Privacy policy

Organizations and the people in them

TallyOps is used by organizations, such as a design or development agency. An organization’s admins decide who can sign in by adding their email addresses, and they decide what work data goes into TallyOps. For that work data we act on the organization’s behalf and follow its instructions. If you have a question about your organization’s data, you can ask your admin or contact us.

Information we collect

When you sign in

You sign in with Google or with a one-time link sent to your email. With Google, we receive your name, email address and profile picture from your Google account. We use your email address to match you to the organizations that added you. See Google user data below.

Work data your organization enters

Clients, client contacts, projects, phases, tasks and deliverables; time entries, timers and notes; people, roles, capacity, billing rates and cost rates; estimates, invoices, bills, payments and approvals; scope-risk flags; and the share links an organization creates for its clients.

Coding sessions, if you connect a coding tool

If you install the tt command-line tool and connect Claude Code, Cursor or Codex, ending a session creates a draft time entry with your attention time, the agent’s working time, the tool and AI model used, token counts and AI cost, the repository, branch and folder, and the identifiers and subject lines of commits made during the session. The conversation with the coding tool stays on your computer and is never sent to us.

Connected services

When an admin connects QuickBooks Online, we read and write the customers, items, vendors, classes, estimates, invoices, bills, payments and other records needed to keep the books in step. When an admin imports from Harvest, we copy the organization’s Harvest time history. Access tokens for these services are stored encrypted.

Technical information

We use cookies only to keep you signed in and to return you to the page you were opening. We don’t use advertising or analytics cookies or third-party trackers. Our hosting and database providers keep standard server logs, such as IP address, browser type and the pages requested, for security and troubleshooting.

How we use information

• To sign you in and keep each organization’s data separate from every other.
• To run TallyOps: timesheets, approvals, budgets, reports, estimates and invoice drafts.
• To send records to QuickBooks Online, only after an admin in your organization approves them.
• To send reminders and alerts your organization has set up.
• To sort imported work history into deliverable types with Anthropic’s Claude, when an organization chooses to. Task names and notes from that history are sent to Anthropic for this.
• To keep the service secure, fix problems and answer your requests.

We don’t sell personal information, use it for advertising, or use it to train AI models.

Google user data

When you choose “Continue with Google”, TallyOps asks Google only for basic sign-in information: your name, email address and profile picture (the openid, email and profile scopes). TallyOps doesn’t request access to Gmail, Google Drive, Google Calendar or any other Google service.

• How we use it: only to confirm who you are and to match your email address to the organizations that added you. If your email doesn’t belong to any organization, you are signed straight back out.
• How we store it: our authentication provider, Supabase, stores the information Google returns, alongside your sign-in record.
• How we share it: we don’t share Google user data with anyone except Supabase, which processes it for us to sign you in. We don’t sell it, use it for advertising, or use it to train AI models.
• Removing it: you can remove TallyOps’s access at any time from your Google account settings, and ask us at aedmundson@weekenddevs.com to delete the information we hold.

TallyOps’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share information with

Within your organization, what people can see depends on their role: for example, only admins see cost rates and margins. Clients see only what your organization puts on a share link, and never cost or rate information.

We use these service providers to run TallyOps:

• Supabase: database and sign-in.
• Vercel: web hosting.
• Inngest: background jobs, such as nightly reports and reminders.
• GitHub and a cloud storage provider: encrypted nightly backups.
• Anthropic: classifying imported work history, when an organization uses it.

We also exchange data with the services your organization connects, such as Intuit QuickBooks Online and Harvest, which handle it under their own privacy policies. We may disclose information when the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of our business, in which case this policy continues to apply to it.

How long we keep information

We keep information while your organization uses TallyOps. Approved and locked records keep an audit history, because invoices and bills depend on them. When an organization or a person asks us to delete their data, we delete it from the live database within 30 days, unless we must keep it by law. Encrypted backups are replaced on a rolling schedule.

How we protect information

Each organization’s data is kept apart by row-level security in the database. Connections use HTTPS, access tokens for connected services are encrypted, backups are encrypted, and cost data is limited to admins. No system is perfectly secure, but we work to protect your information and will tell affected organizations promptly if a breach affects their data.

Your choices and rights

You can ask to see, correct, export or delete your personal information by emailing aedmundson@weekenddevs.com. Depending on where you live, you may have further rights under local law, including the right to appeal a decision about your request. If your organization controls the data, we may pass your request to its admin. We won’t treat you differently for exercising your rights.

Children

TallyOps is a work tool and isn’t meant for anyone under 16. We don’t knowingly collect information from children.

Where information is processed

We and our providers may process information in the United States and other countries where they operate. Data protection laws there may differ from those where you live.

Changes to this policy

When we change this policy we update the date at the top. If a change is significant, we tell organization admins before it takes effect.

Contact

WeekendDevs, aedmundson@weekenddevs.com. See also our terms of service.