1. Who we are and what this policy covers

TallyZap provides tools for contractors and small businesses to record expenses, manage projects, coordinate crew work, and process voice, receipt, and media inputs. This policy applies to the TallyZap iOS app, authenticated cloud features, our website, support communications, and the services that process data on our behalf.

2. Information we collect and process

Depending on how you use TallyZap, we may process:

• Account and identity information: email address, display name, authentication identifiers, Sign in with Apple information, company membership, role, and invitation status.
• Business information: projects, clients, expenses, payments, quotes, tax fields, schedules, reminders, categories, notes, crew assignments, field updates, and reports.
• User content: voice recordings, transcripts, receipt images, photos, videos, documents, captions, and information extracted from those items.
• Technical information: device type, operating system, app version, network information, IP address, request timestamps, authorization data, and sanitized crash or performance diagnostics.
• Location information: coarse, foreground location when you allow TallyZap to retrieve local weather. TallyZap does not continuously track background location.
• Communications: information you include in support, privacy, or other messages to us.

Please avoid including unnecessary sensitive personal information in TallyZap.

3. How we collect and use information

We collect information when you create or sign in to an account, use app features, upload content, join a company, accept a crew invitation, or contact us. We use it to:

• authenticate users and enforce company and crew permissions;
• synchronize authorized records across devices and cloud services;
• create, display, edit, export, and delete records at your direction;
• transcribe voice recordings and extract information from voice or receipts;
• store selected media when file backup is enabled;
• send crew invitations and service communications;
• provide local weather after you permit foreground location access;
• operate, secure, troubleshoot, and improve service reliability; and
• respond to support and privacy requests or comply with applicable law.

We do not sell personal information and do not use TallyZap business information for cross-app advertising or behavioural profiling.

4. Accounts, cloud synchronization, and Crew Mode

TallyZap supports authenticated accounts backed by Supabase. When you sign in, your identity, profile, company membership, invitations, assignments, and authorized business records may be stored or synchronized in Supabase. Some records also remain on your device.

Crew members receive access only to the companies, projects, day plans, media, and updates allowed by their role and assignments. Owners and administrators manage invitations, access, and approvals.

5. Voice, receipts, and AI processing

The microphone is used only after you start a recording and is not used in the background. When you submit a voice recording or receipt image, the content may be transmitted through TallyZap's Render-hosted API to OpenAI for transcription or structured field extraction. Temporary local recordings are deleted after processing or cancellation.

OpenAI API data may be retained in abuse-monitoring logs for up to 30 days, subject to the applicable service configuration and provider policy. Review generated fields before saving or relying on them.

6. Photos, files, and exports

Receipt photos, jobsite photos, videos, and project documents remain on your device unless you enable file backup. When enabled, selected media is stored in private object storage tied to your authenticated account and company permissions.

CSV and PDF exports are created on your device and leave TallyZap only when you choose a destination through the iOS share sheet. You control the security, storage, sharing, and deletion of an exported file after it leaves TallyZap.

7. Diagnostics and service providers

TallyZap uses Sentry for sanitized crash and performance monitoring. Diagnostic reports are configured not to include expense details, photos, transcripts, or your sign-in email.

We rely on service providers that include:

• Supabase for authentication, database services, and authorization;
• Render for application hosting and backend API services;
• OpenAI for transcription and structured extraction;
• Sentry for sanitized diagnostics;
• Open-Meteo for weather information; and
• email delivery and private object-storage providers where those features are enabled.

Providers process information under their own security, retention, and contractual practices. Information may be processed in Canada, the United States, or other jurisdictions and may be subject to the laws of those places.

8. Retention and account deletion

We retain information only as long as reasonably necessary to provide and secure the service, meet legal obligations, and resolve legitimate disputes. Local records remain on your device until you delete them, remove relevant app data, or uninstall the app. Cloud records generally remain while your account is active.

You can request account deletion from Settings in the app. After server confirmation, TallyZap removes your sign-in identity, revokes Sign in with Apple when applicable, revokes company and crew access, and erases the local account snapshot on that device. If you are the sole owner of a company, certain financial or operational records may be retained and minimized where required for tax, audit, accounting, fraud-prevention, or other legal obligations.

Deleting your account does not delete files or messages you previously exported or shared outside TallyZap. Service providers may retain limited security or technical logs under their policies.

9. Security

We use reasonable administrative, technical, and organizational safeguards appropriate to the sensitivity of the information, including encrypted transport, authenticated access controls, company-scoped authorization, and restricted service credentials. No electronic service can guarantee absolute security.

You are responsible for protecting access to your device, Apple ID, email account, and exported files.

10. Your Canadian privacy rights

Subject to applicable Canadian privacy law and permitted exceptions, you may request access to personal information under our control, correction of inaccurate information, deletion where appropriate, withdrawal of consent for future processing, or information about our privacy practices.

We may need to verify your identity before completing a request. If you are dissatisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.

11. Children

TallyZap is intended for adults managing business operations and is not directed to children. If you believe a child has provided personal information through the service, contact us so we can assess and address the situation.

12. Changes to this policy

We may update this policy as the product, providers, or legal requirements change. We will post the revised policy at this address and update the effective date. Material changes may also be communicated through the app or website where appropriate.

13. Contact

Privacy questions and requests may be directed to:

14. Nature of the service

TallyZap is an operational aid and does not provide accounting, tax, legal, financial, workplace-safety, or emergency advice. You remain responsible for reviewing entries and keeping the original records required for your circumstances.