Privacy Policy

Effective November 6, 2026

TallyBeacon is a personal-finance app: you record your accounts and transactions, and it helps you see where your money is headed. It's run by TallyBeacon LLC ("TallyBeacon", "we" or "us"), which is responsible for your data. This page explains what we collect, why, who helps us run the service, and what you can ask us to do with your data. We keep it short and specific on purpose.

The short version

• Your financial data is yours. We use it only to run TallyBeacon for you.
• We never sell your data, and never use it for advertising.
• We never ask for your bank password. You add data yourself, import files you download from your bank, or, if you choose, connect your bank. You sign in to your bank through Plaid, so your bank password never reaches us, and TallyBeacon can only read your transactions, never move money.
• If you use the desktop app, your financial records stay on your own computer, not on our servers.
• You can download a copy of all your data yourself at any time, on any plan: in the app, open Export. You can delete your account, and everything in it, yourself at any time.

What we collect

Your account

• Name and email address, to identify your account and send you sign-in codes.
• Your password, stored only as a one-way scrambled form (a salted scrypt hash). We can't see it or recover it.
• A profile picture, if you add one: only you see it, and we keep a small copy without the photo's location or camera details.
• How you receive sign-in codes: by email; from an authenticator app (we store the app's secret key); or by text message, if you choose that, in which case we store your mobile number.
• If you sign in with Google: Google tells us your name, your email address (which Google has verified) and a permanent Google account ID. We don't receive your Google password or anything else from your Google account.
• If you sign in with Apple: Apple tells us a permanent Apple account ID, your email address (or, if you choose "Hide My Email", a private address at privaterelay.appleid.com that Apple forwards to you), and the first time only, the name you choose to share. We don't receive your Apple password or anything else from your Apple account.

Your financial records

Everything you put into TallyBeacon: accounts and their balances, transactions, categories, payees, recurring bills and paychecks, reconciliations, and any investment records. When you import a bank file (QIF, OFX, QFX or CSV), we read it, hold the parsed rows in memory for up to an hour while you review them, and then keep only what you choose to import, plus the file's name. We don't keep the file itself.

If you connect a bank

Connecting a bank is optional, and part of the Plus plan, and you choose which of its accounts TallyBeacon reads. You sign in to your bank in a window run by Plaid, a company that connects apps to banks. Your bank username and password go to Plaid and your bank, never to us. From Plaid we keep:

• your bank's name, and each account's name, type (such as checking or credit card) and last four digits;
• for each account you turn syncing on for, its posted transactions: date, amount, description and merchant name. Pending transactions are skipped.
• for each investment account you turn syncing on for, if you allow investments when you connect: what it holds (each security's name and ticker symbol, the number of shares, the bank's price and its date, and what you paid when the bank says), and its investment transactions from up to the last 24 months, such as buys, sales, dividends, contributions, fees and interest, each with its date, shares, price and amount.

To keep reading new transactions, we keep a key Plaid gives us for the connection (an "access token"), encrypted with a key stored separately from the database. It lets us read transactions and, for investment accounts, holdings, nothing else: it can't move money, trade or change anything at your bank. We check for new transactions when Plaid tells us there are some, otherwise about every 4 hours, and whenever you choose Sync now. New transactions, investment ones included, wait for you to review them, as an imported file does, and only the ones you accept are added to your records. What an investment account holds is kept with the connection, to show you any shares your records don't account for, and the bank's prices are added to that investment's price history.

You can disconnect a bank at any time under Bank connections. That ends the connection at Plaid, and deletes the access token, what its investment accounts hold, and any transactions still waiting for review. Transactions and prices you've already added stay in your records until you delete them. Deleting your account disconnects every bank first. Plaid handles the data it receives under its own End User Privacy Policy.

We also keep bank data only while there's a reason to:

• If your account moves to Free, syncing pauses. After 30 days without Plus, we end the connection at Plaid and delete it as if you'd disconnected it.
• If access is ended at your bank or at Plaid, we delete the access token, the bank's accounts, what its investment accounts hold and any transactions waiting for review straight away.
• Transactions waiting for review are deleted once you've added them to your records.

