PRIVACY POLICY

0.THE SHORT VERSION

The rest of this policy says the same things in more detail. If anything here conflicts with the short version, the detailed sections control.

1.WHO WE ARE

TallyMap is made and operated by ORYNTLabs LLC, a New Jersey limited liability company ("ORYNTLabs", "we", "us"). This policy covers the TallyMap iPhone app, its widgets, and the website at tallymap.app (together, the "Service"). You can reach us at hello@tallymap.app.

ORYNTLabs is the "controller" of the personal data described here, meaning we decide why and how it is processed. Plaid and Apple also act as independent controllers for the parts they handle (see Section 6).

2.WHAT WE COLLECT

Account information

TallyMap uses Sign in with Apple as its only sign-in method. When you sign in, Apple gives us a stable, app-specific user identifier and, if you choose to share it, your email address (or an Apple "Hide My Email" relay address). We use these to create and authenticate your account. We never see your Apple ID password. Your display name and handle inside the app are derived from your email unless you change them.

Bank transaction data (via Plaid)

If you connect a bank or card, our data provider Plaid Inc. retrieves your transactions and delivers them to the app. For each transaction we receive: the transaction description and merchant name, the amount, the date, Plaid's spending category, the merchant's location (latitude and longitude, when the merchant record includes it), and the name of the institution you connected. We request Plaid's Transactions product only, for US institutions only.

Plaid handles the actual login to your bank. Your bank credentials are entered in Plaid's interface and are never sent to or stored by ORYNTLabs.

Data the app computes

On your phone, TallyMap turns transactions into "places" (a merchant at a location), tally strokes, spending totals by place and period, skip streaks, stickers and badges, and the week and month summaries shown in widgets. Neighborhood labels ("Mission District") are produced by sending merchant coordinates to Apple's reverse-geocoding service. All of this is derived data about your spending and is stored on your device.

Things you enter

Anything you type or choose in the app: check-ins, skips, "not me" flags on transactions, filters, profile changes, and, when friend features are available, the dares, taunts, and messages you send to friends.

Technical data

When the app talks to our backend (hosted on Supabase) the request carries your IP address, a timestamp, and your session token. Supabase keeps standard server logs for a short period for security and debugging. We don't build profiles from these logs.

Notifications

If you allow notifications, the app schedules them on your phone from your own data: a Sunday-evening weekly digest, an evening streak reminder on days you haven't logged a stroke yet, and a nightly check-in while a self-dare you wrote yourself is running. Each one can be switched off in the app, and all of them in iOS Settings. They are local notifications, made on your phone. There is one exception, and only if you ask for it: when a bank you just connected is slow to send its first transactions, the map offers ping me. If you tap it, the app gives our server your phone's push token (an address from Apple's push service) together with the bank connections you're waiting on, and our server sends you one notification through Apple when one of them is ready. That request ends when the notification is sent, when your transactions arrive while the app is open, or after two days.

Background refresh

If Background App Refresh is on, iOS occasionally wakes the app (usually about once a day, on its own schedule) to fetch new transactions from Plaid — the same request the app makes when you open it — so your map and digest are current. You can turn this off for TallyMap in iOS Settings › General › Background App Refresh.

Subscriptions

TallyMap Core is sold through Apple's App Store. Apple handles the payment; we never see your card or billing details. Because bank sync is part of Core, our backend keeps a record of your subscription's status so it connects and syncs banks only for subscribers: which plan (monthly or yearly), Apple's transaction identifier for it, when it expires or its billing grace period ends, whether it renews automatically, and whether it was refunded or revoked. The app sends Apple's signed proof of purchase along with bank requests, purchases are tagged with your TallyMap account identifier so the subscription can be matched to your account, and Apple sends our server signed notices when a subscription renews, lapses, or is refunded. When a subscription ends, we disconnect your banks at Plaid; the data on your phone stays.

3.WHAT WE DON'T COLLECT

• Your phone's location. Map positions come from merchant data in your transactions, not from where your phone is. The optional Exact spots feature (Settings › Map, off by default) asks for Location Services permission so iOS can tell the app where your phone stopped and when; the app uses that only on your phone to match each purchase to the exact store. Visits are never transmitted to us, Plaid, or anyone else, are deleted after 90 days, and you can delete them or turn the feature off at any time. The app works fully without it.
• Your contacts, photos, camera, microphone, or calendar. The app does not request these permissions.
• Bank credentials or account numbers. Those stay with Plaid and your bank.
• Analytics or advertising identifiers. The app contains no analytics, crash-reporting, or advertising SDKs, and does not use the IDFA or track you across other companies' apps and websites. Because we don't track, the app does not show the App Tracking Transparency prompt.

