The data we collect
- Account details: your email address and display name.
- Financial records you create: accounts, balances, transactions, categories, budgets, goals, debts, and subscriptions.
- Email-alert data (only if you connect Gmail): transaction details extracted from the bank alerts MyTally reads in your connected Gmail — such as amount, date, narration, the bank name, and the last 4 digits of an account. We do not store the raw email content.
- Documents you import: statements or receipts you upload for transaction extraction.
- Limited technical data needed to run the app reliably (for example, app and device basics and error diagnostics).
- We do not collect your bank login, card numbers, card PIN, BVN, OTPs, or full account numbers, and we never ask for them.
Why we use it (lawful basis)
- To provide the service you asked for — recording, categorising, syncing, and planning your finances — on the basis of our agreement with you.
- For email auto-tracking and document import, on the basis of your explicit consent, which is recorded when you turn the feature on and which you can withdraw at any time.
- To keep the app secure and working, and to respond to support requests, on the basis of our legitimate interest in providing a safe, reliable product.
- We use the minimum data necessary and do not sell your personal data or use your financial details for advertising.
Connecting your Google account (Gmail auto-tracking)
MyTally lets you connect your Google account so the app can turn your bank transaction-alert emails into transactions automatically. This is optional and off by default — you turn it on yourself, and you can turn it off at any time.
What we access
When you connect Google, MyTally requests a single, read-only permission:
- https://www.googleapis.com/auth/gmail.readonly — read-only access to Gmail.
We use this access only to read transaction-alert emails from a fixed list of known bank and fintech senders. We do not send, modify, label, or delete any email, and we do not read the rest of your inbox. MyTally never receives your Google password.
How we use it
Each matching bank-alert email is read and parsed to extract the transaction details — amount, date, narration/description, the bank name, and the last four digits of an account — so we can create a transaction in your MyTally ledger for you to review or auto-add. We use this data only to provide the auto-tracking feature to you.
What we store
We store only the extracted transaction fields. We do not store the raw email content — it is parsed in transit and discarded, and is never written to our database. Pending alert drafts awaiting your review are deleted automatically (typically within about 90 days; resolved drafts sooner).
How we protect it
Where MyTally holds a Google authorization token to keep the connection working, that token is encrypted at rest and is never exposed to the client app. All data is transmitted over encrypted connections, and each user can access only their own data.
Limited Use
MyTally's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
In particular, Google user data obtained through these scopes is never sold, never used for advertising, never used to train generalized or non-personalized AI/ML models, and not transferred to others except (a) as necessary to provide or improve the auto-tracking feature for you, (b) to comply with applicable law, or (c) as part of a merger or acquisition with equivalent protections and your consent.
Sub-processors
To run this feature, connected email data may be processed by our secure cloud hosting and backend provider (which stores your extracted transaction records) and, where the app cannot deterministically read an unusual alert, an automated text-extraction service used solely to read the figures in that alert. These providers act on our instructions under data-processing terms and may not use your data for their own purposes.
Revoking access
You can disconnect at any time:
- In the app: Profile → Email Auto-Tracking → Remove on the connected Gmail.
- In your Google account: Google Account → Security → Third-party access (https://myaccount.google.com/permissions), then remove MyTally.
Disconnecting immediately revokes MyTally's access at Google and stops all further reading. Deleting your MyTally account also revokes any connected Google grant as part of deletion.
Automated document processing
When you upload a statement or receipt, the file is sent securely to a processing service that extracts the transactions and returns them to you for review. Documents are processed only to read the figures and are not used to profile you.
Categorisation suggestions are produced automatically to save you time; you can always change them, and no automated decision has a legal or similarly significant effect on you.
Service providers we use
We share data only with trusted providers that process it on our behalf to run the app. They act on our instructions under data-processing terms and are not permitted to use your data for their own purposes:
- Supabase — secure cloud hosting, database, and authentication, which store your account and financial records.
- Google (Gemini API) — automated extraction of transactions from the statements and receipts you import, and from the occasional bank alert the app cannot read deterministically.
- Resend — delivery of the app's transactional and support emails.
- The Apple App Store and Google Play — app distribution and updates.
- PostHog (EU cloud) — usage analytics and crash reports, as described below.
- RevenueCat — keeps track of Pro subscriptions bought through the App Store or Google Play.
