A private expense tracker with clear limits

A privacy-first app should let you understand its behavior: what it needs to work, what it keeps on the device, which external services it uses, and which actions activate them.

Tally does not make absolute privacy promises. Its model is local-by-default and has no bank connection, but it requires an account and offers optional features that need a network. The difference is making those boundaries visible.

Tally's normal personal-finance workflow is rooted on the device.

Local by default does not mean every piece of data is permanently isolated from every server. The account, purchases, and features you choose to activate have their own boundaries, described below and in the full policy.

• Movements, accounts, categories, goals, and recurring movements.
• Receipt photos, stored as files in the app's private space.
• Local drafts created by the optional Google Wallet automation on Android.
• The local settings needed to work with the device profile.

Tally requires an account and does not offer guest mode. Supabase Auth manages identity and sessions so the app can grant access, but the account does not make Supabase the source of truth for your personal movements, accounts, categories, receipts, or goals.

You can have an account and still keep functional data on the device. That is why local-by-default does not mean account-free or server-free: it means the cloud does not automatically receive all of your finances just because you create an account.

Tally does not connect bank accounts or request credentials to download movements. You can enter them manually or, with PRO, select a CSV, Excel (.xlsx), or Norma 43 file.

The import is analyzed to prepare a preview; you review and confirm proposals before saving them. If you use optional statement enrichment, limited batches of text and categories are sent to a secure function; the full file is not stored. The CSV Tally exports and re-imports from Settings is a merge of your own data and is a different flow.

This table separates the feature, the related data, and the action that starts it.

Attaching or storing a receipt keeps its image in the app's private storage. Sharing an account does not upload the image; encrypted metadata may be synchronized so it can remain related to the movement.

The image leaves the device only when you request AI analysis. The result is a proposed amount, date, merchant, concept, or category for you to review; it does not replace your decision or save the movement by itself.

Tally does not synchronize all of your finances by default. If you share an account, the data needed for that account is sent for synchronization and its functional content is encrypted on the device before upload.

A shared account can have edit or view-only permissions. The content is encrypted on the device; this page does not call it end-to-end encryption because protection also depends on member, key, and remote-service management described in the privacy policy.

• You choose which account to share.
• Receipt images remain local when you share.
• Participants receive aliases and roles for the shared space.

• It does not mean Tally works without an account: authentication is required.
• It does not mean no data can ever leave the device: sharing, purchases, AI, and analytics or diagnostic settings have specific remote flows.
• It does not mean bank synchronization exists: Tally does not connect banks, and manually entered movements do not appear automatically.
• It does not mean a system is infallible. The policy describes HTTPS/TLS, authenticated encryption for shared content, and per-member permissions, but no system is completely infallible.