Privacy

What TallyUp stores about you, what deleting your account destroys, and what it doesn't.

Per-account encryption took effect July 28, 2026.

What's encrypted, and what isn't

Your email address, display name, phone number, and profile picture are stored encrypted under a key that belongs only to your account. Nothing else uses that key.

Your records are not encrypted this way — bills, payments, maintenance items, valuations, and reservations keep their amounts and dates in readable form. They are the ledger, and they stay legible to you and to anyone you share a group with. Encrypting them under a key we destroy on request would mean a shared group's history could be blanked by any one member leaving.

What deleting your account does

You are signed out everywhere, and the account can no longer sign in.

The key is destroyed rather than the encrypted rows deleted, and the difference is the whole mechanism. TallyUp keeps the full version history of its records, so deleting a row would leave the previous version of that row sitting in history, perfectly readable. Destroying the key makes every copy of those fields unreadable at once, including the copies in history — which is the only way to erase something in a system that remembers.

Your financial records stay where they are. Deleting your account removes your identity from TallyUp; it does not rewrite anyone's ledger. Where a record has to name you after that, it shows a neutral placeholder rather than your name.

If you want your data removed, contact the administrator who invited you — TallyUp is currently invite-only. You will get a specific answer about what can and cannot be removed rather than a blanket assurance.

The cutoff: July 28, 2026

TallyUp did not always encrypt those fields. Per-account encryption took effect on July 28, 2026 — the date the change that introduced it, database migration 044_user_pii_encryption.sql, landed in TallyUp's deployed code. That is where the date comes from; it isn't a policy we picked, it's the day the mechanism started existing.

Records written before July 28, 2026 are not encrypted, and deleting your account does not remove them. If your account existed before that date, the revisions it wrote earlier stay readable in the version history afterwards. Erasure applies forward from the cutoff, not backward.

We are telling you this rather than fixing it, and the next section is why.

Why earlier revisions are kept

TallyUp's records are versioned. Every bill, payment, maintenance item, valuation, and reservation keeps every revision it has ever had, and you can ask what any of them looked like on a given date. That version history is the audit trail. There is no separate log alongside it, because the history is the log.

Keeping an audit trail means not rewriting it. A record of the past that can be quietly revised is not evidence of anything, and the usefulness of proving what a bill said last March rests entirely on nobody — including us — being able to go back and change it. So earlier revisions are kept, including the ones written before the cutoff.

That is a deliberate trade, not an oversight we intend to clear up later. Rewriting history to reach the pre-cutoff plaintext would break the property the history exists for. Erasure is forward-only because the alternative costs more than it buys.

One more limitation, stated plainly

So that you can sign in, TallyUp stores a keyed fingerprint of your email address next to the encrypted copy. Deleting your account clears it, but earlier revisions keep it. Someone who could read the version history and also holds the server's secret key could use it to confirm that an address they already know once had an account here. They could not learn an address they don't already have, and they could not read anything else about it.

The alternative was decrypting every account's email address on every sign-in attempt, which gets slower for everyone as the service grows. We took the fingerprint and are telling you about its edge rather than the reverse.

Disabled and erased are not the same thing

Two different things can happen to a TallyUp account, they have different consequences for your data, and it is worth knowing which one you are looking at.

Erasing is something you do, from your account settings. It destroys your account's key as described above, signs you out everywhere, and cannot be undone.

Disabling is something an administrator does to an account, and it is reversible. It erases nothing at the time: a disabled account cannot sign in, but its assets, bills, groups, and documents are all still there, and re-enabling it brings them back. If you can't sign in and you did not delete your account yourself, this is the state you're in.

Details you entered about other people

TallyUp lets you keep contacts — a plumber, a tenant, a vendor you send a 1099 to — with a name, email address, phone number, notes, and sometimes a taxpayer ID. Those people don't have TallyUp accounts. They never agreed to be in this database, and their only connection to it is you. What becomes of their details when your account goes away is therefore a separate question from what becomes of yours, and it gets a separate answer.

If you erase your account, their details go at the same moment. There is no waiting period and no grace window. Clearing them happens inside the deletion itself, before the account is marked erased — so an erasure that reports success has already done it.

If an administrator disables your account, their details are removed after twelve months. Disabling takes nothing away at the time, and for those twelve months a re-enabled account finds everything as it left it. But an account still disabled after twelve months is not coming back, and keeping a stranger's phone number indefinitely on the chance that it might is a promise made to you at their expense. So once a disabled account passes twelve months, TallyUp clears the identifying details out of the contacts that account entered.

What stays is the structure, not the identity. The contact record itself remains, because bills and maintenance items point at it — removing it outright would break a bill that names that vendor, and in a shared group it would break someone else's bill. What gets cleared is what's inside it: name, email address, phone number, notes, taxpayer ID. The bill keeps its amount and its date. It just no longer carries that person's details.

One consequence, stated plainly rather than left to be discovered: an account re-enabled after more than twelve months disabled gets its own data back — assets, bills, groups, documents — but not its contacts. Those were cleared while it sat disabled, and nothing restores them.

How far erasing reaches

Erasing takes effect on the live system immediately — not overnight, and not on a queue you're waiting in. The key is destroyed as part of the request, and everything above follows from that the moment it happens.

It reaches the backups as well, and by the same mechanism rather than by some second cleanup that has to remember to run. TallyUp keeps two: one holds your records in encrypted form, the other holds the keys that unwrap them. The key backup is rewritten complete each time it runs — so an erased account's key is never deleted from it, it is simply absent from the next copy. Nothing has to notice your erasure and go chase it down, which means nothing can fail to.

What's left in the record backup afterwards is ciphertext with no key: the same unreadable state as everywhere else. It can't be unwrapped by you, by us, or by anyone who gets hold of the file.

What this page does not cover

This page covers the identifying information TallyUp holds about you and about the people you have entered, and what deleting your account does to it. It is not a complete data-handling statement.

One thing is still missing, and it's missing on purpose: this page does not tell you how long the backup copies themselves are kept before they're discarded. There is an internal answer to that question, but the deletion it describes is not yet something TallyUp performs, and publishing a schedule we do not currently act on would be making you a promise the software has not been built to keep — which is the failure this page is most concerned with avoiding. So it says nothing rather than something reassuring. It will appear here when the mechanism behind it does, and not before.

Questions about this policy, or about what TallyUp holds on you, should go to the administrator who invited you to TallyUp, which is currently invite-only.