---
title: Privacy Policy
description: What Tavala stores, what leaves your device, and what never does.
updated: 2026-10-24
---

Tavala is built so that the private thing stays private. You can track your whole financial life in this app without ever creating an account, and if you never create one, your records are never transmitted to us.

This policy explains exactly what that means, what changes when you do create an account, and what rights you have over the data you give us. It covers the Tavala apps for iPhone, iPad, Android and Mac, the web app at https://app.tavala.io, and the website at https://tavala.io.

## Who we are

Tavala LLC ("Tavala", "we", "us") is the controller of the personal data described in this policy.

- **Registered address:** 75 East 3rd Street, Sheridan, Wyoming 82801, Sheridan County, Wyoming, United States
- **Privacy enquiries:** [privacy@tavala.io](mailto:privacy@tavala.io)
- **Support:** [support@tavala.io](mailto:support@tavala.io)
- **Security reports:** [security@tavala.io](mailto:security@tavala.io)

## The short version

- **Guest mode sends us none of your records.** No account, no sync. Your entries live in a database on your device, or in your browser's own storage on the web, and nowhere else.
- **An account adds sync and backup, and nothing more.** When you sign in, your financial records are stored on our servers so your devices can share them and a lost phone does not take them with it. Apart from Ask Tavala, if you turn it on, that is the only reason they leave your device.
- **Ask Tavala, the assistant, is off until you turn it on.** When you do, the question you type and the names it needs go to an AI provider, which writes the answer. The amounts and notes in your records stay on your device, and nothing is saved without your tap.
- **We do not sell your data, and we never will.** There are no advertisements, no advertising identifier, no analytics SDK and no third-party trackers in the app. The website counts visits without cookies and without storing anything that identifies you, as described under "This website".
- **What you pay for is the only money we make.** Tavala Plus, the Group pass and the bank add-on. Payments go through the App Store, Google Play or Stripe, and we never see a card number.
- **Two things reach us from everyone, including guests:** crash reports, scrubbed of amounts and email addresses before they leave your device and not tied to your identity, and a download of the shared exchange-rate table, which carries nothing about you.
- **You can take everything with you or delete it outright**, from inside the app, at any time.

## The two ways to use Tavala

Almost every question about your privacy in Tavala has a different answer depending on which of these you are doing.

### Guest mode, the default

When you open Tavala for the first time you are a guest. There is no account and no sign-in. Everything you record - transactions, wallets, budgets, bills, debts, goals, trips - is written to a database inside the app's private storage on your device. In a browser it is written to that browser's own storage, and clearing the site's data removes it.

In this mode the app never sends your records anywhere. Two requests do leave the device, and neither carries anything about you: the app refreshes a shared table of exchange rates from our servers now and then (never more than every few hours, and never when you are offline, because a table of rates ships inside the app), and if the app crashes it sends a report, scrubbed as described below. We do not know who you are, and we hold no file about you.

If you delete the app, or clear the browser's data, that data is gone. We cannot recover it, because we never had it.

### With an account

Creating an account turns on synchronisation. Your records are uploaded to our database so that another device, or a person you share a space with, can see them, and so that they survive the device they were typed on. Your existing guest data is moved into the account when you sign up.

A free account syncs one device at a time; Tavala Plus syncs every device you own. Either way, this is the point at which we begin to hold personal data about you, and everything below describes that state.

## What we collect when you have an account

**Your account identity.** Your email address and the account identifier we generate for you. You choose a password; we never see it, because authentication is handled by our authentication provider, which stores only a cryptographic hash. When you sign up or reset your password we email you a one-time code.

**Sign-in security, only if you turn it on.** If you add an authenticator app for two-step verification, our authentication provider stores the secret key your app shares with it, so it can check your codes. If you add a passkey, it stores the passkey's public key and a name for it; the private key stays in your device's password manager and never leaves it. Removing either one in the app deletes what was stored for it. There are no recovery codes.

**Your financial records.** The things you enter: amounts, currencies, dates, notes and categories on each transaction; your wallets and their balances; budgets; recurring bills and income; savings goals; debts, including interest rates and payment schedules; the trips and projects you tag entries with; and the spaces you create. These are stored as you entered them.

**Shared space membership.** When you share a space, we store who its members are. If you invite someone by email, we use that address only to find their existing Tavala account and add them; a join code carries no personal data at all. Everyone in a space can see the records in it. Please only invite people you intend to show your finances to.

