This is a draft waiting on review. It is not in force yet.
TallyHop helps a group decide a trip together. This page says what it keeps, why, who helps run it, and how to delete it.
What TallyHop keeps
- Your account. Your email address and the name you give. If you sign in with Apple, Apple gives us an account ID and an email address, which may be a private address that forwards to you. We also keep a token from Apple so we can withdraw TallyHop’s access when you delete your account.
- Your trips. The trips you start or join: their names, destinations and dates, the places on them and who added each one, your votes (vetoes included) and any reason you give for one, how you rated places you went to, and what happened to each decided place.
- Your travel. The flights, trains and other journeys you add to a trip: how you travel, the number on the ticket, where each one leaves from and arrives, its times, and who is on it. Airports come from an open list; a station or place you type is looked up with Google.
- Photos and notes you add to places on a trip.
- Saved places in your library.
- Links you share. When you share or paste a link, we keep it and the text we read from it, such as a caption, to find the places it mentions.
- Guests who vote from a link without an account: the name they type, their votes, and the private link that is their way back in. No email.
- Notification tokens. If you allow notifications on your iPhone, a token that lets us send them to that device.
- Usage events. A record of what happens in TallyHop — a trip started, a place added, a vote cast, a place locked, a page opened, a sign-in — with the time and the trip member or account involved. We use it to see whether groups reach decisions and where they get stuck. It stays with us.
- Use without an account. Starting a trip needs an account. Trips started on the web without one, before that changed, keep working and move to an account when their organizer creates one. To limit how much one connection can use TallyHop without an account, we keep a one-way, scrambled form of its IP address — never the address itself.
Usage events are tied to your account when you have one, so we can see how one person uses TallyHop across trips, with whether each came from the web or the iPhone app and the app’s version. A guest’s events are tied to their place on the trip until they sign in. Deleting your account removes the tie.
TallyHop reads your location only if you ask it to, for getaways near you on the iPhone app’s Explore tab, and only after you tap “Use my location”. iOS gives it approximately, your iPhone rounds it to half a degree of latitude and longitude, an area tens of kilometres across, and only that area is sent, without your name or account. We keep the getaways found for each area for a week, so the next person there gets them quickly, but never who asked or when, and the area is never in usage events. You can pick a home city instead, which stays on your iPhone. Otherwise, destinations and places come from what you search for and share.
What TallyHop doesn’t do
- No ads, and no selling or sharing your data for advertising.
- No tracking you across other companies’ apps or websites.
- No third-party analytics service. Usage events are ours alone.
- We don’t use what you add to train AI models.
Who sees what
- Your trip’s members see its places, tallies and decisions, the plan, each member’s name, and the photos and notes added to it. If you start a trip before giving a name, the group sees the part of your email address before the @.
- Votes. TallyHop shows the group how many said yes, not who voted which way. Votes are stored with your place on the trip, and members’ devices receive them to count the tally, so treat a vote as something your group could find out.
- Ratings of places you went to are shown only as the group’s overall verdict.
- Travel is seen by the trip’s members, who can add, change or join a journey, so a family can share one. It is never on the shared plan or recap, and our usage events record only that a journey was added, never its details.
- The shared plan and recap. If an organizer turns on the plan link, anyone with it sees the trip’s name, destination, dates and decided places. It never shows names, votes, ratings, anyone’s travel, or the group’s photos and notes.
Who helps run TallyHop
These companies process data for us, only to run the part of TallyHop named beside them. Your data is stored in the United States.
- Supabase — the database, sign-in, photo storage and live updates. It holds everything above. Privacy
- Vercel — hosts the website and its server, and sees your IP address and requests as any web host does. Privacy
- Google — maps and place information: the places you search for, the places on your trips, and the stations or places you type for a journey. Google’s place cards show each place’s details and photos straight from Google, and maps, map images and travel times come from Google too, so Google sees your IP address. In the iPhone app, Google’s maps and place cards also collect diagnostics, a device identifier, your approximate location and the places you look up, for Google’s own use. Privacy
- Anthropic — its AI model reads the text from links you share to find places, along with the pictures in a public post when its words name none, and writes a short note for each day of a drafted plan. We send it that text, those pictures and the plan’s places, never your name, email or votes. Privacy
- Wikimedia — a trip’s destination is found through Wikipedia and Wikidata, and its photograph comes from Wikimedia Commons, the free library behind Wikipedia, loading from Wikimedia’s servers, so Wikimedia sees your IP address. To find a destination and suggest its photo, we send Wikipedia and Wikidata the words an organizer types for it — never who you are. Explore’s places come the same way, and so do the opening lines of a destination’s Wikivoyage guide; for getaways near you, our server picks them from the rounded area above and asks Wikimedia only about the places it picked. Privacy
- Expo — delivers notifications to iPhones: the device’s token and the notification’s words, such as a trip’s name and what kind of place it is. Privacy
- Apple — Sign in with Apple, and delivering notifications. Privacy
- Resend — sends sign-in emails: your address and the code. Privacy
How long it’s kept
Your account and what’s in it stay until you delete them. A trip stays while it exists; an organizer can archive a finished trip, and an archive is kept as the group’s record. Travel is deleted 30 days after the trip’s last day, and at once when you leave a trip or are removed from it. Our providers keep their own server logs for short periods.
Deleting your data
Delete my account is in Profile, on the web and in the iPhone app. It shows what will happen to each of your trips before you confirm.
- Trips still being decided: you leave them. Your votes go, and the group’s tallies count again without you.
- Trips that are over or archived: what you did stays, so the record still adds up — your votes, ratings and the places you added — under “Former member” instead of your name.
- Your photos and notes are deleted from every trip.
- A trip you organize passes to the member who joined it earliest and has an account, and you see who before you confirm. If only guests are left, the trip is archived. If nobody else is on it, it is deleted.
- Your saved places, notification tokens and profile are deleted. If you signed in with Apple, we withdraw TallyHop’s access with Apple.
- Usage events stay with your name and account removed, so counts still add up.
Leave this trip is in a trip’s menu, for members and guests. Before a trip ends, your votes leave with you. After it ends, your name and what you added stay on its record, as they do when an organizer removes a member.
If you can’t sign in to delete your account, write to the address on this page, once it is in force.
Your choices
- Change your name in Profile.
- Turn notifications off in your iPhone’s Settings.
- To get a copy of your data or correct something you can’t change yourself, write to the address on this page, once it is in force.
Children
TallyHop is not meant for children under 13, and we don’t knowingly keep their data. If you think a child has an account, write to the address on this page, once it is in force and we’ll delete it.
Changes and contact
If this policy changes, the date at the top changes with it. If a change affects data you’ve already given us, we’ll say so in TallyHop before it takes effect. Questions go to the address on this page, once it is in force. The terms of use cover the rest.