Privacy Policy

Last updated: September 30, 2026

Overview

TallyUp Finance is a personal finance tracking application operated by Stillwater Technology Group LLC, a Montana limited liability company. Your privacy is fundamental to how we built this product. We designed TallyUp so that your financial data stays in your control.

Data We Store

Account profile: Your Google account email, name, and user ID are stored by our database and authentication provider (Supabase) to manage your account and link to your spreadsheet.
Spreadsheet reference: We store the ID of the Google Sheet created for your account. We do not store the contents of your spreadsheet.
Purchase status: Your payment tier and, if you bought Pro, your Stripe customer ID, a reference to that Stripe payment, and the purchase date.
Account settings: The date you accepted our Terms of Service, whether you have completed the in-app tutorial, your beta access status, and your account role.
Google refresh token: A Google OAuth refresh token, limited to the drive.file scope, so TallyUp Finance can keep your spreadsheet connected without asking you to sign in to Google again every hour. See Authentication below.
Feedback you send: If you use the in-app feedback form, your message, email address, and any screenshot you attach are emailed to our support inbox.

Data We Do NOT Store

Your financial data (account balances, investments, budgets, etc.) lives entirely in a Google Sheet in your Google Drive.
We do not have access to your Google Drive files beyond the single spreadsheet TallyUp Finance creates.
We do not sell or monetize your data, or share it for advertising.

Google API Usage

TallyUp Finance uses the Google Sheets API to read and write data to a single spreadsheet in your Google Drive. We request the drive.file scope, which limits access exclusively to files created by TallyUp Finance — we cannot see, access, or modify any other files in your Google Drive. We do not access your email, contacts, calendar, or any other Google services.

TallyUp Finance's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the features you see in TallyUp Finance. We do not use it for advertising, we do not sell it, and no person at TallyUp Finance reads the contents of your spreadsheet unless you ask us to for support, it is needed for security purposes, or it is required by law.

Data Protection

We take the security of your data seriously and implement the following safeguards:

Encryption in transit: All communication between your browser, our servers, and third-party services (Google APIs, Supabase) is encrypted using TLS/HTTPS.
Encryption at rest: Account data stored in our database (Supabase) is encrypted at rest using AES-256 encryption.
Minimal data collection: We only store what is necessary to operate your account, as listed under Data We Store above. Your financial data remains in your Google Drive, not on our servers.
Scoped API access: We use the drive.file scope, which restricts our access to only the single spreadsheet TallyUp Finance creates. We cannot access any other files in your Google Drive.
Limited token storage: Short-lived Google access tokens are never saved to our database. The only Google credential we store is a drive.file-scoped refresh token, which is used solely to issue new access tokens to your signed-in browser.
No selling or advertising use: We do not sell your personal or financial data, or share it with anyone for advertising or analytics. We only use the service providers listed below, and only to run TallyUp Finance.
Access controls: Administrative access to our infrastructure is restricted and requires multi-factor authentication.

Authentication

We use Google OAuth via Supabase for authentication. Your Google password is never shared with us.

When you sign in, Google issues two tokens. The access token is short-lived (about an hour) and is kept in your browser, including a cached copy in local storage so a page reload does not sign you out of Google. It is never saved to our database. The refresh token is stored in your account profile in our database. When your access token expires, our server uses the refresh token to request a new access token from Google and sends it back to your browser. Both tokens are limited to the drive.file scope, so they can only reach the spreadsheet TallyUp Finance created.

Your refresh token is deleted when you delete your account. You can also revoke TallyUp Finance's access at any time from your Google Account permissions page, which immediately invalidates the stored refresh token.

Service Providers

We rely on the following companies to run TallyUp Finance. Each receives only the data it needs to perform its service:

Supabase: our database, authentication, and server functions. Stores the account data described above.
Vercel: hosts the TallyUp Finance website and processes standard request information such as your IP address.
Google: sign-in, and the Google Sheet in your Drive where your financial data lives.
Stripe: processes Pro purchases. Stripe collects your payment card and billing address directly under its own privacy policy; we never see your full card details.
Resend: delivers emails to our support inbox, including a notification with your name and email when you sign up or buy Pro, and any feedback you submit.
GitHub: stores our encrypted nightly database backups.
Market data providers: To show prices and returns, the stock and fund symbols you track are sent from our server to Yahoo Finance, and your browser requests crypto prices from CoinGecko and Coinbase and the Fear & Greed index from alternative.me. Requests made from your browser include your IP address. We never send your balances, quantities, or account details to these providers.

We may also disclose information if required by law, or to protect the rights and safety of our users or the Service.

Cookies & Local Storage

We use browser local storage and session storage to maintain your session (including your sign-in session and a cached Google access token), cache preferences (dark mode, dashboard tab), and improve load times. We do not use third-party tracking cookies or analytics.

Data Deletion

You can delete your account directly from the app — go to your dashboard, click the settings gear icon, and click “Delete Account.” This immediately removes your profile, stored Google refresh token, purchase status, and account from our live database, and deletes your customer record at Stripe. Your Google Sheet will remain in your Google Drive, where you can delete it at any time.

Data Retention

We keep your account data for as long as your account exists.
We make an encrypted backup of our database every night and keep each backup for 30 days. After you delete your account, your data may remain in these backups until they expire.
Records of past payments are retained by Stripe, and by us where needed, for tax, accounting, and refund purposes.
Emails in our support inbox, such as feedback you sent or sign-up notifications, may be kept for as long as needed to support you and keep business records.

Changes to This Policy

We may update this policy as TallyUp Finance changes. When we do, we will update the date at the top of this page, and for significant changes we will make reasonable efforts to notify you.