**The devices that sync.** To apply the free plan's one-device limit, we keep a short record of each device or browser that syncs your account: a random identifier, its kind (such as iPhone, Android tablet, Mac or browser, never a name you gave it) and when it was last seen. A device that has not synced for 30 days frees its place.

**Purchases, only if you buy something.** What you bought, when it started, when it renews or ended, and the transaction identifiers Apple, Google or Stripe gave us for it. Never a card number: the store or Stripe holds your payment details. The section on paying for Tavala explains who sees what.

**Bank connection details, only if you connect a bank.** This is described in its own section below.

## What we collect from everyone, including guests

**Crash reports and diagnostics.** When the app crashes or hits an error, on any platform, we receive a report through Sentry so we can fix it. The report contains the type of error, the code path it happened in, your device model, operating system version and locale, and a randomly generated identifier for your installation.

We have deliberately narrowed what those reports can carry:

- Your IP address is not attached.
- We never associate a crash report with your account, so a report cannot be traced back to you by us.
- Before a report leaves your device, the app strips email addresses and anything shaped like a monetary amount out of the error text.
- The trail of actions leading up to the error is cleared entirely, which is what stops your transaction amounts from ever appearing in a report.

Crash reporting is currently always on and cannot be switched off inside the app. We rely on our legitimate interest in keeping the app working, and we have limited the data to what that requires. If you object to it, the only way to stop it today is to stop using the app, and we would rather you wrote to us at [privacy@tavala.io](mailto:privacy@tavala.io) so we can weigh it up.

**Exchange rates.** The app periodically downloads a shared table of currency and cryptocurrency rates from our servers. The request carries no information about you and is not tied to an account; like any request on the internet it shows our hosting provider the address it came from, which is not kept with anything about you. The rates themselves are collected by our servers, once a day for currencies and a few times a day for cryptocurrencies, from public sources: ExchangeRate-API, a public currency dataset served by jsDelivr, and CoinGecko. Your device never contacts those sources, and nothing you enter is sent to them.

## Connecting a bank, which is optional

Tavala can import transactions from your bank automatically. This feature is off unless you choose it, requires an account with Tavala Plus, is billed as an add-on per connection, and is available in the United States and Canada.

We use **Plaid** to make the connection. When you link an account, you authenticate directly with your bank inside Plaid's own screen; on a Mac or in a browser that screen opens in a browser window. **Your banking username and password are never seen by Tavala** and never touch our servers.

What we receive and store afterwards is the transaction history (up to 730 days of it when you first connect) and balance for the accounts you selected, each account's name and last four digits, and, for loans and credit cards, the balance, interest rate and payment details your bank reports. We also store an access credential that lets us refresh the connection. That credential is encrypted and held only on our servers; it is never sent to your device.

The connection is **read-only**. Tavala cannot move money, make a payment, or change anything at your bank, and we never ask for the ability to.

Plaid processes your data both on our behalf and, as it states in its own end-user policy, for its own purposes such as preventing fraud and improving its services. Because of that, Plaid is not merely acting on our instructions, and we encourage you to read [Plaid's end user privacy policy](https://plaid.com/legal/) before connecting an account. You can disconnect at any time from the app, and you can ask Plaid directly to delete what it holds.

**When you disconnect a bank,** we revoke our access at Plaid, so no new data arrives, and you choose whether the transactions already imported stay in your records. If Plaid cannot be reached at that moment, we keep the encrypted access key only to retry, for at most 30 days, and use it for nothing else.

**If you keep the transactions,** we also keep a copy of the bank data exactly as Plaid sent it to us. It never reaches your device, and we use it only to investigate import problems and keep your records accurate. It stays until you delete your account, or the space the bank was linked to, and is then erased with everything else. **If you delete the transactions,** that copy is deleted with them.

**If you leave a shared space, or its owner removes you,** a bank you connected there stops importing at once and is disconnected within the hour. The transactions it already imported stay with the space as ordinary entries, and the copy of the bank data you linked there is deleted.

**If your bank tells us you stopped sharing one account,** that account stops importing, and we delete the copy of its bank data and any of its transactions that were still pending. Entries already in your records stay.

**If a connection stops working and is not repaired within 30 days,** for example because your bank asks you to sign in again or you withdrew access, we disconnect it at Plaid so that Plaid holds no access we no longer use. The same applies to a bank you link but never finish setting up (you never confirm which accounts to import) within 30 days. The app shows the date in advance and offers to reconnect. Transactions the connection already imported stay as ordinary entries, as if you had disconnected and kept them.

