Privacy Policy

Privacy at a glance

• Receipt photos never leave your device.
• Tally doesn’t receive what is on your check unless you share it. When you confirm how a check is split, the app sends our server a reference for that check, so it can be counted, and, if it is counted, records that step as described under “What Tally measures”. A shared check expires 24 hours after it is created and is deleted automatically shortly afterward.
• Saved checks may sync through your private iCloud. The app on your devices reads and writes them there; our server never receives them.
• Hosting a check needs an account, created with Sign in with Apple. Joining one never does: guests claim their items with no account and nothing to install.
• Your account holds a protected representation of your Sign in with Apple identifier, not the identifier itself. It holds no receipts, no names and no check contents.
• Tally measures which steps of the app people reach, on our own server, to understand where it is confusing. There is no advertising, no tracking across other apps or websites, no third-party analytics, and we don’t sell personal information.

What stays on your device

If you allow camera or photo access, Tally uses it only to scan or choose a receipt. Apple’s text recognition reads the receipt on your iPhone. The photo is not uploaded, not sent to any recognition service, not used to train AI and not saved with the check. Temporary scanner files are cleared when the scanner closes.

Saved checks hold what you scanned or typed: the venue, items, amounts, tax, tip and charges, the names of the people at the table, what each person owed, and your paid checklist. If you are signed in and join someone else’s check, Tally keeps only your own receipt: your items, your share, what you owed, the host’s name, the venue, the check total and how many people shared it. Your statistics are worked out on your iPhone from your saved checks.

A check you are in the middle of is kept on your iPhone, so leaving the app doesn’t lose it. It is not included in backups, does not sync to iCloud and is removed when you finish or discard the check. The links and codes for a check you are hosting or have joined are kept in your iPhone’s Keychain on that device only. They are not included in backups. They stop working after 24 hours, and the app deletes them the next time it looks for them, such as when you next open Tally. Leaving a check you joined removes its link from your iPhone at once.

You can type a guest’s phone number so Tally can open your own Messages app with that guest’s link. Tally never reads your contacts and never sends a text; you send it. The number stays with the check on your iPhone, and in your private iCloud if your saved checks sync there. It is removed before anything is sent to our server, which has no place to store one. Please add someone’s details only where that is appropriate, and remove them if the person asks.

What is sent when you share a check

None of a check’s contents reaches our server until you choose to share it with guests. Confirming how a check is split sends our server a reference for the check, not its contents, as described under “Your account, Sign in with Apple and iCloud”. When you share it, we store what the table needs to claim items and settle up:

• the venue, items, quantities, amounts, tax, tip and other charges;
• the names you entered for yourself and your guests, including your own name, which guests see as the host’s;
• each guest’s claims, whether they have finished, whether the host has marked them paid, and a short activity log of who claimed what and when;
• a private link and a short code for each guest, with the codes stored only in a form that can’t be read back; and
• for a Private Check, the passphrase, stored only as a salted, slow one-way hash.

A guest can join in any web browser or in the app. Either way, our server receives only which items they claim and when they are done. The link or code opens their place, and no account or Apple sign-in is sent. A guest sees the check, the other names, what each person has claimed and whether they have finished, and their own running total, never anyone else’s amount. Once the host locks the check, the guest sees their own final total. Only the host sees everyone’s amounts. Marking someone paid records what the host says; Tally doesn’t handle payments.

A guest who enters a Private Check passphrase correctly gets one cookie that keeps them in that check for 12 hours. It is used for nothing else, and the site stores nothing else in your browser.

To limit abuse, our server counts the checks created and codes tried from each network address, and requests made by each account. The address is kept only as a keyed hash that can’t be reversed without a secret held on our server, never as a readable address, and the counts are deleted within about a day.

What Tally measures

Tally records some of the steps you take in the app, so we can see where it is confusing and fix it. This is our own server, not a third-party analytics service, and there is no SDK in the app collecting anything else.

Each step is recorded with the time it happened, as the app reports it, or with the time our server received it when the app’s time is missing or out of range. The steps are: that the introduction started, or was skipped; which answer you chose to its one question, recorded as the identifier of the choice you tapped from the fixed list shown on that screen (there is no free-text box on it, and nothing you type anywhere in Tally is recorded here); that two of the introduction’s explanation screens were seen; that signing in was started; that an account was created or signed in to; that the acknowledgment was accepted; that the screen about your included checks was shown; that the Tally Pro offer was shown, and that you chose to continue without it; that a check was started by typing it in; that a split was confirmed, and that it was counted; and that the Tally Pro screen was shown because a split could not be counted. Your answer to the introduction’s question is the only step recorded with more than its name and time.

