TallyTaxes — Privacy Policy
Version: 1.0 | Effective: 2026-07-01 | Owner: Philip Cutting (Founder) | Review cadence: Annual
TallyTaxes (“TallyTaxes,” “we,” “us,” or “our”) is an AI-assisted expense-classification service that helps you separate business and personal expenses, including by analyzing your bank-transaction data. TallyTaxes is operated by LionProDev, a sole proprietorship founded and run by Philip Cutting, based in the United States.
This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, who we share it with, and the choices and rights you have. Please read it alongside our Terms of Service.
1. Who We Are and How to Reach Us
If you have questions about this policy or your data, or if you want to exercise your privacy rights, contact us at phil@lionprodev.com.
2. Information We Collect
We collect only the information needed to provide the service:
- Account information. Your email address and a password. Your password is never stored in a readable form — it is protected using a strong one-way hash (Argon2id). We also store your two-factor authentication (2FA) setup, including an encrypted authentication secret and hashed backup codes.
- Financial data via Plaid. When you choose to connect a bank or financial account, our partner Plaid securely provides us with data such as your transactions, account balances, and account and institution details. We also store a Plaid access token that lets us retrieve this data on your behalf. We do not receive or store your banking login credentials — you enter those directly with Plaid.
- Uploaded documents and statements. Documents you upload (such as receipts or statements) so we can read them using optical character recognition (OCR) and help classify the expenses they contain.
- Payment information. If you subscribe to a paid plan, payments are handled by Stripe. TallyTaxes does not collect or store your full card number; Stripe processes payment details directly.
- Security and activity logs. Records of security-relevant events (such as sign-ins, 2FA use, and data access) that we keep to protect your account and detect misuse.
3. Why We Collect It and How We Use It
We use your information solely to provide and operate the service, including to:
- Create and secure your account and enforce two-factor authentication;
- Connect to your financial accounts (with your consent) and retrieve transaction data;
- Read uploaded documents and classify expenses as business or personal;
- Process subscription payments;
- Protect against fraud, abuse, and security threats, and meet our legal obligations;
- Communicate with you about your account and service-related matters.
4. We Do Not Sell or Rent Your Data, and We Do Not Advertise to You
TallyTaxes does not sell, rent, or trade your personal or financial information. We do not use your consumer data for advertising or marketing, and we do not allow our subprocessors to use it for their own advertising. Your data is used only to deliver the service you signed up for, and shared only with the service providers strictly necessary to operate TallyTaxes, as described below.
5. Service Providers (Subprocessors) We Share Data With
To run TallyTaxes, we rely on a small set of trusted, reputable providers that process data on our behalf and under contract. We share only the data each provider needs for its function:
| Provider | Function |
|---|---|
| Vercel | Application hosting and serverless compute (TLS in transit) |
| Supabase | Database and file storage (AES-256 encrypted at rest, TLS in transit) |
| Plaid | Securely connecting your bank accounts and providing transaction data |
| Stripe | Payment processing for subscriptions |
| AWS Textract | OCR (reading text from uploaded documents) |
| Google Cloud Vision | OCR (reading text from uploaded documents) |
| OpenAI | AI-assisted expense classification (your data is not used to train their models) |
| Resend | Sending transactional email (such as account and security notices) |
We use Plaid specifically to let you connect your bank accounts. Plaid’s handling of your data is also governed by Plaid’s own privacy policy, which you can review during the connection process.
6. How We Protect Your Data
We apply industry best-practice security controls, including:
- Encryption in transit using TLS 1.2 or higher everywhere;
- Encryption at rest — full-database AES-256 encryption, plus an additional layer of AES-256-GCM encryption applied by our application to the most sensitive fields (your Plaid access tokens and 2FA secrets);
- Mandatory two-factor authentication (2FA) on every account;
- Strong password protection using Argon2id hashing with a secret pepper;
- Least-privilege access controls, with production access limited to the founder;
- Security event logging to detect and investigate suspicious activity.
No online service can guarantee absolute security, but we work continuously to protect your information and to improve our controls.
7. Your Privacy Rights and Choices
You have the right to:
- Access the personal information associated with your account;
- Correct inaccurate account information;
- Delete your account and associated data. TallyTaxes provides self-service account and data deletion from within the application; you may also request deletion by emailing us. On a verified deletion request, we remove your data within 30 days, except where we are legally required to retain certain records (see Retention below).
To exercise any of these rights, use the account controls in the app or email phil@lionprodev.com. We may need to verify your identity before acting on a request. We will not discriminate against you for exercising your rights.
8. Data Retention
- We retain your consumer financial data only as long as needed to provide the service to you.
- Security and audit logs are retained for 7 years, consistent with financial-data safeguards (GLBA-aligned) and to support security investigations.
- When you delete your account, we delete your associated data within 30 days, except where a longer retention period is required by law.
9. Your Consent
By creating an account, you explicitly agree to this Privacy Policy and our Terms of Service. When you connect a financial account, you separately provide consent through Plaid Link’s consent flow, which describes the data being shared before any connection is made. You can disconnect a linked account or delete your data at any time.
10. Children’s Privacy
TallyTaxes is a service for adults and is not directed to individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us at phil@lionprodev.com and we will delete it.
11. International Users and Jurisdiction
TallyTaxes is operated from the United States, and your information is processed and stored in the United States and by U.S.-based providers or their infrastructure. This policy and the service are governed by the laws of the United States. If you access TallyTaxes from outside the United States, you understand that your information will be processed here.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the version and effective date above and notify you by email and/or an in-app notice before the changes take effect. Continued use of the service after an update means you accept the revised policy.
13. Contact
For any privacy or security question, or to exercise your rights, contact:
phil@lionprodev.com
Review & Revision History
| Version | Date | Author | Summary |
|---|---|---|---|
| 1.0 | 2026-07-01 | Philip Cutting | Initial public Privacy Policy. |