Tally privacy
Updated October 11, 2026 · iPhone social and profile update
Your account and local data
Tally is operated by S3 AI Labs LLC. Sign in with Apple provides an account identifier and, when authorized, your name and email to Supabase. Hide My Email is supported. Your schedule and attendance remain on your phone; the required data below is also uploaded. Tally never edits your calendar. Apple Maps handles building searches and maps.
Required app sharing and day replay
Using Tally requires acceptance of account-linked school-time precise location, class details, class-window diagnostics and Tally app activity. Build 61 narrows location collection under the existing sharing agreement. Older builds may retain their previously disclosed all-day behavior until updated, and existing history is not retroactively deleted. There is no separate opt-out for these required categories; sign out to stop account-linked collection, or delete your account to remove its server data. iOS location permissions remain under your control.
With automatic attendance, Always and Precise Location enabled, Tally keeps its location service active across your school day, including breaks between tracked classes. Opening Tally once before your first class can start the service early; it stops after the last tracked class’s departure buffer. School time is based on the classes you track and their saved building pins, not your school’s general opening hours. A day with no pinned classes has no school-time recording. Changing your tracked schedule changes these boundaries.
After you accept the sharing agreement, Tally saves precise coordinates, timestamps, accuracy and available speed only in scheduled collection windows: 30 minutes before the first class in a group until 10 minutes after the last. Classes separated by no more than 60 minutes form a group. Longer breaks keep the location service active but their readings are discarded. Early service startup does not widen collection windows. Outside-window readings are not saved, uploaded or counted toward attendance. These account-linked readings are uploaded to Supabase to provide day replay and improve Tally. You and authorized Tally administrators can view them; Friends group members cannot.
Recording follows movement and saves at most one reading per minute. The protected on-device retry queue keeps up to 1,440 readings for less than 24 hours and is excluded from backups. Server replay history is limited to 30 days and 43,200 readings. Older readings are hidden and pruned on synchronization; provider backups follow their normal retention. Day in review → Replay options → Delete replay history removes saved all-day locations and invalidates pending earlier uploads. New recording continues under the agreement.
Replay motion estimates straight lines only between nearby, recent, sufficiently accurate readings. It is not an exact route. Long gaps stay visible. Outside-class readings never earn attendance credit. iOS can interrupt delivery, and school-day battery performance remains under field testing.
Required class details include tracked names, times, buildings, saved pins, import method and attendance outcomes; the latest snapshot is capped at 2,000 classes. Class-window diagnostics run from eight minutes before through five minutes after class and include location accuracy, building distance, nearby results, wake/error categories, battery and permission state, device model and iOS version. App activity includes opens, time in Tally, named screens, setup steps and import outcomes. It excludes typed text, screenshots, audio and other-app activity. Diagnostics and activity have up to 30 days of visible history, capped at 10,000 records per category. Full local testing logs and written excuses are not automatically uploaded.
Attendance calculation and background limits
New classes after this update use location updates requested at a 10-metre movement interval. A usable fix must be no more than 60 seconds old with accuracy of 75 metres or better. Tally treats you as nearby only when distance plus reported accuracy fits within a 110-metre building radius, and as away when distance minus accuracy exceeds it. Uncertain boundary readings do not change the last clear state.
Nearby time is inferred between clear readings, including quiet periods while stationary, and counts only during the scheduled class. At least 51% is required. A later departure reading can correct an earlier estimate. Known permission loss or a tracking restart ends continued-presence inference at the last sample. Earlier saved attendance and personal records are preserved; a class already underway at the update retains its earlier rule unless it already has movement evidence.
iOS controls background execution and privacy indicators. Opening Tally before your first class helps establish tracking. Force-quitting, restarting the phone, permission changes, battery restrictions or system suspension can interrupt it. Scheduled background wakes are not guaranteed. Startup and interruption notifications are best-effort prompts to reopen Tally, not proof that you closed it. Keeping tracking active through breaks can use more battery.
Google Calendar
Connecting Google Calendar is optional and separate from Sign in with Apple. Google asks for read-only access to your calendar list and events. Tally reads calendar names and identifiers so you can choose calendars, then reads upcoming event titles, times, locations and descriptions in those calendars to help you select classes. It never creates, changes or deletes Google events. Only classes you choose enter your attendance schedule.
