TallyBob is run by TallyBob LLC. It exists to work out who’s owed what on a group trip, so it keeps what that takes and not much else — it has never sold anybody’s information, and nothing about your trips is shared with an advertiser.
Your account: your email address, your name, and a nickname if you set one. Your password is handled by our authentication provider and is never visible to us. TallyBob also notes when you last opened each part of each trip you are on, so the trip’s Overview can show what the other travelers have added since; only you can see those notes.
Your phone number, only if you enter one. It is private by default. It is shared with a trip’s travelers only when you switch sharing on for that trip, one trip at a time.
Payout handles, only if you enter them — your Venmo, Zelle, Cash App, PayPal or Apple Cash name, so people who owe you money know where to send it. These are visible to travelers on your trips, which is the point of entering them.
Your trips: names, dates, locations, the people on them, expenses and what each person’s share is, plans, flights, tasks, lists and notes.
Photos you upload — receipts and trip photos or video. They live in private storage and are readable only through short-lived links issued to people on that trip.
Questions you send us through Ask Bob, so we can answer them.
Flight confirmations you forward. Forwarded flight confirmations are read by Anthropic’s Claude to pull out the flights; TallyBob keeps the flights, not the email. What was read from each one is deleted after 30 days, and a booking code is kept only scrambled, so forwarding the same booking twice adds nothing. Each forwarded flight keeps the passenger’s name as the airline printed it and who forwarded it.
Card numbers. Payment happens on Stripe’s own page. We are told that a payment succeeded and nothing more — TallyBob never sees your card.
The money travelers owe each other. TallyBob works out the splits and never holds or moves a cent. People pay each other in Venmo, Zelle, Cash App, PayPal, Apple Cash or cash, directly.
Only the people on it. That is enforced by the database itself, on every table and every file, rather than by the app remembering to check — a trip you are not on returns nothing, not a page you are asked politely not to read.
Four exceptions. A share link you generate yourself (an itinerary or a settle-up link) can be opened by whoever you send it to. A trip recap link can be opened by anyone it is passed to, once the trip’s admin turns it on after the trip ends: it shows the trip’s name, place and dates, the travelers’ first names or just how many went, the trip’s total unless the admin leaves it off, and whether everyone is square, and never who’s owed what, anyone’s balance, any expense or the plans. A shopping list’s add link, once the trip’s admin shares it, lets whoever holds it add items to that list under a name they type, which the trip’s travelers see beside each item; it shows the trip’s name and the list’s name and nothing else, and the admin can turn it off. And an invite link lets one person join the seat you made for them.
Five companies, each doing one job: our hosting and database provider stores the data, our host runs the site, Stripe processes payments, an email provider delivers the notifications you have turned on and receives the flight confirmations you forward, and Anthropic reads those forwarded confirmations to find the flights. None of them is given your information for their own purposes.
We count visits with privacy-friendly analytics — no cookies, and nothing that identifies you.
Our public pages and the sign-up page also carry Meta's pixel, so we can tell when an ad on Facebook or Instagram brought someone here. It sets a cookie, and Meta may link the visit to a Facebook or Instagram account and use it for its own advertising. It never runs once you're signed in, and never on a shared trip, recap, settle-up or invite link.
Every notification email carries an unsubscribe link, and there is a single switch on your account page that stops all of them. There’s no marketing list to escape.
There is a Delete My Account button on your account page, and it does what it says. Your login, name, phone and payout details are deleted. It is not recoverable and it is permanent — there is no grace period and nothing we can restore afterwards, so please be sure before you press it.
Trips with other people on them do not go with you. Before you can delete your account, you have to hand each of those trips to someone else on it who has an account; they get an email letting them know the trip is theirs now. Everyone keeps the trip, the expenses, the photos and the settle-up. A trip that nobody else has an account on is deleted with your account, since nobody else could open it.
One thing survives on purpose. Your name and what you spent on other people’s trips stay, because their settle-up needs them — without it, five other people can no longer work out who’s owed what. You appear on those trips the way any traveler without an account does: your name is there and your share still counts, but the records are no longer connected to any login and you cannot sign in to them.
Email support@tallybob.com. If you want a copy of what we hold about you, or something corrected or removed, ask and we will do it.