Privacy Policy

Last updated: March 8, 2026

This privacy policy describes how Mayank Agrawal ("we", "us", or "our"), the developer of TallyTalk, collects, uses, stores, shares, and protects your personal information when you use our mobile application. TallyTalk is a voice-based expense tracking app available on iOS and Android.

By using TallyTalk, you agree to the collection and use of information as described in this policy.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address — provided directly or via Google or Apple Sign-In
• Authentication credentials — passwords are hashed and never stored in plain text; OAuth tokens are managed securely by our authentication provider
• User ID — a unique identifier assigned to your account
• Account creation date

1.2 Financial Data

To provide the app's core functionality, we collect and store:

• Expense and income amounts
• Transaction descriptions
• Transaction categories
• Transaction dates
• Transaction type (expense or income)

1.3 Voice and Audio Data

When you use the voice recording feature:

• Audio is recorded locally on your device in M4A format
• The audio is converted to base64 and transmitted to our server for processing
• Our server sends the audio to OpenAI's Whisper API for speech-to-text transcription
• The resulting text transcript is stored with your expense record
• Audio files are not permanently stored — they are deleted from your device after processing, and OpenAI does not retain audio data submitted via their API

1.4 Voice Transcripts

The text transcription of your voice recording is stored in our database alongside the associated expense entry. This allows you to review what was spoken when the expense was created.

1.5 User Preferences

We store the following preferences locally on your device:

• Currency preference
• Voice language preference
• Onboarding completion status

These preferences are not transmitted to our servers.

1.6 Information We Do Not Collect

TallyTalk does not collect:

• Location data
• Contacts or address book data
• Photos, videos, or files (other than voice recordings you initiate)
• Device identifiers for advertising purposes
• Browsing history
• Analytics or usage tracking data

2. How We Use Your Information

• Expense tracking: To process, store, and display your financial transaction data
• Voice processing: To convert your voice recordings into text and extract expense details
• Authentication: To create and manage your account and keep your data secure
• Data synchronization: To sync your data across devices when you are signed in

We do not use your data for advertising, profiling, or selling to third parties.

3. How We Share Your Information

We share your data only with the following third-party service providers, solely for the purpose of operating the app:

We do not sell, rent, or trade your personal information to any third party.

3.1 Third-Party Data Protection Standards

All third-party service providers used by TallyTalk are required to provide the same or equal level of protection for your personal data as described in this policy. Specifically:

• OpenAI, Inc. — Data submitted via the API is not used to train or improve OpenAI's models. API data may be retained for up to 30 days solely for abuse and misuse monitoring, after which it is deleted. All transmissions use HTTPS/TLS encryption. OpenAI maintains industry-standard security practices. See OpenAI's API Data Usage Policies for details.
• Supabase, Inc. — SOC 2 Type II certified. Provides encryption at rest and in transit, row-level security policies, and regular security audits. Your data is isolated and accessible only to your authenticated account.
• Google / Apple (authentication only) — Only authentication tokens are shared when you use Google or Apple Sign-In. No financial data, voice recordings, or personal content is sent to these providers.

4. Device Permissions

4.1 Microphone

TallyTalk requires microphone access to record voice memos for expense tracking. Audio is only recorded when you explicitly tap the record button. We do not record audio in the background or without your knowledge.

4.2 Internet

Required to sync your data, process voice recordings, and authenticate your account.

5. Data Storage and Security

5.1 In Transit

All data transmitted between your device and our servers uses HTTPS/TLS encryption.

5.2 At Rest

• Server-side: Your data is stored in a Supabase-managed PostgreSQL database with encryption at rest and row-level security policies that ensure you can only access your own data.
• On-device: Session tokens and preferences are stored using platform-standard secure storage mechanisms (Keychain on iOS, encrypted SharedPreferences on Android).

5.3 Passwords

Passwords are hashed using bcrypt before storage. We never store or have access to your plain-text password.

5.4 Audio Files

Voice recordings are temporary. They exist on your device only during processing and are deleted immediately after the transcription is complete. Audio is not stored on our servers.

6. Data Retention and Deletion

6.1 Retention

We retain your account and financial data for as long as your account is active. Voice audio files are not retained — only the resulting text transcript is stored.

6.2 Account Deletion

You can delete your account at any time from within the app (Settings > Delete Account). When you delete your account:

• All your expense and income records are permanently deleted
• All custom categories you created are permanently deleted
• Your authentication account and associated data are permanently deleted
• Local preferences on your device are cleared upon sign-out

Account deletion is immediate and irreversible. We do not retain your data after deletion.

6.3 Sign Out

Signing out clears your local session data. Your account and stored data remain on our servers and are accessible when you sign back in.

7. Your Rights

You have the right to:

• Access your personal data — all your data is visible within the app
• Delete your account and all associated data — available in app Settings
• Withdraw consent — you can revoke AI voice processing consent at any time in the app (Settings > Privacy & Data > AI Voice Processing); you can also revoke microphone permission through your device settings. Revoking consent does not affect other app functionality
• Data portability — contact us to request an export of your data

8. Children's Privacy

TallyTalk is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected data from a child under 13, please contact us and we will promptly delete it.

9. Home Screen Widget

TallyTalk offers an optional home screen widget ("QuickRecord") for quick access to the voice recording feature. The widget does not access, display, or transmit any user data. It simply provides a shortcut to open the app's recording screen.

10. Changes to This Policy

We may update this privacy policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the app after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions, concerns, or requests regarding this privacy policy or your personal data, please contact us:

Developer: Mayank Agrawal

Email: magrawal2592000@gmail.com