Usage analytics and how you found us
To understand which parts of the app work and which need fixing, we collect usage data when you use MyTally. This is separate from your financial records.
- App activity: which screens you open, which features you use (for example, starting an import or connecting Gmail), and whether a step succeeded or failed.
- App information and performance: crash reports and error messages, the app version and update you are running, and basic device details (operating system, device model, language).
- Identifiers: your MyTally user ID and an ID generated by the analytics software for your installation. We do not collect your phone's advertising ID.
- Account-level facts: your plan (free or Pro), whether you are in a trial, how many accounts you have added, and how you track (Gmail, forwarding or manual).
- The days on which you opened the app, stored in our own database.
- Where you came from, if you arrive through a campaign link or invite, or tell us how you heard about MyTally: the campaign name and source, and the answer you give. We do not store the full address of the page you came from.
- If you use an invite code, which code it was, so we can see that a friend brought you. We give no rewards for invites today.
- When someone opens one of our download or invite links, we log the click: the campaign, the kind of device (Android, iPhone or computer) and the time. We don't log your IP address or browser details, and we delete these click logs after 180 days.
What analytics never includes
Usage data never includes your transactions or their amounts, narrations or descriptions, the names of people or businesses you pay or receive money from, your email address, or any part of your account numbers.
PostHog (PostHog Inc., using its EU cloud hosting in the European Union) receives usage events and crash reports on our behalf. RevenueCat (RevenueCat Inc.) processes your subscription and purchase records so we can confirm your Pro access; it receives your MyTally user ID and the purchase details from the App Store or Google Play, never your financial records. Both act as our data processors and may not use your data for their own purposes.
We process usage data on the basis of our legitimate interest, under the Nigeria Data Protection Act 2023, in keeping MyTally reliable and improving it: finding crashes, seeing where people get stuck, and measuring whether changes help. The data is limited to how the app is used, excludes your financial details, is not sold, and is not used for advertising or to track you across other companies' apps or websites.
Usage events and crash reports are kept for up to 24 months and then deleted. Subscription records are kept for as long as your account exists, and afterwards for as long as the law requires us to keep transaction records for tax and accounting.
You can switch off usage analytics at any time in Profile > Preferences > Share usage analytics. When it is off, the app stops sending usage events and crash reports from that device, stops recording where you came from, and we stop recording your active days. The setting is saved to your account, so it applies on your other devices too. Switching it off does not change how MyTally works. Subscription records are still processed, because we need them to provide Pro.
Where your data is processed
Our hosting and processing providers may store and process data on servers located outside Nigeria. Where data is transferred across borders, we rely on providers that apply recognised safeguards and appropriate protections, consistent with the NDPA/NDPR. By using the app you are informed of and consent to this processing.
How long we keep it
Your account and financial records are kept for as long as your account exists, so the app works across your devices.
Email-alert drafts awaiting review are deleted automatically (typically within about 90 days), and resolved drafts sooner (around 30 days). Raw email content is not kept at all.
When you delete your account, your data is permanently removed from our systems as described below.
How we protect your data
Access is restricted to your authenticated account, data is transmitted over encrypted connections, and each user can only access their own records.
No system is perfectly secure, so please use a strong, unique password and protect your device. If we ever become aware of a personal-data breach that poses a risk to you, we will act on it and notify the relevant authority and affected users as required by law.
Your rights
Under the NDPA/NDPR you have the right to access your data, correct it, delete it, restrict or object to certain processing, withdraw consent, and receive a copy of your data in a portable format.
In the app you can: edit your profile and records, export your transactions to a file, withdraw email-tracking consent by disconnecting Gmail (Profile → Email Auto-Tracking → Remove), and permanently delete your account from Profile → Delete Account.
For any other request, email support@mytally.xyz. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).
Deleting your account
Deleting your account is permanent and irreversible. It removes your account and all associated data from our servers — including accounts, transactions, categories, budgets, goals, debts, subscriptions, learned categorisation, and any pending alert drafts — and revokes any connected Google grant. You would need to create a new account to use MyTally again.
Children
MyTally is intended for adults and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has provided us data, contact us so we can remove it.
Changes and contact
We may update this policy as the app evolves; we will revise the "Last updated" date above and, for significant changes, aim to make them clear in the app.
For any privacy question or data-protection request, contact support@mytally.xyz.