TallyTab — Privacy Policy

Status: draft for legal review — not yet in force. This draft is published for transparency while TallyTab is in development. Values shown in «guillemets» are still being confirmed and will be filled in before this policy takes effect.

Last updated: 29 July 2026

TallyTab exists to give you one calm, private place to see your money. That only works if you can trust us with the data behind it. This policy explains — in plain English — what we collect, why, where it lives, and the control you have over it.

Our promise is simple: no ads, and no selling your data. Ever.

Contents

1. At a glance
2. Who we are
3. The data we collect
4. What we deliberately do not collect
5. Where your data comes from
6. Why we use your data, and the lawful basis for each use
7. Sensitive ("special category") data
8. Open banking: how it works
9. Who we share data with
10. International transfers
11. How long we keep your data
12. How we protect your data
13. Your rights
14. Children
15. Automated decision-making
16. Cookies and our website
17. Changes to this policy
18. Contact us
19. Governing law

1. At a glance

• We connect to your banks read-only, through an FCA-authorised open banking provider. We can see balances and transactions; we can never move your money.
• Your bank login details never touch TallyTab. You enter them with your bank, not with us.
• No ads. No selling your data. No advertising identifiers, advertising SDKs or product-analytics SDKs, and no data brokers. We do use a privacy-configured diagnostic service to find crashes and server faults, as described below.
• Your account and financial data are stored in the UK and EU — our database runs in London. Support and service emails may be handled by providers with US infrastructure, under UK-approved safeguards (see section 10).
• Deleting your account (in the app, or by emailing us) erases everything in our database in one operation — your login, your accounts, your transactions, your budgets. The only things that outlive it are backup copies (gone within «30» days), support emails, and the small set of records the law requires us to keep — see section 11.
• Take your data with you. On any plan, ask us for a full, machine-readable copy of your data, free of charge. TallyTab Plus also includes CSV export of your transactions directly in the app.
• Questions or requests: privacy@tallytab.co.uk. We respond within one month.

2. Who we are

TallyTab is made by Datavise Limited, a company registered in Scotland (company number SC817715), trading as TallyTab.

Registered office: 2nd Floor Clyde Offices, 48 West George Street, Glasgow, G2 1BP, United Kingdom.

Datavise Limited is the data controller for your personal data. "Data controller" is the legal term for the organisation that decides how and why your data is used — in other words, the one responsible for looking after it under UK data protection law (the UK GDPR and the Data Protection Act 2018).

We are registering with the Information Commissioner's Office (ICO), the UK's data protection regulator, and will show our registration reference here — «ICO registration number» — before this policy takes effect.

We are not required to appoint a Data Protection Officer; privacy@tallytab.co.uk reaches the people responsible for data protection.

For anything in this policy, contact us at privacy@tallytab.co.uk.

3. The data we collect

We collect the minimum we need to run the app. Here it is, grouped by where it comes from.

Account data

• Your email address, and either a password (stored only as a cryptographic hash — we never keep the password itself) or your Google or Apple sign-in identity if you choose to sign in that way.
• Your subscription status — whether you're on the free tier or TallyTab Plus, plus the transaction identifiers Apple or Google send us to confirm it. Apple and Google hold the payment records; we never see your card details.

Launch waitlist

• If you join the website waitlist, we collect your email address, plus your first name and whether you use iPhone or Android if you choose to provide them. We use these details only for TallyTab launch and beta updates.

Financial data (via open banking)

When you choose to connect an account — a bank account, credit card, savings account or investment — we receive, read-only:

• Balances for each connected account.
• Transactions — dates, amounts, merchant or payee names, and reference text.
• Connection metadata — which institution the account is with, the account type, and the status of the connection (for example, when consent is due for renewal).

We only ever receive this after you have explicitly consented, and only through our FCA-authorised open banking provider (see section 8).

Things you add

• Categories, notes, budgets, goals and rules you create in the app.
• Any changes you make to how transactions are categorised.

Technical and diagnostic data

• Server logs. When the app talks to our servers, we log your IP address and basic request details — the endpoint called, the time, the response status and a request ID. We use these for security, rate limiting and diagnosing problems, and delete them after «90 days».
• Crash and error diagnostics. TallyTab can send technical fault reports to Sentry when a release is configured with our Sentry project. Reports may include the app/operating-system version, device model, failed operation and a stack trace. We disable request bodies, default personal-data collection and stack-frame local variables, and scrub identifiers, email addresses, secrets and money values before a report leaves our systems. Apple or Google may also provide device-level diagnostics if your device sharing settings allow it.
• Push notification token. So we can deliver notifications, we store a token that identifies your device to Firebase Cloud Messaging and, on iOS, Apple's Push Notification service. It is linked to your account. When you sign out, the app requests deletion of its local token and durably queues removal of the matching account/token record from our server; if the device is offline, that server removal is retried when connectivity returns. Deleting your account also deletes the server record (see section 16).
• Android notification owner binding. Android notification payloads include a stable, one-way SHA-256 value derived from your account ID. The app compares it with the current signed-in account before showing a notification, so a delayed message cannot appear for the next person using the device. Google receives this pseudonymous value with the payload, but not the raw account ID.

