TallyscopePrivacy policy
Your bank statements are read in your browser and are not uploaded. This policy explains the small amount of data we do handle, who handles it, and your rights.
1. Who is responsible
Tallyscope ("we", "us") is the controller of the personal data described here. Contact for any privacy matter: support@tallyscope.app.
2. The short version
- Statement files and the transactions read from them are processed in your browser tab. They are not uploaded to our servers and we do not store them.
- If you create an account we store your email address and your plan. Payments are handled by Stripe.
- We use cookieless, aggregate analytics and error reports that contain no statement content.
- The AI assistant sends the wording of a question to AI providers when the built-in engine cannot understand it. Advanced AI features, an opt-in paid mode, send a masked table to Google Gemini.
3. Data that stays in your browser
When you add a statement, the file is read from your device into your browser's memory. Parsing, OCR, verification, currency conversion and export happen there. We never receive the file, its text, or the extracted transactions through these functions. When you close the tab the data is gone. Your browser's local storage keeps your settings (such as display currency, date format, theme and OCR language) and, if you are signed in, the authentication session issued by our authentication provider. You can clear it at any time in your browser.
4. Data we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account email, password hash or Google sign-in identifier, plan and Day pass records | Provide your account and paid features | Contract (Art. 6(1)(b)) |
| Payment and subscription data held by Stripe (we receive status, plan, customer reference, not your card number) | Take payment, manage subscriptions, prevent fraud, meet tax duties | Contract; legal obligation (Art. 6(1)(c)) |
| Aggregate page analytics from Vercel Web Analytics (no cookies, no cross-site tracking) | Understand which pages and features are used | Legitimate interests (Art. 6(1)(f)) |
| Error reports (error message cut to 200 characters with digit runs masked, the top five stack frames as function and file name, app version, browser family; never statement content and not the page address) | Find and fix bugs | Legitimate interests |
| Technical request data: IP address and user agent in server logs; a salted hash of your IP address for rate limiting | Security, abuse prevention, fair-use limits on the assistant | Legitimate interests |
| Emails you send to support | Answer you | Legitimate interests; contract |
5. The AI assistant
Default behaviour. Answers are calculated in your browser from your table. If the built-in engine cannot understand a question, the wording of that question (and the previous query plan, for follow-ups) is sent to our server function, which forwards it to an AI model to turn it into a structured query. Your transactions are not sent. The AI providers we may use, in turn, are Google Gemini, Groq, GitHub Models, Cloudflare Workers AI and OpenRouter, on their free tiers. Free-tier providers may log prompts and may use them to improve their models, under their own terms. Do not type personal details, account numbers or confidential information into a question.
Advanced AI features: "AI reads my transactions" mode. Off by default and available on the Day pass and Pro plans. If you switch it on, questions that the local engine cannot answer send a masked version of your table (dates, descriptions, amounts, categories) to Google Gemini through our server function, which answers from it. IBANs, card numbers and long account numbers are masked by pattern. Masking is pattern-based. It does not remove names, merchant names or free-text descriptions, which may identify you or other people. Read-mode requests are not cached and their content is not logged by us. Turn the mode off at any time. Answers in this mode are labelled as AI-written, because an AI's arithmetic is not verified.
6. Who receives data (processors and recipients)
- Vercel Inc.: hosting, serverless functions, web analytics and server logs.
- Supabase: authentication and the database holding your account, plan and Day pass records.
- Stripe: payments, invoices and subscription management. Stripe acts as an independent controller for some purposes, such as fraud prevention and regulatory compliance; see Stripe's privacy policy.
- AI providers listed in section 5, only for the assistant features described there.
- Upstash: a rate-limit counter and cache store for the assistant, where configured. It holds salted hashes and cached query plans, not statement data.
- Google, if you sign in with Google, as your identity provider. The sign-in happens in a separate window on Google's site.
- Public exchange-rate services and a CDN receive currency codes and dates, or a language-model file request, from your browser, along with your IP address as in any web request. They do not receive statement data.
7. International transfers
Some providers above are based in, or process data in, countries outside the European Economic Area, including the United States. Where personal data is transferred, we rely on the provider's participation in the EU-US Data Privacy Framework or on Standard Contractual Clauses, as applicable. Ask us for details at the address above.
8. How long we keep data
- Statement data: not retained by us.
- Account, plan and Day pass records: until you delete your account, then removed, except what we must keep by law.
- Payment and invoice records: kept by us and Stripe for as long as tax and accounting law requires (commonly several years).
- Server logs and error reports: kept for a limited period, in line with our hosting provider's settings, to maintain security and fix bugs.
- Rate-limit counters: short-lived, expiring automatically.
- Support emails: kept as long as needed to resolve your request and for a reasonable period afterwards.
9. Your rights
Under the GDPR and similar laws you may ask to access your data, correct it, have it erased, restrict or object to processing, receive a copy in a portable format, and withdraw consent where processing is based on consent. Erasure: you can delete your account yourself in the app with Delete account. This removes your account and subscription data and your Stripe customer record on our side, then signs you out; records we must keep by law, such as invoices, are retained. For any other request, email us; we aim to answer within one month. You can also complain to your local data protection authority; you may complain to your local data protection authority.
10. Cookies and similar technologies
We do not use advertising or tracking cookies, and our analytics are cookieless. The site uses your browser's local storage for settings and, if you sign in, your authentication session; these are strictly necessary for the features you request. Stripe's hosted checkout and Google's sign-in page are third-party sites with their own cookie practices, which apply when you visit them.
11. Security
The site is served over HTTPS and uses a strict Content-Security-Policy that limits the hosts your browser may contact. Statement processing in your own browser reduces what can be exposed. No online service is perfectly secure, and you are responsible for keeping your own device and account credentials safe.
12. Children
Tallyscope is not directed at children and we do not knowingly collect their personal data. You must be old enough to enter a contract in your country to buy a plan.
13. Changes
We may update this policy as the product changes. The date at the top shows the latest version; material changes affecting paying customers will be announced in the app or by email.
14. Contact
Tallyscope. Email: support@tallyscope.app. See also the terms, the refund policy and how statements stay in your browser.