Google credentials stay in Google Sign-In’s protected storage on your iPhone and are not uploaded to Tally’s server. Unselected events and event descriptions are not uploaded. Chosen class names, times, buildings, saved pins and attendance results follow the required sharing agreement described above and are stored in Supabase. You and authorized Tally administrators can view the shared class details; Friends group members receive the class details described below only when you enable group sharing. Google data is not used for advertising or to train generalized models.
Tally’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
Connect, refresh, reconnect or disconnect in Tally Settings → Manage classes. Disconnecting stops Google updates, clears the local Google sign-in and removes future unrecorded Google classes. Completed attendance remains on your phone; shared records follow the retention and account-deletion rules below. You can also revoke Tally’s access in your Google Account’s connected-app settings. Signing out of Tally disconnects Google on this device. Neither action deletes events from Google Calendar.
Class setup
Manual entry and the offline photo scanner work on-device. Optional guided setup sends your chosen messages, images and drafts through Supabase to Nebius for interpretation. Chosen voice recordings go to ElevenLabs for transcription and optional spoken replies; Tavily receives school search terms, not your schedule. This uses a separate disclosure. Drafts are stored per account on your phone; the service stores request counts, not conversations or schedules. Providers process requests under their policies.
Friends
Creating or joining a group shares your name, tracked class names, times and attendance outcomes within group dates, membership, predictions, picks, totals and play-dollar balances with its members. The confirmation also explains your student profile: university when available, all-time attended and missed totals, and current and longest class streaks. Tally derives your attendance percentage and tier from that summary. These personal totals are separate from competition results, which begin at the group’s agreed start.
Existing memberships share a student profile only after you choose Share my profile in the new app. Profiles and class results refresh while Tally is open; another member may need to update Tally and share before their profile appears. Group summaries are stored in Supabase with the group and removed with the membership or account. Friends never receives GPS coordinates, building pins, day replay or written excuses. Play dollars have no cash value, purchases or prizes.
Friends alerts and agreements
Group odds and class exclusions require member votes, stored with the group in Supabase. The inbox keeps proposal and voting updates. Exclusions affect that group’s scores and future picks; they do not change personal calendars or attendance history. When several exact course matches identify one school, Tally can infer a university for the profile.
When you allow notifications, Tally stores an Apple push token linked to your account in Supabase and sends Friends alerts and owner-written Tally messages through Apple Push Notification service. The Tally owner can select recipients; message text, recipients and read status are stored in Supabase. Inbox copies remain until account deletion. Alerts may appear while Tally is closed. Manage alerts in iPhone Settings. Sign-out removes this device’s registration when connected; deleting the account removes its server tokens. Group notices are removed with the membership, group or account. Unsent alerts expire after one day; provider backups follow their normal retention.
Chats, friends and sharing
Chats is optional and lives inside Friends, alongside separate group competitions. Supabase stores your name, username, profile photo or emoji and optional school. You choose whether signed-in users can find your profile. Quick Add uses shared groups and mutual friends, with separate opt-ins for contact and broad-area suggestions. Shared group members who have not set up Chats can receive an invitation. Both people must accept the friendship before chatting.
Phone discovery is optional. Supabase stores your verified number; Twilio Verify processes the number to send verification codes. Connecting contacts asks for iPhone permission and uploads normalized phone-number hashes for matching, not contact names or raw address-book numbers. Hashes are still personal data. Only people who enable phone discovery can match. You can separately choose contact-joined alerts. Disconnecting contacts deletes the stored hashes.
Nearby suggestions require a separate opt-in. Tally uses a fresh location reading to determine your city or broad area, stores that area without coordinates, and matches other opted-in profiles. Area suggestions expire after seven days unless refreshed. Attendance location does not automatically enable discovery.
For each accepted friend, you control sharing of your attendance percentage, upcoming class names and times, and attendance streak. These choices start off. Tally uploads only categories shared with at least one friend, and each friend sees only their granted categories. Unsharing revokes access immediately; shared summaries expire after seven days without an update. Exact location, day replay and written excuses are not shared with chat friends. Friends group sharing has its own rules above.
One-to-one Chats stores the text, emoji, photos, videos, voice recordings, captions, replies and reactions you send, along with sender and recipient identifiers, timestamps, opened/read status, saves, Snap streaks and chat preferences. Authenticated access to a conversation and its media requires being one of its two participants, an accepted friendship and no block in either direction. Supabase processes and stores this content to provide the service. Access controls protect it; Chats is not end-to-end encrypted.