**Connections also end when they are no longer in use or no longer paid for.** If you do not open Tavala for 90 days, if your Tavala Plus subscription ends, or if a new connection's add-on is not paid within 24 hours of linking, we disconnect at Plaid in the same way, and the imported entries stay.

## Ask Tavala, which is optional

Ask Tavala is an assistant inside the app. It answers questions about your records, explains the terms Tavala uses, and can prepare a change, such as new entries or a budget, for you to confirm. It is off unless you turn it on, it needs an account, and it works only with a connection. Before your first question, the app shows you what is sent, where it goes and what is never included, and asks you to agree.

**How it works.** The app on your device does everything that touches your records: it finds the entries, does the arithmetic and fills in every figure. To understand your question and put the answer into words, it uses an AI language model run by **OpenAI**, and, for a harder question on Tavala Plus, one run by **Anthropic**. Each request goes from your device to our servers in the European Union (Ireland) and from there to the provider; your device never contacts the provider itself.

**What is sent to the AI provider:**

- The question you typed, exactly as you typed it, with the earlier questions and answers of the same conversation so that a follow-up makes sense. Anything you type into a question, an amount or a name included, is sent as written.
- The names the answer needs from the space you are in: wallets, categories, trips and projects, recurring rules and, where an answer lists entries, the names on them, such as a merchant.
- The shape of the answer: which kind of figure goes where, dates and counts.

**What is never sent:** the amounts in your records, which the provider sees only as placeholders that your device fills in; the notes on your entries, kept back the same way; anything from your other spaces; bank sign-in details, card numbers and bank access credentials.

**What the providers do with it.** They use it to write the answer and do not use it to train their models. Under their terms for business customers they may keep a request for up to 30 days to detect misuse, and then delete it. Both process requests in the United States.

**What we keep.** We record that you agreed and when, and when you turned Ask Tavala off. To count the free question of the day and the monthly allowance, we record when each question was asked, and delete that record after 90 days. For each request we keep an activity line: the time, the tool the assistant used, the space, how many of your records it read, which provider and model answered, and the size and cost of the request. The activity line never contains your question, the answer or an amount. You can read it in **Settings › Ask Tavala**, it is part of your data export, and it is deleted after 90 days. We do not keep your questions or the answers on our servers.

**On your device.** The app keeps your last three questions, to offer them again; signing out removes them. If you tap **Report this answer**, the report is kept on your device, and the app asks before it sends anything to our support address.

**Changes it prepares.** Ask Tavala never changes your records on its own. A change is shown as a preview, and it is saved only when you tap **Confirm**, through the same rules as a change you make by hand.

**Turning it off.** Switch Ask Tavala off in **Settings › Ask Tavala**. Your next question on any of your devices is refused until you turn it on again. The activity lines already kept stay until their 90 days end, or until you delete your account.

**Answers can be wrong.** The words are generated by an AI model, and the app says so above every conversation. The figures come from your records, but a model can misread a question or describe a figure badly. Check an answer before you rely on it.

## Things that stay on your device

Some parts of the app look like they involve us, and do not.

- **Reminders** about bills, the optional daily nudge and the cash check-in are scheduled by your device's own operating system. Nothing is sent from our servers, and the reminder text deliberately never contains an amount.
- **The app lock, and the checks before sensitive actions,** use your device's fingerprint, face or passcode check, or a passkey. Connecting a bank and changing your security settings always ask; exporting your data and deleting your account ask if you turn that on in Settings. The app is told only whether the check passed. Biometric data is held by your operating system and is never available to us.
- **The home screen widget** reads a small summary of your spending that the app writes into shared device storage. It contains totals only, never balances, and it never leaves the device.
- **Exports**, whether the complete JSON file or a CSV or PDF report, are written to your device and handed to whichever app you choose to share them with. They do not pass through us.
- **The arithmetic.** Forecasts, payoff plans, budget statuses, spending insights and every figure in an Ask Tavala answer are calculated on your device from the figures you entered.

## Paying for Tavala

Tavala is free to use. Tavala Plus, the Group pass and the bank add-on are paid, and buying them is the only time money and payment details come into the picture.

**In the apps,** purchases go through the App Store or Google Play. Apple or Google takes the payment and holds your payment details under its own policies; we never see them. We receive a receipt and a transaction identifier, which we check with RevenueCat, a subscription service that confirms store purchases for us and recognises them again when you sign in on another device.

**In the browser,** purchases go through Stripe. Stripe takes your card details on its own pages and holds them; we receive the plan you bought, its dates, and Stripe's identifiers for you and the subscription. Stripe also runs the page in Settings where you change or cancel a web subscription and download its invoices.