What is never recorded: receipt photos, item text, venues, amounts, totals, guest names, what anyone claimed, phone numbers, payment details or your Apple identifier. There is nowhere in these records for any of it. They are attached to your account, kept for up to about thirteen months, and deleted with your account. They are never used to decide what you are allowed to do: what you may host is decided by your included checks and your subscription, which are separate.

Events raised before you have an account (the introduction screens) are held in the app’s memory only. If you close Tally without creating an account, they are never sent anywhere and nothing about your visit is kept.

Your account, Sign in with Apple and iCloud

Hosting a check needs a Tally account, which is created with Sign in with Apple. Joining a check needs no account at all, in the app or in a browser: a guest opens a link or types a code, claims their items and is done.

When you sign in, Apple gives the app a token identifying you and, the first time only, your first name. Account and sign-in information. When you create a Tally account, we assign a random internal account identifier. The internal identifier operates your account. If you use Sign in with Apple, we receive information needed to verify the sign-in and retain a protected representation of the provider identifier so we can recognize the returning account. We do not use the provider identifier as Tally’s primary account identity. We do not request or store your Apple email address for the current sign-in flow.

Your account holds only:

• a random internal identifier that operates your account, never shown to you;
• a protected representation of your Sign in with Apple identifier;
• when the account was created and last used;
• whether you have finished the app’s introduction, or were counted as having done so because you used an earlier version of Tally;
• for each iPhone signed in to it, a credential kept only in protected form, with when it was created, last used and expires;
• which version of the receipt-accuracy acknowledgment you gave in the app, and when;
• for every check that was counted, whether it used one of your included checks or was allowed by a Tally Pro subscription, the app’s reference for that check (which shows when you started it), how and when it was counted, and, if it was counted when you shared it, which shared check it was;
• how many checks your iPhone had already counted when it signed in; and
• the app activity record, as described under “What Tally measures”.

When you confirm how a check is split, the app also tells our server whether your iPhone shows an active Tally Pro subscription. Our server takes the app’s word for this and uses it only to decide whether the check can be counted after your included checks are used. Tally does not save that yes/no value as part of your account data.

It holds no receipts, no item text, no venue, no names, no amounts and no check contents. Those keep the storage described above: on your iPhone, in your private iCloud, and on our server only for a check you actually share. Signing in never opens a check by itself; a link or code is still needed, and an account credential is not one.

Your name is not part of the account. It is kept in your iPhone’s Keychain, and if iCloud Keychain is on it syncs through it, so the app recognizes you on another iPhone without asking. Apple encrypts iCloud Keychain end to end: the app reads your name from it on your devices, and our server never receives anything from it. Your name does reach our server in one way, unchanged from before: when you share a check, the app sends it as the host’s name, because guests see it.

Your iPhone keeps a credential for your account in the Keychain. It is specific to that iPhone, is not included in backups and does not sync, so a new iPhone or a reinstall signs in again. Signing out removes it from that iPhone and leaves the account itself untouched.

iCloud is Apple’s service, not ours. If it is on, the app on your devices saves your checks to your private iCloud database and reads them back from it. That database belongs to your Apple Account: our server doesn’t receive it, and we can’t open it. A check’s contents reach our server only if you share the check, as described above. Apple’s terms and privacy policy apply to iCloud.

Service providers

• Vercel hosts tallysplit.app and its API. As with any website, it processes information about each request, such as the network address, browser or device type, the page requested (for a guest link, the link itself) and the time, and keeps operational logs under its own retention practices.
• Supabase hosts the database, in the United States, that holds shared checks, protected credentials, rate-limit counts and accounts.
• Apple provides the App Store and subscriptions, Sign in with Apple, iCloud, on-device text recognition, Messages and sharing. Tally receives only what this policy describes, and never your payment details.

Each provider’s own notice has more detail: Vercel, Supabase and Apple.

How we use and share information

We use information only to run Tally: to scan, build, save and split a check to the cent; to share it, record claims and show each guest their total; to recognize you as the host of your own checks and count the ones included with your account; to protect Private Checks, limit abuse and fix problems; to see which steps of the app people reach so we can improve it; to ask Apple whether a subscription is active; and to answer requests and meet legal obligations. We don’t use receipts, check contents, names or phone numbers for advertising, profiling or AI training.

A shared check goes only to the people you send it to, and to the providers above so they can run the service. We may disclose information when the law requires it, to protect people or investigate abuse, or as part of a merger or sale of Tally, with notice where required.