Sign-in and security records

• Sessions: when you sign in we set a cookie that keeps you signed in, and record when the session started and last used, and which browser it was (the "user agent"). Only a scrambled form of the cookie's value is stored.
• Sign-in codes: stored scrambled, expire after 10 minutes, and can only be used once.
• Failed sign-in attempts, so we can lock an account after repeated wrong guesses.
• Passkeys: if you add one, we keep its public key, a name for it (such as "Chrome on Windows"), and when it was added and last used. Your fingerprint, face or PIN never leaves your device, and neither does the passkey's private key.
• Trusted browsers: if you choose "Trust this browser for 30 days" when entering a sign-in code, we record which browser it is (its user agent) and when it was trusted and last used, so that browser can skip the code until then. You can see and forget them under Account & security.
• What you agreed to: when you agreed to our Terms of Service and this policy, and which version; and each time you agree to connect a bank through Plaid, with the version you saw and which browser you used.
• IP addresses: used briefly to limit repeated sign-in attempts, and recorded in our servers' short-lived request logs to keep the service secure and working.

If you ask for an invite

While TallyBeacon is invitation-only, you can leave your email address, and your first name if you like, to ask for an invite. We use it only to send you that invite, and send nothing else to it. We delete it once you're invited or we decide not to invite you, or sooner if you ask us to.

If you ask to hear about something new

Some of our pages let you leave your email address to hear when something we're considering is ready, such as the desktop app for Windows. We keep the address, which page you left it on, and when. We use it only to write to you once when that thing is ready, and send nothing else to it. We delete it after that email, if we decide not to build it, when you delete an account with the same address, or sooner if you ask us to.

If you book a call

You can book a free video call with Robert Knox, who built TallyBeacon, to move your history over from another app. You book on a Google Calendar page, where you give your name and email address and tell us which app you're moving from and how you heard about TallyBeacon. The call runs on Google Meet.

We use these details to hold the call and follow up about it, and your answer about how you heard of us to see which of our efforts are working. During the call you may share your screen or a file, so Robert may see your financial records. He looks at them only to help you, and we don't record the call. We delete the booking within 12 months of the call, or sooner if you ask us to.

If you subscribe to Plus

Payments are handled by Stripe. Your card details and billing address go straight to Stripe and never reach us. From Stripe we keep your Stripe customer ID, which plan you're on, whether your subscription is active, and when it renews or ends, so the app knows you have Plus. Stripe sends your receipts, and keeps a record of each payment as tax and accounting laws require.

If you share a household

On Plus, you can invite one partner to share your household. We keep the email address you invite, the access you chose (full or view-only), and when the invite was sent, when it runs out and when it was accepted. An invite that isn't accepted lapses after 14 days.

Once your partner joins, they see everything in your financial records, as you do: every account and its balance, transactions, categories, payees and rules, bills and paychecks, budgets, savings goals, investments, reports, the forecast and its alerts, and the names of the banks you've connected and their accounts. They can download your records as a spreadsheet or QIF files. With full access they can also add, change and delete them; with view-only access they can't. Your partner can choose to get your household's alerts by email at their own address and as notifications on their own devices.

Your partner doesn't see your sign-in or security settings, your mobile number, your profile picture, or your plan and billing, and can't download your full backup file. They see your name and email address, and you see theirs. Any accounts your partner keeps of their own stay theirs: you never see them.

Either of you can end the sharing at any time, and it ends if either of you deletes your account. Your partner then loses access straight away. Anything they added stays in your records.

If you use the desktop app

TallyBeacon's desktop app keeps your financial records on your own computer, not on our servers. We can't see them, and we have no copy, so we can't recover them for you. The app makes its own backups, to a folder you choose. It doesn't add encryption of its own, so anyone who can open your computer or those backups can read them: use a password and your computer's disk encryption, and keep the backups somewhere safe. Parts of this policy about records kept on our servers, including our backups and staff access, apply to TallyBeacon on the web, not to what's in the app.

The app still talks to our site in a few ways. None of these include your accounts, amounts or payees, unless you type them into a message to us:

• Approving your computer: you do this once, signed in to your TallyBeacon account in your browser. We keep the name your computer gives itself (which can include your own name), whether it's a Mac or a Windows computer, when you approved it, the last time it checked your plan, and a scrambled form of the token that identifies it.
• Your plan: the app asks us for your plan when it starts and regularly while it runs. We send back your account's name, email and plan, signed so the app can trust it, and the app keeps them on your computer.
• Updates: when it starts and once a day, the app asks whether there's a newer version, saying which version it is and what kind of computer it's on. Updates are downloaded from our download service, which runs on AWS.
• Help & contact: a message you send from the app comes to us through our site, with the screen you were on.

The milestones and days of use described under How you use TallyBeacon stay on your computer when you use the app; they aren't sent to us. Deleting the app doesn't delete your records or backups: they stay on your computer until you remove them. Deleting your TallyBeacon account removes what we keep about your computers, and the records on your computer stay there. To unlink a computer without deleting your account, email [email protected].