Typing a friend's username with @ can add a profile link. Only the direct recipient can receive a mention alert. Mentioning a third person does not give them the conversation or notify them. A single active tracked class may suggest a removable “During CSE 29” label before you send. The label is a snapshot of your schedule, not live location or proof you are in class. It does not include coordinates, a room, a building pin or your future schedule. Overlapping classes do not produce a suggestion, and the suggestion is removed if the class ends before Send.
Camera and microphone access are requested when you use capture or recording. The photo picker shares only the library items you choose; exporting a photo or video asks for permission to save to Photos. Photos are resized and re-encoded before upload to strip embedded metadata. Videos are compressed for delivery. Media may upload privately while you preview it, before you tap Send; abandoning the preview does not send it to the other person. Protected files on this iPhone keep pending or failed messages for retry. Signing out clears the account's local chat cache.
Chat expiry, saves and copies
Unopened messages expire from Chat access after 31 days. Read text and emoji expire 24 hours after the first read. Opening unsaved photos, videos or voice recordings grants a 90-second access window. One replay can renew that window; leaving the conversation ends replay eligibility in the app. These are access limits. Content may remain stored after access expiry until cleanup runs. Message metadata and report records may remain until account deletion.
A message saved by either participant remains accessible beyond ordinary expiry while either person keeps it saved, unless it is deleted. Unsave removes only your own save. Senders can delete their messages; a recipient can also delete a saved photo or video. Deletion removes Chat access immediately. Expired or deleted media and abandoned uploads are cleaned up during subsequent chat activity, so physical file deletion can lag access expiry. Provider backups follow their normal retention.
Recipients can export photos and videos or make their own copies, recordings or screenshots. Tally does not detect screenshots or screen recordings. Expiry, unsaving, blocking and account deletion cannot remove copies someone has already saved outside Tally.
Chat controls and notifications
You can remove or block a friend and report a received message in Chats. Blocking prevents messaging and authenticated conversation access between those accounts. Reports store the message reference, your account, the selected reason and the report time for review by authorized Tally administrators. A report is not a promise of an immediate response.
When notifications are allowed, Tally uses the account-linked Apple push token described above for chat alerts. Apple Push Notification service receives generic alerts and routing identifiers, without message text, media or class labels. Chat settings separately control Chats, Snaps, typing, friend requests and acceptances, mentions, and Streak reminders. Muting a conversation takes priority over its alert preferences. Device notification settings and iOS delivery restrictions also apply.
Snap streaks count reciprocal photo or video exchanges and are separate from attendance streaks. You must opt into reminders for each active streak. This iPhone schedules a reminder one hour before its last synchronized expiry; opening Tally refreshes that timing. It may become stale while Tally stays closed. Reminder opt-in resets when the streak ends, and signing out removes this account's pending Streak reminders and delivered chat alerts.
Personal goals and reminders
Your attendance goal and notification choices stay on this iPhone, separated by account. Goal progress uses completed classes, excludes excuses and includes personal confirmations. Weekly progress, goal reached, before-class and day-review reminders have separate controls. Day-review alerts are scheduled only after recorded data uploads successfully, at 8 pm or after a later final class. iOS permissions, background delivery and whether Tally has synchronized can affect delivery.
Retention, deletion and choices
Sign out to stop account-linked collection and uploads. Manage Calendar, Location and notifications in iPhone Settings. Delete your account in Tally’s Account settings to remove its server records, including replay, classes, diagnostics, activity, group information and Chats. Chat uploads and sends are stopped while deletion is in progress. Profile photos, contact hashes, discovery settings and individual sharing grants are also removed. Your uploaded chat files must be removed from active storage before your sign-in account is deleted; if removal cannot finish, Tally asks you to retry instead of reporting success. Unfinished rounds close and refund play credits. Personal attendance remains on your phone until removed with app/device controls. Uninstalling alone does not delete server data. Provider backups and exports may retain copies under their normal retention.
Earlier app versions retain their original agreement until you accept the new scope. Legacy class-window optional readings are capped at 1,000. App information is not shared with advertisers. Website cookies and optional analytics are described separately in the website policy.
Support and requests
For access, correction or deletion requests, contact privacy@s3ailabs.com. We may need to verify your request. Tally is not an official school attendance record. This alpha may contain errors; location is proximity evidence, not proof of attendance.