Support correspondence

• If you email us (support@, privacy@ or hello@tallytab.co.uk), we keep the correspondence so we can help you and refer back to it if you contact us again.

4. What we deliberately do not collect

This list matters as much as the one above.

• No advertising identifiers. We never read your device's ad ID.
• No advertising or product-analytics SDKs. Sentry is used only for technical fault diagnosis under the restrictions in section 3; it is not used to profile behaviour, measure marketing or build advertising audiences.
• No data brokers. We don't buy data about you, and we don't supply data to brokers.
• No selling your data. We don't sell, rent or trade your personal data to anyone, for any purpose.
• No bank credentials. Your online banking username and password are entered with your bank, never with us. They never pass through our systems.
• No payment card details. TallyTab Plus (£3.99/month after any store-confirmed 7-day introductory trial) is billed through the App Store or Google Play. Apple and Google handle all payment data; we only receive confirmation of your subscription status and entitlement period.
• No biometric data. If you enable the optional app lock, Face ID or your fingerprint is checked by your phone's operating system. We only receive a yes/no answer. Your biometric data never leaves your device and we never see it.

5. Where your data comes from

• From you — when you join the launch waitlist, create an account, add categories, budgets, goals, rules and notes, or email us.
• From your banks and other financial institutions — via our open banking provider, only after you connect an account and give explicit consent.
• From Apple and Google — your sign-in identity (if you use Sign in with Apple or Google), confirmation of your subscription status, and crash reports if your device settings share them.
• From the app and API when a fault occurs — the scrubbed technical diagnostic data described in section 3, sent to Sentry only when that service is configured.
• From your device — the server logs described in section 3, generated when the app talks to our servers.

That's it. We don't obtain data about you from anywhere else.

6. Why we use your data, and the lawful basis for each use

You need an email address and a sign-in method to create an account — we can't provide the service without them. Everything else, including connecting any bank, is optional.

UK GDPR requires a lawful basis for every use of personal data. Here are ours. Where we rely on "legitimate interests", we name the interest — and you have the right to object (see section 13).

We never use your data for third-party advertising, and we never sell it. There is no lawful basis in the table for those things because we don't do them.

7. Sensitive ("special category") data

Your transactions can hint at sensitive things about you. A pharmacy payment, a therapy invoice, a union subscription, a donation to a religious or political organisation — the law calls information about health, beliefs, politics, trade union membership and similar "special category data", and it gets extra protection.

Here is how we treat that risk:

• We don't profile you. We never analyse your transactions to work out your health, religion, politics, sexuality or anything else about you as a person.
• We don't infer. Transaction categorisation is a convenience feature — it sorts spending into everyday buckets like "Groceries" or "Transport" based on merchant information. It draws no conclusions about you.
• You control the categories. You can rename, recategorise or create categories however you like, and your choices always win.
• Nothing is shared. Your transactions are used to show you your money — nothing more.

If you believe any of your data needs special handling, email privacy@tallytab.co.uk and we'll help.

8. Open banking: how it works

TallyTab connects to your accounts through «Yapily / TrueLayer / Finexer» (FRN «number»), a provider authorised by the Financial Conduct Authority (FCA) as an Account Information Service Provider (AISP). An AISP is a regulated company permitted to fetch read-only account information from your bank, with your permission, under the UK's open banking rules.

What this means in practice:

• You consent first. Nothing is connected until you choose an institution in the app and approve the connection with your bank — usually via your banking app.
• Your credentials stay with your bank. You authenticate directly with your bank. Your online banking username and password are never entered into TallyTab and never pass through our systems, or our provider's.
• Read-only, always. We receive balances, transactions and account details. Neither TallyTab nor the provider can move money, make payments or change anything on your accounts.
• Consent expires every 90 days. Under open banking rules, your consent lapses after 90 days unless you renew it. The app will prompt you; if you do nothing, the connection simply stops refreshing.
• You can revoke at any time. Disconnect an account in the app, or withdraw access directly with your bank. Either works, immediately: we stop receiving new data from that account. The history already in TallyTab stays, so your net worth record remains complete — it is deleted when you delete your account «or delete the connection's data in-app».