Diagnostics you choose to share. iOS gives the app Apple's own crash and hang reports for your device (MetricKit), and the app keeps a short log of them on your phone. It is never sent automatically. If you tap Share diagnostics (Settings › Your data), you pick where it goes — for example, an email to us. It contains technical details such as stack traces and timings, not your transactions. If we ever add a crash reporter or analytics that sends data on its own, we will update this policy and the App Store privacy label before that version ships.

4.WHERE YOUR DATA LIVES

On your iPhone

Your transactions, places, tally, stickers, and caches are stored in an on-device database protected with iOS Data Protection (the "complete" file-protection class, so the data is encrypted whenever your phone is locked). A small summary (this month's total, stroke counts, streak, and the week's day-by-day state) is shared with the TallyMap widgets through an app group container on the same device. If you use iCloud or encrypted device backups, your device's copy of this data is included in those backups under Apple's terms.

On our backend

Our backend runs on Supabase in the United States. We store there only: your account record (Apple identifier, email if shared, sign-in timestamps), your Core subscription status (see Subscriptions above), and, for each connected bank, the institution name, a sync cursor that tells Plaid where we left off, and the Plaid access token that lets our server request your transactions. For each bank we also keep a few sync flags: when it last synced, whether Plaid has told us new transactions are waiting, and whether the bank needs you to log in again. To avoid paying our data provider twice for the same lookup, our backend also keeps a list of the bank transaction identifiers it has already enriched — identifiers only, no amounts, merchants, places or dates; it is deleted with the bank connection. So that each of your phones receives every transaction, we also keep, per phone, an identifier Apple gives the app for that device (the same on all our apps on that phone, different on every other phone, and not usable to track you across other companies' apps) with the date we first saw it, and for each bank that phone's own position in the bank's update stream. If you disconnect every bank yourself, we note that date so your other phones don't ask you to reconnect. Plaid sends those signals to our server as webhooks; they identify the bank connection, not your transactions. If you tap ping me (see Notifications above), we keep that phone's push token and which APNs environment it belongs to (up to five phones per account), and, until the notification is sent or two days pass, the bank connections you're waiting on. Access tokens are encrypted at rest with a key held only by our server functions, and the table that holds them cannot be read by the app or by any user. Transactions pass through our server to your phone and are not stored there.

5.HOW WE USE IT

We use your data to provide the Service: to sign you in, to fetch your transactions from Plaid and show them as strokes on your map, to compute tallies, streaks, stickers, and digests, to send the notifications you've enabled, to run friend features you opt into, to answer support requests, to keep the Service secure, and to comply with law. We do not use your data for advertising, to build marketing profiles, or to train machine-learning models.

Where a law requires a legal basis, we rely on the performance of our agreement with you (providing the app), our legitimate interests in security and improving the app, and your consent where we ask for it (for example, notifications and bank connections, which you can withdraw at any time).

6.WHO WE SHARE IT WITH

We share data only with the service providers needed to run TallyMap, only as needed to provide it:

We may also disclose data if required by law, subpoena, or court order; to protect the rights, safety, or property of ORYNTLabs, our users, or the public; or as part of a merger, acquisition, or sale of assets, in which case this policy continues to apply to your data and we will notify you of any change in ownership.

7.FRIENDS & DARES

Counts, never amounts. Dares, crews, Spotless Week and invites are opt-in. When you use them:

• Dares and crews. Our backend stores the dare itself (what to skip, how long, the stake), who is in it (by account), the name and emoji you typed for that dare, and one number per member: how many slips so far — plus, for Spotless Week, one yes/no per day. Your phone decides that number from your own transactions; no merchant, place, time or amount is ever sent.
• What members see. Members of a dare see each other's dare names, emoji and counts. Nobody outside the dare sees anything.
• Invites. Every account gets one invite code. If a friend signs in with it, our backend records that the two accounts are linked and, when your friend subscribes, hands each of you a one-time App Store offer code for a free month of Core. Codes carry no name; neither of you is told who the other is. A crew link carries its creator's invite code, so joining through it works like an invite.
• Your profile. The display name you pick, an emoji, your home city (if you set one) and the name you use in dares are stored with your account so a new phone signed in with the same Apple ID gets them back. Your profile photo stays on your phone.
• Regulars (opt-in, off by default). If you turn it on, your phone sends, once a week, how many times you went to each spot that month, with your emoji — never when, never how much. A board for a spot appears only once five or more people have opted in there. Pharmacies, clinics, hospitals, banks, bars, liquor stores, schools, places of worship and adult venues are never reported. Turning it off deletes those rows.

