TallyBob is run by TallyBob LLC. It exists to work out who’s owed what on a group trip, so it keeps what that takes and not much else — and it has never sold or shared anybody’s information with an advertiser.
Your account: your email address, your name, and a nickname if you set one. Your password is handled by our authentication provider and is never visible to us.
Your phone number, only if you enter one. It is private by default. It is shared with a trip’s travelers only when you switch sharing on for that trip, one trip at a time.
Payout handles, only if you enter them — your Venmo, Zelle, Cash App, PayPal or Apple Cash name, so people who owe you money know where to send it. These are visible to travelers on your trips, which is the point of entering them.
Your trips: names, dates, locations, the people on them, expenses and what each person’s share is, plans, flights, tasks and lists.
Photos you upload — receipts and trip photos or video. They live in private storage and are readable only through short-lived links issued to people on that trip.
Questions you send us through Ask Bob, so we can answer them.
Card numbers. Payment happens on Stripe’s own page. We are told that a payment succeeded and nothing more — TallyBob never sees your card.
The money travelers owe each other. TallyBob works out the splits and never holds or moves a cent. People pay each other in Venmo, Zelle, Cash App, PayPal, Apple Cash or cash, directly.
Only the people on it. That is enforced by the database itself, on every table and every file, rather than by the app remembering to check — a trip you are not on returns nothing, not a page you are asked politely not to read.
Two exceptions, both yours to trigger: a share link you generate yourself (an itinerary or a settle-up link) can be opened by whoever you send it to, and an invite link lets one person join the seat you made for them.
Four companies, each doing one job: our hosting and database provider stores the data, our host runs the site, Stripe processes payments, and an email provider delivers the notifications you have turned on. None of them is given your information for their own purposes.
We count visits with privacy-friendly analytics — no cookies, and nothing that identifies you.
Every notification email carries an unsubscribe link, and there is a single switch on your account page that stops all of them. There’s no marketing list to escape.
There is a Delete My Account button on your account page, and it does what it says. Your login, name, phone and payout details are deleted. It is not recoverable and it is permanent — there is no grace period and nothing we can restore afterwards, so please be sure before you press it.
Trips with other people on them do not go with you. Before you can delete your account, you have to hand each of those trips to someone else on it who has an account; they get an email letting them know the trip is theirs now. Everyone keeps the trip, the expenses, the photos and the settle-up. A trip that nobody else has an account on is deleted with your account, since nobody else could open it.
One thing survives on purpose. Your name and what you spent on other people’s trips stay, because their settle-up needs them — without it, five other people can no longer work out who’s owed what. You appear on those trips the way any traveler without an account does: your name is there and your share still counts, but the records are no longer connected to any login and you cannot sign in to them.
Email support@tallybob.com. If you want a copy of what we hold about you, or something corrected or removed, ask and we will do it.