Our provider is a regulated business and a data controller in its own right for the account information service it provides — it handles your data under its own legal responsibilities and its own privacy notice: «link to provider's privacy notice». Its role is to act as the secure pipe between your bank and TallyTab.

9. Who we share data with

We share your data only with the service providers that run TallyTab — known as processors, companies that handle data strictly on our instructions. Each is bound by a contract to protect your data and use it only to provide their service to us.

A few organisations handle your data as independent controllers — meaning they decide how they use it under their own privacy policies, because your relationship with them is direct:

• Our open banking provider, «Yapily / TrueLayer / Finexer» (FCA-authorised AISP, FRN «number»), which provides its regulated account information service under its own authorisation and its own privacy notice: «link to provider's privacy notice». Section 8 explains its role.

• Apple and Google, for Sign in with Apple/Google, App Store / Google Play billing, device-level crash reporting, and push notification delivery — Google (Firebase Cloud Messaging) and, on iOS, Apple (Push Notification service) carry our notifications and the device token to your device (see sections 3 and 16).

• Your bank or financial institution, which decides how to handle your accounts and your open banking consent at its end.

And to be explicit about who we do not share with: no advertisers, no ad networks, no data brokers, no "marketing partners". We do not sell your data to anyone.

We may disclose data if the law genuinely requires it — for example, a valid order from a UK court or authority. If that ever happens, we will disclose the minimum required and, where the law allows, tell you.

If Datavise Limited were ever acquired or merged, your data would remain protected by this policy, and we would notify you before any change took effect.

10. International transfers

Your account and financial data are stored in the UK and EU:

• Database and authentication: London, UK (Supabase, eu-west-2).
• API server: EU (Hetzner).
• Open banking provider: UK.

The UK Government has ruled that the EU provides adequate protection for personal data ("adequacy regulations"), so UK–EU storage requires no extra safeguards.

Email and diagnostics are the honest exceptions. Service emails may be sent by a provider with US infrastructure («Postmark or Resend — TBC»; Postmark stores data in the US), support correspondence lives in Google Workspace («data region to be confirmed»), and Sentry's final processing region and safeguards still need to be recorded. Where any provider processes your personal data in the United States — including remote support access to UK-hosted systems by a processor's US-based staff — we will only allow it with UK-approved safeguards in place: the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Agreement (IDTA) / UK Addendum to the EU Standard Contractual Clauses. We will complete transfer risk assessments before launch and keep the table in section 9 up to date.

11. How long we keep your data

The short version: while your account is open, briefly afterwards for backups — plus the small set of records the law makes us keep.

How deletion actually works

We built deletion to be real, not a "soft delete" that hides your data while keeping it.

• Go to Settings → Delete account in the app, or email privacy@tallytab.co.uk.
• Deleting your account deletes your login identity itself. Every table in our database is linked to that identity with an automatic cascade, so your accounts, transactions, budgets, goals, rules, notes and settings are all erased in a single database operation.
• There are no partial deletes: if anything were to fail, the whole operation fails visibly and we fix it — you're never left half-deleted without knowing.
• Copies in backups expire within «30» days as backups roll off.
• Two things live outside that database cascade and are deleted separately, on the schedules in the table above: support emails (stored in Google Workspace) and the minimal subscription and accounting records the law requires us to keep.

12. How we protect your data

• Encryption in transit. All traffic between the app, our servers and our providers uses TLS.
• Row-level security. Our database enforces rules at the level of each individual record, so your data can only ever be read by your own authenticated account — a safeguard built into the database itself, not just the app.
• No bank credentials. The most sensitive secret — your bank login — never touches our systems at all (see section 8).
• Hashed passwords. If you use a password, we store only a cryptographic hash, never the password itself.
• Protected on your device. Your session tokens are stored encrypted with a hardware-backed key wherever the device supports it — Android Keystore (AES-GCM) on Android, the Keychain on iOS.
• Optional app lock. You can require Face ID or your fingerprint to open the app. The check is done entirely by your phone's operating system; biometric data never leaves your device.
• Minimal collection. The strongest protection is not holding data in the first place — which is why the list in section 4 is so long.

No system is perfectly secure, and we won't pretend otherwise. If a breach ever put your rights at risk, we would notify you and the ICO without undue delay, as the law requires — and as we'd want done for us.

13. Your rights

UK GDPR gives you real rights over your data. Here is each one, and exactly how to use it with TallyTab.

