored by us after this one-time read — only the extracted text data (merchant, amount, date, category) is saved to your account.

We do not collect, request, or store:

• Your bank account login, password, or credentials, ever.
• Any payment card numbers.
• Your NRIC or other government ID numbers.

2. Why we collect it

We collect this data solely to provide the Service's core function: letting you track, categorize, and understand your own personal expenses and income. We do not use your data for advertising, and we do not sell your data to any third party, ever.

3. Who we share data with

We use the following third-party service providers to operate Tally. Each processes data only as necessary to provide their specific function, and none are permitted to use your data for their own purposes:

These providers may process data on servers located outside Singapore. By using the Service, you consent to this transfer, which is necessary to provide the Service to you.

4. How your data is protected

• The Service is designed so no user can see another's data — this is enforced by the database itself using Row-Level Security, not just a policy promise. Through the app, one user's account has no way to read another's transactions, notes, or attached photos.
• We do not access, browse, or review individual users' data as a matter of normal operation.
• That said, in the interest of full accuracy: as the operator of the underlying infrastructure (Supabase, which also stores any photos you attach in Notes), direct administrative access to the raw database and file storage is not technically impossible. Row-Level Security prevents cross-user access through the app itself, but it does not prevent the account owner from using their own administrative credentials to inspect stored data directly. We do not do this as a matter of course, and doing so is unnecessary for operating the Service.
• All data is encrypted in transit (HTTPS/TLS).

5. How long we keep your data

We retain your data for as long as your account remains active. If you delete your account, your data is permanently removed from our database and cannot be recovered.

6. Your rights

Under the PDPA, you have the right to:

• Access the personal data we hold about you.
• Correct any inaccurate data (you can do this directly within the app for almost everything).
• Withdraw consent for us to continue collecting, using, or disclosing your data, which in practice means deleting your account.
• Request deletion of your account and all associated data at any time.

To exercise any of these rights, contact us at hello@letstally.app.

7. Children's data

Tally is not directed at or intended for use by children. If you are under 18, please only use this Service with the involvement of a parent or guardian.

8. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will make the updated Policy available on this page. Continued use of the Service after changes are posted constitutes acceptance of the revised Policy.

9. Complaints

If you have any concerns about how your personal data has been handled, please contact us first at hello@letstally.app. If you remain unsatisfied, you may lodge a complaint with Singapore's Personal Data Protection Commission (PDPC) at pdpc.gov.sg.