Privacy Policy

1Who we are

Tally is published by MTS Studio, an independent developer, who is responsible for the personal data described in this policy. In this policy we, us and our mean MTS Studio.

For anything relating to your privacy, write to [email protected].

2What we collect

Information you give us

Information collected automatically

3What we do not collect

To be specific about what is absent, Tally does not:

• contain any advertising SDK, and shows no ads;
• contain any analytics or crash-reporting SDK that profiles you;
• read your advertising ID, device serial number, IMEI or MAC address;
• collect your precise or approximate location;
• read your contacts, calendar, call log, SMS, photo library or files;
• record audio or video, or keep any camera image;
• track you across other apps or websites; or
• ask for payment card or financial details.

4Device permissions

5How we use it

We use the information above only to:

• run the app - create events, record counts, and sync them between the devices counting the same event;
• identify you, keep you signed in, and let you recover a forgotten password;
• show a community its members, events and announcements;
• compile and email the attendance report a community asks for;
• enforce rate limits, such as the interval between report requests;
• answer your support messages;
• diagnose faults, keep the service secure, and investigate abuse; and
• comply with the law.

We do not use your information for advertising, and we do not make automated decisions about you that produce legal or similarly significant effects.

6Why we are allowed to

Where the law requires us to identify a legal basis for using your information, we rely on:

• Performance of a contract - to give you the service you asked for when you accepted the Terms of Service: your account, your events, your communities, your reports.
• Our legitimate interests - keeping the service secure and available, preventing abuse, and improving the app. We rely on this only where it does not override your rights.
• Your consent - for the camera, which your device asks you to grant and which you can withdraw at any time in your device settings.
• Legal obligation - where we must retain or disclose information by law.

7Who else sees it

We share information only in these situations:

• Other members of your community. Community events, groups, item names, counts, announcements and the member list are visible to the people in that community. This is the point of a community - please treat anything you put there as shared.
• Google Firebase. Community announcements are stored in Google's Cloud Firestore. Google processes that data on our behalf, under its own terms.
• Our email provider. Verification codes, password resets and attendance reports are delivered by email, which means the message and the recipient address pass through a mail service.
• Hosting and infrastructure. The providers that run our servers necessarily hold the data stored on them, and act on our instructions.
• Legal requests. If we are required by valid legal process, or need to protect someone's safety or our legal rights, we may disclose information. Where we are permitted to tell you, we will.
• A change of hands. If Tally is ever transferred to another developer or organisation, your data may transfer with it. We will tell you first, and this policy will continue to apply until you are given a new one.

We do not sell personal information, and we do not share it for advertising.

8Information about other people

If you believe a community has recorded something about you through Tally, contact that community first - they control the record. If you cannot reach them, write to us at [email protected] and we will help where we reasonably can.

9Data kept on your device

Tally stores a small amount of data in its own private storage on your device:

• the random device identifier described above;
• your light or dark theme preference; and
• the time until which a community can next request a report, so the app can show a countdown without asking the server.

This data stays on your device. You can remove all of it by clearing the app's data or uninstalling Tally - but read the note in the Terms first, because clearing the device identifier also ends your ability to edit events you created without an account.

10How long we keep it

• Account information - for as long as your account exists, and then deleted or anonymised when you delete it.
• Events, counts and communities - for as long as the community keeps them, because they are that community's records rather than only yours. Deleting your own account does not delete the community's history.
• Announcements - until deleted from the community.
• Verification and reset codes - short-lived; they expire soon after being issued.
• Connection records - kept for a limited period for security and troubleshooting, then discarded.
• Emails we send - once a report or code has been delivered, the copy in your mailbox is yours and outside our control.

Backups are cycled on a routine schedule, so deleted data may persist in a backup briefly before ageing out.

11Your rights and choices

In the app, right now

• See and correct your details - open Profile to review or change your name and email.
• Change your password - from Profile, or by using "forgot password" at sign-in.
• Delete your account - Profile → Delete Account. You will be asked to confirm, and the deletion is permanent. If you have already uninstalled the app or cannot sign in, request deletion here instead.
• Withdraw camera access - in your device's app settings. Tally will fall back to entering event codes by hand.
• Use Tally without an account - simply do not register.

By writing to us

Depending on where you live, you may also have the right to ask for a copy of your information, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable form. To exercise any of these, email [email protected] from the address on your account.

We will respond within 30 days. We may need to verify your identity first, and we may decline a request where the law allows - for example where it would expose another person's information, or where a community's own records must be retained. If we decline, we will tell you why.

Exercising these rights costs nothing and will not cause us to treat you differently. If you are unhappy with our response, you may complain to the data protection authority where you live.

12How we protect it

The measures we take include:

• encrypting all traffic between the app and our servers with HTTPS/TLS;
• storing passwords in protected form rather than as readable text;
• authenticating requests with a signed token that expires, rather than resending your password;
• verifying email addresses with a one-time code before an account becomes usable;
• limiting the rate of sensitive operations, such as report requests; and
• restricting server access to those who need it.

No service can promise perfect security, and we do not. What we can promise is that if a breach affects your personal data and creates a real risk to you, we will notify you and the relevant authority as the law requires, and tell you what to do about it.

13Children

Tally is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us information, write to [email protected] and we will delete it.

Note that a community counting attendance may be counting children. Those counts are the community's records, and section 8 applies to them.

Our Child Safety Standards set out what we prohibit in relation to child sexual abuse and exploitation, how to report it, and who to contact.

14Where data is processed

Our servers and the services we rely on - including Google Firebase and our email provider - operate from data centres in more than one country, so your information may be stored or processed outside the country you live in. Wherever it is processed, this policy applies to it, and we require our providers to protect it to a comparable standard.

15Changes to this policy

We will update this policy when the app changes what it collects or how it uses data. The "Last updated" date at the top always reflects the current version. If a change is significant - new data collected, a new purpose, or a new category of recipient - we will give notice in the app or by email before it takes effect.

16Contact us