Privacy

Who runs this

Tally is a personal, open-source project run by one person, Bill Zhang. It is not a company. Questions, or a deletion request, go to billzhangsc@gmail.com.

What is stored

• Your account — the email address you sign up with, and a hashed password. Passwords are never stored in a readable form.
• Your diary — the foods you log, portions, meals, timestamps and the macro numbers captured at the moment you log them.
• What you said — the raw text or voice transcript of every utterance you submit, kept so the app can learn your phrasing and so mistakes can be traced. Photos you submit are processed for recognition.
• What it learned — the mapping from your phrases to specific foods, and the portion you usually take.
• Weigh-ins and profile — any weight you log, plus the height, age, sex, activity level and goals you enter to generate targets.
• Where a photo was taken — on the owner’s account only. A photo taken with the camera carries the phone’s location, which is used once to look up the places around it and is never stored. The names of those places are kept, in the log and its trace, because they are what the model was told. Demo accounts are never asked for their location.
• Oura activity — on the owner’s account only, once Oura is connected: the full daily-activity and workout records Oura returns, from 90 days before connecting onward. That includes each day’s calories burned, steps and activity score, and Oura’s own finer detail such as its minute-by-minute activity levels. The tokens that let Tally read them are stored encrypted.

Where it is processed

Tally is a small app standing on other people’s services. These are all of them:

• Neon — the Postgres database that holds everything above, and the managed authentication that issues your session.
• Vercel — hosting for the web app and the API.
• Deepgram — converts your voice recordings to text. OpenAI’s transcription is the fallback when it fails.
• OpenAI — splits your sentence into food items, reads photos you submit, and runs the agent that searches for a food it has not seen before.
• USDA FoodData Central and Open Food Facts — the food databases. A lookup sends the name or barcode of a food, never your diary.
• Google Places — owner’s account only. Receives the location of a camera photo and returns the names of the places around it.
• Firecrawl — owner’s account only. Reads a restaurant’s published menu page when the photo lane looks one up.
• Oura — owner’s account only, once connected. Tally reads daily activity and workouts from it; nothing from your diary is sent to Oura.

Application traces are kept on a server run by the same person who runs Tally, not a third-party analytics product. There is no advertising, no tracking pixels and no analytics SDK in the app.

Who can see your rows

Accounts are separated inside the database itself, by Postgres row-level security rather than by application code — the database role the app runs as cannot read another account’s rows even if the app asks it to. The one shared table is the cache of public food records, which holds nutrition data and nothing personal.

The one exception is the operator. As owner of the database, Bill has administrative access that row-level security does not apply to, and can read any account’s rows directly. If you would rather nobody else could read your diary, run your own copy — see below.

Your data is not sold, rented, or shared with anyone beyond the services listed above.

Demo accounts

Anyone can sign up for a demo account, capped at one log a day. A demo is for trying the app, not for keeping a diary, and its rows are stored the same way and deleted on the same request.

Cookies

Only the sign-in service’s own two: a session token, and a signed copy of your session that lets a page skip re-checking it for up to fifteen minutes. No advertising or analytics cookies.

Getting your data out, or deleted

There is no self-serve export or delete button yet. Email billzhangsc@gmail.com from the address on the account and everything tied to it will be exported or removed. Because Tally is MIT-licensed, the other option is to run your own copy and keep the data on infrastructure you control.

Changes

If this policy changes, the date at the top changes with it. The full history of this page is public in the repository.