Privacy Policy

1. Who this policy covers

This policy explains how TallySmarts ("we," "us") collects, uses, and protects your personal information when you use the TallySmarts app. TallySmarts is operated by Griko Pty Ltd. If you have questions about this policy or your data, contact us at admin@griko.com.au.

2. What we collect

• Account information — your first name, last name, email address, and password (stored securely hashed; we never see or store your actual password)
• Financial information you enter — transactions, categories, budgets, bills, recurring transactions, account names and balances, and net worth items (assets and liabilities) that you manually enter or import via CSV file
• Technical information — standard information collected automatically by our hosting and security providers, such as IP address and browser type, used only to keep the app secure and running
• Usage statistics — anonymous counts of which pages in the app are visited, collected without cookies and not linked to your account or your financial information

TallySmarts does not connect directly to your bank account and cannot move money. All financial data comes from information you type in yourself or upload from a CSV file you download from your own bank.

3. How we use your information

• To provide the TallySmarts service — storing and displaying your data back to you, and only to you
• To keep the app secure, including detecting and blocking automated bot activity on signup and login
• To send essential account emails, such as email verification and password reset links
• To send reminders you've turned on — bill and card payment reminder emails, net worth update reminders, and push notifications on devices where you've allowed them. You can turn any of these off at any time
• To understand which parts of the app are used most, so we know what to improve

We do not use your data for advertising, and we do not sell your data to anyone.

4. Who we share it with

We use the following service providers to run TallySmarts. Each one processes data only to provide their service to us — none of them may use your data for their own purposes:

• Supabase — hosts our database and handles account login/authentication
• Vercel — hosts the TallySmarts application itself, and provides the anonymous page-visit statistics described above
• Cloudflare — provides bot and abuse protection on our signup and login forms
• Google — lets you sign in with your Google account, if you choose to (we receive your name and email address from Google)
• Resend — sends our emails, including account emails and the reminders you've turned on
• Sentry — records technical error reports so we can find and fix bugs. A report includes technical details such as the page, your browser and device type, and where in our code the error happened. We set it up so reports don't include your name, email address, IP address, or the financial information you've entered
• Push notification services — if you allow notifications, your browser's provider (such as Google or Apple) delivers them to your device

We will only share your information beyond this list if required to by law, or with your explicit consent.

5. Where your data is stored

Your account and financial data are stored in our database in Australia (Sydney). Some of the providers listed above process data outside Australia to deliver their service — for example, Sentry and Resend are based in the United States, and Vercel's servers may handle your requests in the United States or other countries. Where this happens, we only use providers that are contractually required to protect your information, and we take reasonable steps to make sure it's handled consistently with the Australian Privacy Principles.

6. Cookies and browser storage

TallySmarts uses only essential cookies — to keep you signed in and to show dates in your time zone. It also saves a few display preferences in your browser (such as which sections you've collapsed) so the app looks the way you left it. We don't use advertising or tracking cookies, and our usage statistics don't use cookies at all.

7. How long we keep your data

We keep your data for as long as your account remains active. If you delete your account from Settings, your transactions, categories, budgets, bills, recurring transactions, and net worth items — across both your Personal and Business profiles — are permanently deleted. This cannot be undone.

8. Your rights

• Access — you can view all of your data at any time by logging in
• Correction — you can edit or delete any individual transaction, category, or other record yourself, at any time
• Deletion — you can permanently delete your entire account and all associated data from Settings → Delete Account

To exercise any other rights you may have under applicable privacy law — including, for Australian users, the Australian Privacy Principles under the Privacy Act 1988 — contact us at admin@griko.com.au.

9. Security

All data is transmitted using HTTPS encryption. Passwords are never stored in plain text. Your data is isolated from other users' data at the database level, so only you can access your own records. No method of storage or transmission is 100% secure, and we cannot guarantee absolute security.

10. Children's privacy

TallySmarts is not intended for use by anyone under the age of 18. We do not knowingly collect information from children.

11. Changes to this policy

We may update this policy from time to time. We'll update the "Last updated" date above, and let you know of any material changes by email or an in-app notice.

12. Contact us

Questions about this policy or your data? Email us at admin@griko.com.au.