Tally privacy notice

Who handles your information

FierceSpeed, based in New Zealand, provides Tally. Use the contact form for privacy questions, access or correction requests, or help deleting an account. The New Zealand Privacy Act 2020 applies. You can also contact the Office of the Privacy Commissioner.

What we collect and why

Google or email sign-in supplies your account identifier, email address and name so we can authenticate you and manage access. We keep your terms acceptance version and time. Workspace membership, invitations, projects, clients, descriptions, time entries, rates and exports support your timesheets and collaboration.

We store check-in text, settings and workday status. Earlier exercise lists and movement records remain private and available for export; current Tally versions no longer record new movement activity. Desktop device type and last-seen time help avoid duplicate reminders. Security and operational records may include request metadata, IP addresses, authentication events and changes to workspace records, to protect and run the service.

Required account and workspace information is needed to provide those features. Speech, movement records and integrations are optional. Do not include sensitive information in a time note unless it is necessary and you have authority to share it.

Workspace visibility

You can see your own time. Workspace owners and administrators can see team time; managers can see time for projects they manage. Membership information is visible as needed for workspace features. Movement records, check-in drafts and preferences are personal records and are not included in the team's time reports. Authorised service access may still be needed to provide support or meet legal obligations.

A workspace administrator may invite you using your email address or add information about clients and projects. If you receive an unexpected invitation, you can ignore it or contact us. Administrators must have authority to provide information about other people and give any required notices.

Where information is processed

Tally uses Google Firebase Authentication, Firestore, Firebase Hosting and a Cloud Run API. Application records and API processing are configured in Sydney, Australia. Authentication, hosting, email delivery and operational infrastructure may process information in other countries under the providers' arrangements. Public installer files are stored in a United States region; they contain application code, not your workspace data.

Sign-in links and invitations are delivered through Resend. Google and Resend receive the information needed to provide their services. Records travel over encrypted connections, but Tally is not end-to-end encrypted. We restrict access using authentication, workspace permissions and server-side checks.

Your device and optional speech

The web app caches records in browser storage; desktop apps use a local database so you can work offline. Protect your device and account, particularly on a shared computer.

Built-in speech is off by default. If you enable it with your own Deepgram API key, audio goes directly to Deepgram for transcription under your provider agreement. Tally does not upload that key or retain audio on its server. Saved transcripts become check-in records. On desktop the speech key is held in the operating system's credential storage; on the web it stays in the browser tab's session storage.

If you use Wispr Flow or another dictation tool, that tool handles your audio under its own settings and privacy terms. Tally receives the text you enter. No Tally speech provider is required for that option.

Other integrations

When you authorise an MCP client, it can read or change records within the selected workspace and permissions. Information sent to that client is governed by its own terms; revoke unused connections in Tally. Calendar access, when available and connected, uses busy/free periods to avoid reminders during meetings. You can disconnect optional services.

Retention, access and deletion

We keep account and workspace records while needed to provide the service. You can export personal records from Settings, correct time entries and revoke integrations. Use Settings to delete an account or contact us for help. Owners must delete owned workspaces first; that removes their shared workspace records too.

Account deletion removes your personal records, memberships and saved credentials from Tally. Client and project records shared with a continuing workspace can remain under its owner. Previously downloaded exports, offline copies on other devices, operational logs retained for security or legal needs, and information already sent to an external provider may not disappear immediately or be within our control. We do not promise deletion from another person's copies.

Advertising and changes

Tally does not sell personal information or use advertising trackers. Storage used for sign-in, settings and offline access is needed to operate the app. We will update this notice when processing changes materially and provide appropriate notice in the app. The related terms and conditions explain account and workspace responsibilities.