We keep a record of what you bought, from when to when, and how it ended, because it decides what the app lets you do and because we must account for it. Those records stay as long as tax and accounting law requires, which can be after you delete your account; they hold no financial entries of yours.

Prices are never set from anything we know about you.

## Why we are allowed to use your data

For anyone in the UK, the European Economic Area, or another region with comparable law, these are our legal bases.

| What we do | Why we are permitted to |
| --- | --- |
| Hold your account and sync your records | Performance of our contract with you |
| Share records with members of a space you joined | Performance of our contract with you |
| Import your bank transactions | Your consent, which you may withdraw by disconnecting |
| Answer your questions with Ask Tavala | Your consent, which you may withdraw by turning it off in Settings |
| Take payment and keep records of purchases | Performance of our contract with you, and compliance with a legal obligation |
| Send the emails the service needs: sign-in codes, a notice before Plus ends, a warning before an unused account is deleted | Performance of our contract with you |
| Receive crash and diagnostic reports | Our legitimate interest in a working, secure app |
| Delete a free account nobody has opened for two years | Our legitimate interest in not holding data no one uses, with warnings first |
| Keep records needed for accounting or to defend a legal claim | Compliance with a legal obligation, and our legitimate interests |

We do not carry out profiling or automated decision-making that produces legal or similarly significant effects. The forecasts, payoff plans and spending insights in the app are calculations that run on your device from figures you entered; they are not decisions we take about you. Ask Tavala's answers are written by an AI model around figures your device calculated; they inform you and decide nothing about you.

## Who else touches your data

We keep this list short on purpose. These are our processors and providers.

| Provider | What it does | Where it processes |
| --- | --- | --- |
| Supabase | Database and authentication for signed-in accounts | the European Union (Ireland) |
| PowerSync | The synchronisation service that moves records between your devices and our database | the European Union |
| Amazon Web Services | Serves the web app and this website | the European Union (Ireland), through a content delivery network with edge locations near you |
| Sentry | Crash and error reporting | United States |
| Plaid | Bank connections, only if you use them | United States and the European Union |
| OpenAI | Writes Ask Tavala's answers, only if you turn it on | United States |
| Anthropic | Writes answers to harder Ask Tavala questions on Tavala Plus, only if you turn it on | United States |
| RevenueCat | Confirms App Store and Google Play purchases | United States |
| Stripe | Payments on the web, only if you buy there | United States and the European Union |
| Resend | Sending account and billing emails, such as sign-in codes, password resets and notices | United States |
| Umami | Counting visits to this website, without cookies | the European Union |

Apple and Google take payment for purchases made in their stores as sellers in their own right, under their own terms and privacy policies, not on our instructions.

**Where your records are stored.** Your account and financial records are held in the European Union (Ireland), and the service that synchronises them between your devices runs in the European Union. They are not stored in the United States, so if you are in the European Economic Area your records stay inside it. If you turn on Ask Tavala, the parts of a question described in its section above are processed in the United States by OpenAI or Anthropic, and kept there for no more than the 30 days described. The web app you load from app.tavala.io is served from a content delivery network near you; that is the app's code, not your records, which travel only between your browser and Ireland.

**Who reaches them from where.** Tavala LLC is registered in the United States, so we administer those systems from there, crash reports are processed there, purchases are confirmed there, emails are sent from there, and, if you use it, Ask Tavala's answers are written there. That makes the United States a destination for some of your data even though your records are not stored in it.

If you are in the United Kingdom, the European Economic Area or Switzerland, those transfers rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum where it applies, or another lawful transfer mechanism. Write to us and we will tell you which safeguards cover you.

We do not sell personal data, and we do not share it for cross-context behavioural advertising, under any definition of those terms in California law or elsewhere. We have never done so.

## This website

tavala.io sets no cookies and loads no advertising scripts. To count visits it uses Umami, a cookieless analytics service: for each page view it records the page, the site that sent you, your browser, operating system, device type and country, and it stores nothing that identifies you and cannot follow you to other websites. It also counts, without more detail, clicks that open the web app or an app store. If your browser sends a Do Not Track signal, nothing is counted. If you switch it between light and dark, that choice is remembered in your browser only. Our hosting provider keeps the standard access logs of any web server (the address a request came from, the page and the time) for a limited period, which we use only to investigate abuse.

## How long we keep things

**Your records stay until you remove them.** We do not expire your data while you use your account, because a spending history is only useful over years.