• Access. Ask for a copy of the personal data we hold about you and how we use it. Email privacy@tallytab.co.uk.
• Rectification. Correct anything inaccurate. You can edit your details, categories and everything you've added directly in the app; for anything else, email us.
• Erasure. Delete your data with Settings → Delete account in the app, or email privacy@tallytab.co.uk. Section 11 explains exactly what happens — everything in our database is erased in one operation, and the few records the law requires us to keep are listed there.
• Portability. Take your data with you. On any plan, email privacy@tallytab.co.uk for a full copy of your data in a machine-readable format, free of charge. TallyTab Plus also includes CSV export of your transactions directly in the app.
• Restriction. Ask us to pause processing of your data while a question or dispute is resolved. Email privacy@tallytab.co.uk.
• Objection. Object to any processing we base on legitimate interests (see the table in section 6). Email privacy@tallytab.co.uk; we'll stop unless we can show compelling grounds.
• Withdraw consent. For open banking connections, disconnect the account in the app, or revoke access with your bank — either way, we stop receiving new data immediately. The history already in your TallyTab account stays so your record is complete, and is deleted when you delete your account «or delete the connection's data in-app» (see section 11). Withdrawing consent doesn't affect the lawfulness of what happened before.
• Rights around automated decisions. We make no automated decisions with legal or similarly significant effects (see section 15), but if you're ever unsure, ask.

How we respond. We will respond within one month. For unusually complex requests the law allows up to two further months — if we ever need that, we'll tell you within the first month and explain why. Exercising your rights is free.

Complaints. If you're unhappy with how we've handled your data, we'd genuinely like the chance to put it right first — email privacy@tallytab.co.uk. You also have the right to complain to the regulator at any time:

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF ico.org.uk · 0303 123 1113

14. Children

TallyTab is for adults. You must be 18 or over to use it, and during our beta the service is available to UK residents only. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has created an account, email privacy@tallytab.co.uk and we will delete it.

15. Automated decision-making

We make no automated decisions about you with legal or similarly significant effects. In plain terms: nothing TallyTab does automatically can affect your access to credit, your legal rights, or anything of similar weight.

Two features are automated, and both are purely informational:

• Transaction categorisation sorts spending into categories based on merchant information. It's a display convenience — you can override any category, and your choice sticks.
• Nudges (bill-jump alerts, budget tips, payment-due reminders) are informational suggestions generated by our service when your data refreshes, and shown as notifications by the app on your device. You can ignore or disable them at any time.

We do not credit-score you, and we do not build behavioural profiles.

16. Cookies and our website

• Our website (tallytab.co.uk) sets no cookies and runs no analytics. It's a plain website.
• The app contains no advertising or product-analytics SDKs. Its optional Sentry integration is limited to technical diagnostics as described in section 3.

If that ever changes — for example, if we add privacy-respecting, first-party analytics — we will update this policy first and ask for consent where the law requires it.

The app sends push notifications — for nudges (generated by our service when your data refreshes) and occasional service messages. We deliver these through Firebase Cloud Messaging (a Google service) and, on iOS, through Apple's Push Notification service. Daily net-worth notifications are off until you turn them on. When enabled, their remote payload includes your current GBP net worth and its change since the previous daily update we sent. Those financial values pass through push infrastructure and may appear in system notification UI according to your device's preview settings. To route a notification to your device, we store a push notification token for that device on our servers, linked to your account. On sign-out, the app clears displayed and pending notifications, requests deletion of its local token, and durably queues removal of the matching server record before discarding the account/token pair needed for that cleanup. If the device is offline, the server removal is retained and retried on a later connected launch. Account deletion removes the server record as part of the account's database cascade. The notification content and token pass through Google's and/or Apple's push infrastructure to reach you. On Android the pseudonymous owner binding described in section 3 passes through Google's infrastructure as well. You can turn notifications off at any time in the app or in your device settings.

17. Changes to this policy

We'll update this policy when the service changes — for example, when our open banking provider is confirmed, or if we add a new processor.

• For material changes — anything that meaningfully affects your data or your rights — we will notify you in the app before the change takes effect, with time to read it and, if you wish, export your data and leave.
• For minor changes (clarifications, typo fixes), we'll simply update the date at the top.

Previous versions are available on request from privacy@tallytab.co.uk.

18. Contact us

• Privacy and data rights: privacy@tallytab.co.uk
• Help using the app: support@tallytab.co.uk
• Anything else: hello@tallytab.co.uk

By post: Datavise Limited (trading as TallyTab), 2nd Floor Clyde Offices, 48 West George Street, Glasgow, G2 1BP, United Kingdom.

19. Governing law

This policy, and any dispute arising from it, is governed by the law of England and Wales. Nothing in this section limits your statutory rights under UK data protection law, or your right to complain to the ICO, wherever you live in the UK.