What Tavala stores and who can see it

Without an account, everything you record stays on your device and Tavala never receives it. With an account, your records are also stored on Tavala's servers so your devices can share them and a lost phone does not take them with it. Tavala has no ads, no advertising identifier and no analytics tracking, and it does not sell data.

This page is the short version. The full text is the privacy policy at tavala.io/privacy, which you can also open from SettingsAboutPrivacy policy.

Without an account (guest)

• Your wallets, entries, budgets, bills, debts, goals and trips are written to a database inside the app on your device. In a browser they are written to that browser's own storage.
• The app sends none of those records anywhere. There is no copy on a server and no backup.
• Deleting the app, or clearing the site's data in your browser, removes them for good. Tavala cannot recover them because it never had them.
• When you create an account, your data moves into it. See use Tavala without an account.

With an account

Creating an account turns on sync and backup. Ask Tavala, the assistant, stays off until you turn it on. Tavala then stores:

Your records are stored in the European Union (Ireland), and the sync service runs in the European Union.

Who can see your records

• In a private space, only you.
• In a shared space, every member sees every entry in it. Invite only people you want to show those finances to. A space shows its members, and members cannot see your other spaces.
• Tavala holds your records to run sync and backup, and limits who can reach its systems.
• AI providers, only if you turn on Ask Tavala. Your question and the names it needs go to OpenAI, or Anthropic for a hard question, to write the answer. Amounts and notes stay on your device, and neither provider trains on it. See what Ask Tavala sends and keeps.
• Your bank is never given your Tavala data. A bank connection is read-only: Tavala can see your transactions and balances and can never move money. You sign in on your bank's own screen through Plaid, and Tavala never sees your bank password.

What reaches Tavala from everyone, guests too

• Crash reports. When the app crashes, a report is sent so Tavala can fix it. It carries the type of error, your device model, system version and language, and a random installation identifier. Before it leaves your device, email addresses and anything shaped like an amount are removed, and the trail of recent actions is cleared. It is not linked to your account. You cannot switch crash reports off inside the app.
• Exchange rates. The app downloads a shared table of rates from time to time. The request carries nothing about you.

What stays on your device

• The app lock and hidden amounts. These choices are kept on the device and turn off when you sign out. See lock Tavala with Face ID, a fingerprint or a passcode and hide amounts on screen.
• Bill reminders are scheduled by your device. Nothing is sent from Tavala's servers, and a reminder never contains an amount.
• The home screen widget reads a small summary of today's and this month's spending that the app writes on the device. It never leaves the device.
• Exports are written to your device and handed to the app you choose. They do not pass through Tavala. See export all your data.
• Forecasts, payoff plans and budget statuses are worked out on your device from the figures you entered.

Your controls

• Take a copy: export all your data as a JSON file.
• Delete it: delete your account removes the account and its data. A free account nobody opens for 24 months is deleted after two warning emails.
• Add checks: two-step verification and passkeys protect the account. Connecting a bank always asks your device to confirm it is you.
• Ask a question: write to privacy@tavala.io. See contact support for everything else.