Where your data goes depends on your choices, and on nothing else
Tavala sends nothing about your money anywhere until you choose to: an account to sync, a bank to connect, a question for Ask Tavala. Each choice adds one path, and each path is listed here with the company at the other end of it and what that company receives. The privacy policy says the same in full.
Nothing leaves the device. No account, no server, no sign-up.
Your entries sync both ways with a database hosted in Ireland, in the EU, so a second device and a backup exist.
US and Canada only, and one way: Tavala reads transactions and balances, and can never move money.
Only when you ask: your question and the names it needs go to OpenAI, or Anthropic for a hard one, and words come back. Amounts and notes stay on your phone, and nothing is saved without your tap.
As a guest, your records stay on the device
Wallets, entries, budgets, bills, debts and trips are written to a database inside the app, or to the browser's own storage on the web. Tavala never receives them, so it cannot lose, read or recover them.
With an account, in Ireland
Your records sync through a database in the European Union (Ireland), and the sync service runs in the EU. They are not stored in the United States.
- Nothing until you chooseNo account, no bank and no Ask Tavala means no records leave the device. Each of the three is a choice you make, and each can be undone.
- No ads, no analytics SDK, nothing soldThe app has no advertising, no advertising identifier and no analytics SDK. Besides its own database and sync services, the outside code in it confirms store purchases (RevenueCat), reports crashes (Sentry) and opens Plaid's window when you connect a bank. Data is never sold or shared for advertising.
- The one thing that leaves every deviceWhen the app crashes, a report goes to Sentry with the error, the device model, the system version and language and a random installation id. Emails and anything shaped like an amount are removed first, and it is not linked to your account.
- Yours to take, yours to deleteExport my data writes everything to a JSON file on every plan. Deleting your account deletes its records at once.
Each choice adds one path
Tavala is private in the plain sense: nothing about your money leaves your device until you make a choice that needs it to. Create an account, and your records sync through Ireland so a second device and a lost phone are covered. Connect a bank, and Plaid sends Tavala that bank's transactions. Turn on Ask Tavala, and your question and the names it needs go to an AI model, without your amounts. Each path is optional, each is listed below with who is at the other end, and each can be closed again.
What reaches Tavala from everyone
Two things leave every device, guests included. Crash reports go to Sentry: the type of error, the device model, the system version and language and a random installation id, with email addresses and anything shaped like an amount removed first, not linked to your account, deleted on a 90-day cycle. And the app downloads a shared table of exchange rates from time to time; that request carries nothing about you.
What stays on your device even with an account
The app lock and hidden amounts, bill reminders (scheduled by the device, never containing an amount), the widget's summary, exports (written to the device and handed to the app you choose, never through Tavala), and the forecasts, payoff plans and budget statuses, which are worked out on the device from the figures you entered.
Every company that touches your data
From the privacy policy's own list of processors and providers. Most only matter if you use the thing they serve.
| Provider | What it does | When | Where |
|---|---|---|---|
| Supabase | Database and sign-in | With an account | EU (Ireland) |
| PowerSync | Moves records between your devices | With an account | EU |
| Amazon Web Services | Serves the web app and this site | Always | EU (Ireland), with nearby edge locations |
| Sentry | Crash reports, scrubbed and unlinked | Always | United States |
| Plaid | Bank connections | Only if you connect a bank | United States and EU |
| OpenAI | Writes Ask Tavala's answers | Only if you turn it on | United States |
| Anthropic | Writes answers to harder questions | Only with Ask Tavala on Plus | United States |
| RevenueCat | Confirms App Store and Google Play purchases | Only if you buy in a store | United States |
| Stripe | Payments on the web | Only if you buy on the web | United States and EU |
| Resend | Sign-in codes and account emails | With an account | United States |
| Umami | Counts visits to this website, no cookies | On tavala.io only | EU |
Data practices in other budgeting apps
Where each app keeps your data and whether it needs a bank or an account to start.
| What | Tavala | YNAB | Monarch | Actual Budget |
|---|---|---|---|---|
| Where your data lives | On your deviceWith an account, synced through Ireland (EU) | United States"operated from the United States" | Not statedAvailable in the US and Canada only | On your deviceOr on a sync server you run |
| Start without an account | YesAn account adds backup and sync | NoSign up for the trial | NoA subscription service | YesThe desktop app needs no server |
| AI | Off until you turn it onThe model never sees an amount | Categorizing and insightsAllowed by its privacy policy (April 2026) | AI assistantAuto-categorization cannot be turned off | Not statedIts privacy policy does not mention AI |
| Bank connections | Optional add-onBanks in the United States and Canada, through Plaid, $3.99 a month per bank | IncludedSelect banks in the US, Canada and 18 European countries, UK included | Included, at the coreUS and Canada only, 13,000+ institutions | Optional, set up yourselfNeeds your server; SimpleFIN ($15 a year) or Enable Banking |
Questions about privacy
- Is my data encrypted on my phone?
- Tavala relies on the protection the operating system gives an app's private storage, which a phone or Mac with a passcode encrypts. It does not add its own database encryption. The app lock adds a check before the app opens.
- Can Tavala staff read my entries?
- With an account, your records are held on Tavala's servers to run sync, and access to those systems is limited. Without an account, Tavala never has them.
- Does the website track me?
- tavala.io sets no cookies. It counts visits with Umami, a cookieless service in the EU that stores nothing that identifies you, and counts clicks that open the web app or a store.
- Does Tavala sell or share my data for advertising?
- No. Tavala has no ads and no advertising identifier, does not sell personal data and does not share it for cross-context behavioural advertising, under any definition of those terms.
Go further
- Privacy policyThe full text, with every provider and every retention period.
- Ask Tavala AI AgentWhat the assistant sends, and what it never sees.
- Offline-firstStart with no account at all.
- What Tavala stores and who can see itWithout an account your records never leave your device. With one, they sync to Tavala's servers. What is stored, who sees it, and the controls you have.
- Export all your dataSave everything you entered in Tavala as one JSON file - wallets, transactions, budgets, recurring rules, bank connections and trips. It is not encrypted.
- Lock Tavala with Face ID, a fingerprint or a passcodeTurn on the app lock so Tavala asks for Face ID, Touch ID, your fingerprint or your device passcode every time it opens. Not available in a browser.
Also in Tavala
- Ask Tavala AI AgentQuestions answered from your ledger, and changes you confirm.
- Multi-currencyThe rate from the day you paid, kept on every entry.
- Offline-first and privateEvery screen works with no connection and no account.
- Shared spacesOne ledger for up to six people, each on their own phone.
- Budgets, bills and forecastWhat is left, and what is safe to spend before pay day.
- Debt payoffSnowball or avalanche, and the month you are debt-free.
- Bank sync (US and Canada)Read-only import from US and Canadian banks, through Plaid.
- Trips and projectsA trip or a project kept apart from everyday spending.
Start with what you spent today.
There is no account to create and no card to enter. Pick your currency, add what you paid, and Home shows what is left.