Security at Tallyscope

Last reviewed: 2026-10-30. For details of data handling and retention, read our privacy policy.

Your files stay on your device

Statement files are read directly inside your browser tab. Parsing, OCR, balance checks and conversion run on your device, so you can convert statements without uploading the files to our servers.

Files, extracted transactions and edits remain in the tab's working memory. The app does not save statement content to browser storage. Closing the tab ends that working session; your original files and any exports you downloaded remain on your device.

Your browser saves preferences such as your display currency, theme and OCR language, a cache of exchange rates, and your privacy choices. If you sign in, it also keeps your login session. You can clear these through your browser's site-data settings.

You control AI sharing

The built-in assistant calculates answers locally. When it needs help understanding a question, it sends the question wording to an AI service through our server. Your transaction table is not included in that request. Avoid putting personal details in your questions.

“Let the AI read my transactions” is off by default. This optional feature requires your consent and a Day pass or Pro plan. When enabled, questions that need it send a masked transaction table to Google Gemini through our server.

Masking covers common account and card number patterns, IBANs, emails, phone numbers and links. Some account-like numbers retain their last four characters. Names, merchant names, descriptions, dates and amounts can remain visible. Pattern-based masking does not make the table anonymous or guarantee that every personal detail is removed.

AI services may retain submitted text or use it to improve their models, depending on the provider and service terms. Review the disclosure in the app and our privacy policy before enabling this feature. You can turn it off at any time; consent lasts for the browser session unless you choose to remember it.

Protection while you use the site

• Encrypted connections. The site uses HTTPS and tells supported browsers to keep using secure connections.
• Restricted scripts and connections. Browser security policies restrict which scripts can run and which services the app can contact. These controls help reduce exposure to unauthorised code and requests.
• Protection against embedding. Other websites are prevented from displaying Tallyscope inside a frame, helping protect against deceptive overlays and clicks.
• Limited browser permissions. The site disables access to the camera, microphone, location and other device capabilities it does not need.
• No advertising scripts. The site does not load third-party advertising or tracking scripts. Optional usage events and error reports require your opt-in and exclude statement content.

Exchange-rate lookups and optional OCR language downloads do not send your statement content. Account and payment services handle sign-in and billing separately from conversion. The privacy guide explains these network uses.

Accounts and payments

Sign-in is handled by Supabase Auth. Our application does not store your password. Account and billing requests are checked on our servers, and database access rules restrict which account records a signed-in user can read.

Payments take place on Stripe's hosted checkout page. Card details are entered directly with Stripe and never reach our application or servers. Payment notifications are verified before they are used to update access.

You can manage billing or delete your account from the app. The privacy policy explains account deletion and records retained for legal obligations.

Safer exports

CSV exports neutralise text that could be interpreted as spreadsheet formulas. Excel exports write text as text cells. These safeguards help prevent transaction descriptions from becoming executable formulas when you open an export.

Report a security concern

Email support@tallyscope.app with the affected page or feature, steps to reproduce the issue, and its potential impact. Use your own account and synthetic data, and avoid sharing real statements or other people's information. Please avoid disruptive or high-volume testing and allow time for us to investigate before publishing details.

We aim to reply within a few working days and will follow up on confirmed issues.