How you use TallyBeacon

To see whether TallyBeacon is working for people, we record milestones and the days you use the app: for example, that you added a checking account, finished an import of a QIF file, or viewed your upcoming cash flow. These records never include amounts, payees, account names or anything else from your finances. They stay in our own database; no analytics or advertising company receives them.

When you sign up, we also note how you found us: the campaign named in the link you followed (for example, a newsletter or a launch post), or the website that linked to us, by its name only. We use it to count which links bring people to TallyBeacon.

In your browser

Besides the sign-in cookie (and a short-lived one while you sign in with Google or Apple, and one that lasts 30 days on a browser you choose to trust), TallyBeacon saves a few display preferences in your browser, such as light or dark mode. These never leave your device. If you arrive from a campaign link or another website, TallyBeacon also notes which in your browser for 30 days; it reaches us only if you sign up. We use no advertising or tracking cookies.

How we use it

Only to run TallyBeacon: to sign you in and keep your account secure, to store and show your records, to calculate forecasts and summaries for you, to bring in transactions from the banks you connect, and to send the emails (or texts) the service needs, such as sign-in codes. We don't use your financial data to market anything to you, and we don't look at it except when you ask us to help with a problem, or when the law requires it.

Who helps us run TallyBeacon

A few companies process data on our behalf, only to provide their part of the service:

• Amazon Web Services (United States): hosts the app and its database, and sends our emails (Amazon SES) and text messages (Amazon SNS).
• Cloudflare: sits in front of our servers to protect them from attacks and deliver pages quickly, and counts visits anonymously (Cloudflare Web Analytics, which uses no cookies).
• Google: if you choose "Continue with Google", to confirm who you are, and if you book a call, to run the booking page and the video call. Our support mailbox is also run on Google Workspace, so emails you send us are stored there.
• Apple: only if you choose "Continue with Apple", to confirm who you are. If you hide your email, our emails to you pass through Apple's relay service.
• Plaid (United States): only if you connect a bank, to connect to it and pass us the account details and transactions described above. Plaid sees your bank sign-in; we don't.
• Stripe (United States): only if you subscribe to Plus, to take and manage payments. Your card details go to Stripe, not to us.

We don't sell or rent your data, and we don't share it with anyone else unless the law requires it (for example, a valid court order), or to protect the safety of our users or the service.

Mobile numbers and text-message consent are never shared with third parties or affiliates for marketing or promotional purposes. We use your number only to send the sign-in codes you asked for; reply STOP to any text to stop them.

Where it's kept, and how it's protected

On the web, your data is stored in the United States, in AWS's US East region. In the desktop app, it's on your own computer (If you use the desktop app). Every connection to TallyBeacon is encrypted (HTTPS). Each person can only ever reach their own records, and those of a household they've been invited to share (If you share a household). The database is not reachable from the internet, only by our own servers. To help you with your account, TallyBeacon staff can see how it's set up (your name and email, how you sign in, your plan, when you last used it, and how many accounts and transactions it holds), but not what's in it: no account names, amounts or payees. Every time staff open an account or change something for you is logged. We back it up daily and keep backups for 7 days. No system is perfectly secure, but we work to protect your data and will tell you promptly if a breach affects it.

How long we keep it

As long as your account is open. When you delete your account (or ask us to), it and all your records are deleted from the live database straight away, along with your invitation if you had one, and they disappear from our backups within 7 days as those roll over. What we keep afterwards is only daily counts that don't identify anyone, such as how many people used TallyBeacon on a given day. Request logs are kept for a few days only. Deleting your account also cancels any Plus subscription; Stripe keeps its records of payments already made, as the law requires. A connected bank can be removed sooner, as If you connect a bank describes.

Your choices and rights

• See and correct your records at any time in the app.
• Delete your account yourself: in the app, open Account & security (under your name) and choose Delete your account. It takes effect immediately.
• Get a copy of your data yourself: in the app, open Export to download everything (a backup file, a spreadsheet of your transactions, or QIF files for another finance app). It's free on every plan.
• Ask us for a copy or to delete your data for you: email [email protected] from the address on your account. We'll reply within 30 days, usually much sooner.
• Depending on where you live, you may have further rights over your data. Write to us and we'll help.

Children

TallyBeacon is meant for adults, and not for anyone under 18. We don't knowingly collect data from children. If you believe a child has made an account, tell us and we'll delete it.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change matters to how your data is used, we'll email you before it takes effect.

Contact

Privacy questions and requests: [email protected]. Anything else: [email protected]. To report a security problem: [email protected]. By phone: 260-203-0207. By mail: TallyBeacon LLC, 6435 W Jefferson Blvd PMB #380, Fort Wayne, IN 46804.