We don’t sell personal information, share it for advertising or give it to data brokers, and Tally doesn’t track you across other apps or websites. Because there is no tracking to switch off, browser Do Not Track and Global Privacy Control signals don’t change how Tally behaves.

Retention and deletion

A shared check expires 24 hours after it is created. From that moment its links and codes stop working, and our server no longer shows it to anyone. The expired check is then deleted from our database automatically shortly afterward, by a cleanup that runs every hour. If the host closes a check sooner, it is deleted at once. A check the host has settled, by marking every guest paid, stays readable to its guests, read only, until it expires, so their links show that it was settled. Copies can remain for a short time in our providers’ backups and logs until those are cycled out.

Saved checks stay on your iPhone, and in your private iCloud, until you delete them. Deleting one is meant to remove it from your other devices too, although Apple’s backups follow Apple’s own policies. The check in progress is removed when you finish or discard it.

Your account is kept while you use Tally. An account that is not signed in to for two years is deleted automatically, with everything hanging off it. The app activity record is deleted after about thirteen months, whether or not the account is still in use.

On the Account screen, Delete account deletes your account from our server: the hash of your Apple identifier, the acknowledgment you accepted, the count of checks you have hosted, the app activity record, and the credentials of any iPhone signed in to it. If you are sharing a check at the time, sharing ends and its links stop working. If our server can’t be reached, Tally says so rather than pretending it worked. Your name stays, on your iPhone and in iCloud Keychain, so signing in again recognizes you; you can clear it on the Account screen. Your saved checks, the check you’re in the middle of and any check you joined stay too. Delete all Tally data removes all of that from your iPhone: your name on your iPhone and in iCloud Keychain, saved checks (including in your private iCloud if they sync there), the check you’re in the middle of and the link to any check you joined. A check you are sharing is ended on our server first when it can be reached; if it can’t be, it stays open there until it expires within about a day. A check someone else is hosting stays on our server until they close it or it expires.

Delete all Tally data removes the local Tally data described above from this iPhone, except for the finished-check count described below. If you are signed in, it also asks our server to delete your account. Neither one cancels a subscription; manage that in Settings under your Apple Account. The count of checks you have hosted is kept with your account and on your iPhone, so the included checks can’t be reset by signing out, reinstalling or deleting an account and creating another. iOS can keep Keychain items after an app is removed, so use Delete account before removing Tally if you want your account gone. Use Delete all Tally data to remove your name and other local Tally data from this iPhone.

Your choices and privacy rights

• Type a check in by hand instead of allowing camera or photo access.
• Use Tally without sharing, so none of your check’s contents reaches our server.
• In the app, see a summary of what your account holds on the Account data screen.
• In the app, delete a saved check, close a shared check, delete your account or delete all your Tally data.
• In iOS Settings, stop Tally using your Apple ID under Sign in with Apple, and manage what syncs to iCloud.

Most of what Tally keeps is on your iPhone, where the controls above delete it directly, and a shared check expires after 24 hours and is deleted shortly afterward. Depending on where you live, you may also have the right to ask what information we hold about you, or to have it corrected or deleted. We may need to verify such a request, and may decline or limit it where the law allows. We will not treat you differently for exercising a privacy right.

We can’t reach information kept only on someone else’s iPhone or in their iCloud. If a host saved your name or number, ask the host to remove it. A guest can delete a kept receipt from Saved checks.

Security

Connections to Tally use HTTPS. Credentials on your iPhone are kept in the Keychain, only our server can reach the database, guest links and codes expire, codes and passphrases are stored only in protected forms, and requests are rate limited. Your Apple identifier is verified against Apple’s own published keys and stored only as a protected representation. Your account credential and a guest link are separate things that can’t be exchanged for one another: an account credential opens no check, and a check link gives no access to an account. No system is perfect, so treat a guest link or code as private: anyone who has it can open that guest’s place in the check until it expires or the host closes it.

Children and international users

Tally is not directed to children under 13, and we don’t knowingly collect personal information from them. If we learn that we have, we will delete it.

Tally is run from the United States, and shared checks are stored there. A guest who opens a link from another country is served through Vercel’s network, which may handle the request outside the United States.

Changes, and who runs Tally

We will update this policy when Tally’s features, providers or legal obligations change, post the new version here, and change the date at the top, which is the date this version took effect. Where the law requires more notice, we will give it. Before Tally does anything materially new with information, such as recognizing receipts in the cloud, adding third-party analytics or handling payments, this policy and the App Store privacy details will be updated first.

Tally is operated by Connor O’Shea, Phoenix, Arizona, United States.