This is a plain-language summary of how Tally handles your data. It is not a substitute for legal advice. Last updated September 15, 2026.

Privacy Policy

Who runs Tally

Tally is a personal finance dashboard run by Jake Hodges, an individual, not a company. If you have questions about this policy or your data, contact jake@aifrontdesk.com.

What Tally collects

When you create an account, Tally stores:

• Your email address
• A hash of your password, not the password itself
• Your TOTP secret, used for second-factor sign-in, stored encrypted

When you connect a bank, card, loan, or brokerage account through Plaid, Tally stores what Plaid returns for that connection: account names, types, and balances, transactions, investment holdings and the securities they reference, liabilities such as credit cards, mortgages, and student loans, and recurring income and bill streams that Plaid detects. Tally also keeps a daily snapshot of your total assets and liabilities to draw your net worth chart, a log of each sync (when it ran, whether it worked, how many transactions changed), and a security log of events like sign-ins, password changes, and account connections and disconnections, which never contains your password, tokens, or secrets.

If you create a read-only API token or connect Tally to an AI assistant through its MCP endpoint, Tally stores a hash of that token or of the resulting access token, not the token itself, along with when it was created and last used.

Plaid is the data provider

Tally does not build its own connections to your bank. It uses Plaid to connect to your financial institutions and to retrieve your account and transaction data. Your bank username and password are entered into Plaid Link, not into Tally, and Tally never receives or stores your bank credentials. Plaid has its own privacy policy covering what it collects and how it is used, available at plaid.com/legal/#end-user-privacy-policy.

How your data is secured

• The access tokens Plaid issues for your connected accounts are encrypted at rest with AES-256-GCM, using a key held only as a Cloudflare Worker secret, not in the database.
• Your TOTP secret is encrypted the same way.
• Your password is stored as a salted hash, never in plain text.
• Session tokens and API tokens are stored as hashes, not as the raw values you were given.
• Every account requires a second factor (TOTP) before it can sign in and reach your financial data.
• Your data is held in Cloudflare D1, a managed database on Cloudflare's infrastructure.

No system is perfectly secure, but Tally is built so that a leak of the database alone does not expose your bank credentials or usable copies of your access tokens.

What Tally does not do

Tally does not sell your data, and it does not share your financial data with advertisers or other third parties for marketing purposes.

Who else touches your data

Tally relies on a small number of service providers to operate:

• Plaid, to connect to your financial institutions and retrieve account data
• Cloudflare, which hosts the application, database, and file storage
• Resend, which delivers account emails such as verification and password reset messages

Each of these providers processes data only as needed to provide their part of the service.

Exporting and deleting your data

You can export your data from the Settings page in the app. You can also delete your account from Settings. Deleting your account removes your stored data from Tally's database, including your accounts, transactions, holdings, liabilities, recurring streams, and tokens, and disconnects each of your linked institutions through Plaid so Plaid also stops treating the connection as active. Deletion cannot be undone.

Retention

Tally keeps your data for as long as your account is active, so the dashboard and sync jobs can work. If you disconnect a single institution without deleting your account, its historical transactions stay in your account unless you delete the account entirely. Security log entries are kept to help investigate account issues and are not sold or shared.

Contact

For privacy questions, data requests, or anything else about how Tally handles your information, contact jake@aifrontdesk.com.