Privacy Policy

Who we are

Tallypath is developed and operated by DMO Software Solutions Inc., a company registered in British Columbia, Canada, with a registered address at 34581 4th Ave, Unit 4, Abbotsford, BC, Canada.

For anything in this policy — a question, a request for your records, or a request to delete them — write to developer@tallypath.app. DMO Software Solutions Inc. is the organisation responsible for the personal information described here.

What Tallypath collects

Tallypath collects what it needs to keep your records, and does not collect categories of data it has no use for. In practice that is five things.

• Account information. The email address you register with, and an authentication credential. If you sign in through Apple or Google, we receive the identifier that service gives us and, where you allow it, your email address.
• Location and trip data. When you enable automatic tracking, the app uses your device location — including in the background, while a drive is in progress — to record the start, end, route and distance of a trip. This is the most sensitive thing Tallypath holds and it exists for one purpose: producing a mileage record you can stand behind.
• Your financial records. Trips, expenses, receipts and the photographs you attach to them, categories, vehicles, budgets, and the reports generated from all of it. Where a premium feature reads the contents of a receipt, the extracted fields — merchant, date, subtotal, tax, total — are stored alongside the original image.
• Device and diagnostic information. Device model, operating-system version, app version, crash reports and basic error logs. This is used to fix defects and to tell you when a permission or a system setting is preventing tracking from working.
• Subscription status. Whether your account holds an active plan or add-on, and which one. Payment card details are never collected by us — see "Payments" below.

Tallypath does not collect contacts, photos other than the images you deliberately attach, microphone input, health data, or browsing activity on other apps or websites.

Location data, specifically

Automatic trip detection requires access to your location while the app is in the background. That permission is requested explicitly, it is optional, and the app is usable without it — trips can be entered by hand and count exactly the same.

• Location is sampled to reconstruct a drive, and is not streamed continuously when no drive is in progress.
• A recorded route is shown on its own trip screen. It is not included in notifications, and it is left out of exports unless you deliberately include it.
• You can delete a route while keeping the trip and its distance, pause tracking, or switch it off entirely at any time, in the app or in your device settings.
• We do not sell location data, share it with data brokers, or use it for advertising. We do not use it to build a profile of you for any purpose other than producing your own records.

Why we process it

Each category is processed for a stated purpose and no other.

• To provide the product: recording trips, storing receipts and expenses, producing reports and exports.
• To operate your account: authentication, keeping your records associated with you, and restoring them on a new device.
• To manage subscriptions: knowing which plan an account holds so premium features work.
• To keep the product working: diagnosing crashes and defects, and preventing abuse of the service.
• To communicate with you: service messages, responses to support requests, and notices about material changes to this policy or to the Terms.

Where the law requires a legal basis, we rely on the performance of our contract with you for the first four, on your consent for background location and for optional communications, and on our legitimate interest in a secure, functioning service for abuse prevention.

Who else sees your data

We do not sell your personal information, we do not rent it, and we do not share it for anyone else’s advertising. There is no advertising inside Tallypath.

Your data reaches a third party in only three situations.

• Service providers who run parts of the service on our behalf — cloud hosting and storage, error reporting, email delivery, and, where a premium feature requires reading the contents of a receipt, a processing provider engaged for that purpose. Each is bound by contract to process data only on our instructions and only for that purpose.
• App store operators. Apple and Google process your purchase and tell us whether a subscription is active. They do not receive your records.
• Where the law requires it — a valid legal demand, or where disclosure is necessary to protect someone’s safety or to establish or defend a legal claim. If we receive a demand for your records and we are permitted to tell you, we will.

If the business is ever sold or merged, records may transfer as part of it. You would be told before that happened, and the acquirer would be bound by this policy until it was properly replaced.

Where it is stored, and for how long

Records are stored on cloud infrastructure and are encrypted in transit and at rest. Data may be processed in Canada or the United States, which are the launch markets for the product; wherever it is processed, it remains subject to this policy and to the contractual protections we impose on our providers.

Your records are kept for as long as your account exists. When you delete your account, they are deleted — see the Data and deletion page for exactly what that covers and how long it takes. Backups are rotated on a schedule and deleted content ages out of them; we do not restore deleted records from a backup to bring them back.

Payments

Subscriptions purchased inside the app are billed by Apple or by Google under their own terms and their own privacy policies. Card numbers, billing addresses and payment credentials are handled by them and are never collected or stored by us. What we receive is confirmation that a subscription is active, and which one.

Your rights over your data

Whatever jurisdiction you are in, you can do all of the following.

• Get a copy. Export your records as ordinary files you own, from inside the app, at any time and on any plan. There is no export fee.
• Correct it. Edit or re-categorise any record. Nothing in Tallypath is write-once.
• Delete it. Delete an individual route, trip, receipt or expense, or delete your account and everything in it.
• Withdraw consent. Turn off background location, or switch off optional messages, without losing access to the rest of the app.
• Ask what we hold. Write to us and we will tell you, and provide a copy, free of charge.
• Complain. In Canada you may complain to the Office of the Privacy Commissioner of Canada, or to your provincial commissioner. We would rather you told us first, but the right is yours either way.

To exercise any of these, write to developer@tallypath.app with "Privacy" in the subject line. We answer within 30 days, and usually much sooner. We may need to confirm you control the account before acting on a request — that check exists to protect you.

If you are a resident of California or another US state with comparable legislation, the rights above satisfy your rights of access, correction, deletion and portability. We do not sell or share personal information as those terms are defined in that legislation, and we do not use it for cross-context behavioural advertising, so there is nothing for you to opt out of. We will not discriminate against you for exercising a right.

Security

Records are encrypted in transit and at rest. Access to production systems is restricted to the people who need it to operate the service, and is logged. We do not browse customer records, and no one at the company reads your receipts to improve a product.

No system is perfect, and we will not claim otherwise. If a breach affects your data and creates a real risk of significant harm, we will notify you and the relevant regulator as the law requires, and tell you what happened rather than what we wish had happened.

If you believe you have found a vulnerability, please write to developer@tallypath.app before disclosing it publicly. We will acknowledge you and tell you what we are doing about it.

Children

Tallypath is a business tool for adults and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has created an account, write to us and we will delete it.

Changes to this policy

When this policy changes we update the date at the top. If a change materially affects what we collect or what we do with it, we will tell you in the app or by email before it takes effect, rather than relying on you to notice a new date.

Contact

DMO Software Solutions Inc.

34581 4th Ave, Unit 4, Abbotsford, BC, Canada

developer@tallypath.app