**A free account nobody opens is deleted after 24 months.** We email you 30 days and 7 days before it happens, and opening the app once keeps the account. An account with Tavala Plus is not subject to this while the subscription runs.

**When you delete your account, your records are deleted with it, at once.** A space you share with other people stays with them, including any transactions a bank you connected there already imported, which remain as ordinary entries no longer linked to your bank; the [account deletion page](https://tavala.io/delete-account) explains this. We keep encrypted daily backups of the database so that a failure on our side cannot lose everyone's records. They are kept on a rolling cycle and fully replaced within 30 days, so a deleted record is gone from them within that time, and a backup is only ever restored to recover from such a failure, never to bring an account back.

**Bank data you keep stays until you delete your account.** Disconnecting a bank and keeping its transactions stops new data arriving but keeps the copy Plaid sent us. Disconnecting and deleting the transactions deletes that copy too, and so does deleting your account or the space the bank was linked to. Leaving a shared space deletes the copy of the bank data you linked there. A connection that ends on its own, because it stayed broken, was never set up, went unused for 90 days, was not paid for, or outlived your Plus subscription, is treated the same way as when you disconnect and keep its transactions.

**Ask Tavala's activity lines and question records are deleted after 90 days**, and deleting your account deletes them at once, with the record of your consent. Your questions and the answers are never stored on our servers.

**Purchase records stay as long as tax and accounting law requires**, even after you delete your account. They contain the plan, the dates and the transaction identifiers, and no financial entries.

**Crash reports are deleted on a 90-day rolling basis.** They are not linked to your account, so they are not affected by deleting it and cannot be retrieved for you individually.

**Guest data has no retention period, because we never receive it.** It exists only on your device, or in your browser, until you delete the app or clear its data.

## Your rights

You may ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to our use of it. You may also ask for it in a portable form, and withdraw any consent you have given.

Two of these you can exercise immediately, on any device or at app.tavala.io, without contacting us at all:

- **Get a copy.** Settings → **Export my data** writes a complete JSON file of your records to your device. Reports can also be exported as CSV or PDF.
- **Delete everything.** Settings → **Delete account** removes your account and its data. Full details, including what happens to shared spaces and subscriptions, are on our [account deletion page](https://tavala.io/delete-account).

For anything else, write to [privacy@tavala.io](mailto:privacy@tavala.io). We will respond within 30 days. We may need to confirm you control the email address on the account before we act.

If you are in the EEA or UK and you think we have handled your data badly, you may complain to your national data protection authority. We would appreciate the chance to put it right first.

## Security

Everything that travels between the app and our servers is encrypted in transit with TLS. Bank access credentials are encrypted at rest with AES-256 and never leave our servers. The database is backed up daily, encrypted, and the backups are reachable only by the same few people as the database itself. Access to production systems is limited to those who need it, and every account that can reach them is protected by two-factor authentication.

Connecting a bank asks your device to confirm it is you first, with your face, fingerprint, passcode or a passkey, every time Plaid opens. You can also turn on two-step verification with an authenticator app, which then asks for a code each time you sign in on a new device or reset your password; add passkeys to sign in without a password on iPhone, iPad, Mac, Android and in browsers that support them; and ask for the same check before exporting your data or deleting your account. All of this is in Settings, under **Sign-in & security**.

**One thing we want to be straight about:** the database on your device is not itself encrypted by Tavala beyond the protection your operating system already applies to an app's private storage. On a modern iPhone, Android phone or Mac with a passcode set, that storage is encrypted by the device. In a browser, your guest data and your signed-in session are protected only by your browser profile and the device it runs on, so sign out on a computer you share. Turning on the app lock in Settings adds a check before the app opens. We are working on encrypting the local database directly, and we will update this policy when we do.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your data, we will tell you and the authorities as the law requires.

**Found a security problem?** Write to [security@tavala.io](mailto:security@tavala.io). We acknowledge reports within 3 business days and keep you updated while we fix it.

## Children

Tavala is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, write to [privacy@tavala.io](mailto:privacy@tavala.io) and we will remove it.

## Changes to this policy

If we change this policy in a way that materially affects you, we will tell you in the app or by email before the change takes effect. Older versions are available on request.

The date at the top of this page is the date the current version took effect.

## Contact

Questions, requests and complaints all go to the same place:

**Tavala LLC**\
75 East 3rd Street\
Sheridan, Wyoming 82801\
Sheridan County, Wyoming\
United States\
[privacy@tavala.io](mailto:privacy@tavala.io)