Nothing in this section is shared with anyone until you create a dare, join a crew, redeem or share an invite, or turn Regulars on. You can leave a dare, remove an invite, or turn Regulars off at any time in the app.

8.DELETING YOUR DATA

• Sign out (Settings › Account › Sign out) wipes all financial data from your device: transactions, derived places, the connected-bank list, location caches, your pin corrections, and the on-device visit log. Your account and bank connections remain so you can sign back in.
• Exact spots (Settings → Map) lets you turn location matching off and delete stored visits at any time.
• Disconnect a bank (Settings → Banks → tap the bank) removes TallyMap's access at Plaid and deletes that connection's access token and sync data from our backend. Transactions already on your phone stay there. You can also revoke TallyMap's access at any time from Plaid's portal at my.plaid.com.
• Delete your account (Settings › Danger zone › Delete my account) permanently removes your account record, subscription status, device identifiers, push tokens and stored bank access tokens from our backend, revokes every bank connection at Plaid, and erases the app's data from your device. This cannot be undone.

You don't need to email us to do any of the above, but you can (hello@tallymap.app) and we'll help.

9.RETENTION

Transactions and derived data live on your device until you sign out, delete your account, or delete the app. Backend account records, subscription status, device identifiers and encrypted access tokens are kept until you delete your account (access tokens also go when your Core subscription ends and we disconnect your banks). A push token goes when you sign out on that phone or delete your account. Deleting your account does not cancel an App Store subscription; cancel it in your Apple ID settings. Supabase's server logs and database backups are retained for a limited period (days to a few weeks, depending on the plan) and then overwritten; deleted accounts disappear from backups on that schedule. Support emails are kept as long as needed to resolve your request.

10.SECURITY

We designed TallyMap so that the most sensitive data never reaches us. Bank credentials stay with Plaid. Transactions stay on your phone under iOS Data Protection. Plaid access tokens are encrypted at rest on our server, readable only by our server functions, and held in a table with no client access. All traffic between the app, our backend, and Plaid uses TLS. Your session is protected by Apple's sign-in and expires automatically. We ran a security review of the backend and the app's data lifecycle before beta and fixed everything it found.

No system is perfectly secure. If we learn of a breach that affects your data, we will notify you and any regulators as required by law.

11.YOUR RIGHTS

Depending on where you live (including California, Colorado, Connecticut, Virginia, Utah, and other US states with privacy laws, and the EU/UK if you use the app there), you may have the right to access, correct, delete, or receive a copy of your personal data, to opt out of sales or targeted advertising (we do neither), and to not be discriminated against for exercising these rights.

Most of these you can exercise yourself: everything TallyMap knows about your spending is on your phone, and account deletion is one tap away. For anything else, email hello@tallymap.app from the address on your account and we'll respond within the time required by your local law (generally 45 days). If we deny a request, you can appeal by replying to our response. You may also authorize an agent to make a request for you; we'll ask for proof of that authorization.

If you're in the EU or UK you may lodge a complaint with your local data protection authority. Data we hold is processed in the United States; by using the Service you understand that your data is transferred there.

12.CHILDREN

TallyMap is for adults. You must be 18 or older to create an account or connect a bank. The app is not directed to anyone under 18, and we do not knowingly collect their data. If you believe someone under 18 has created an account, contact us and we will delete it.

13.THIS WEBSITE

tallymap.app is a static site hosted on Vercel. The site sets one first-party cookie on /invite and /dare that remembers a code for 24 hours; /invite asks TallyMap's own server whether a code exists. No third-party cookies, no analytics, no ads. Vercel keeps standard access logs (IP address, browser, pages requested) for security and capacity purposes. Fonts, images, and videos are served from our own domain.

14.CHANGES

We'll update this policy as the app evolves (for example, if friend features launch). We'll post the new version here with a new effective date, and for material changes we'll tell you in the app before they take effect. Continuing to use TallyMap after a change means you accept the updated policy.

15.CONTACT

Questions, requests, or complaints about privacy: hello@tallymap.app. Please include "Privacy" in the subject line so we can route it quickly.

ORYNTLabs LLC · TallyMap · New Jersey, USA