Privacy Policy for Tally

1. The short version

Tally is an app for planning game nights and recording the results of your board game matches. From those results Tally works out rankings, statistics and a year in review. For that we need your email address, your name and the evenings and matches that you and your groups enter.

• We show no ads and sell no data.
• We build no advertising profiles about you and do not track you across other apps or websites.
• What you enter in a group is visible to the other members of that group.
• You can export your data in the app and delete your account in the app at any time.

The details follow below.

2. Who is responsible?

The controller for the processing of your data in the Tally app and on the website tally.borstessi.de is:

Lennart Borstelmann
Falkenstraße 23
32457 Porta Westfalica
Germany
Email: hello@borstessi.de

We have not appointed a data protection officer because there is no legal obligation to do so. If you have questions about data protection, write to the address above.

3. What data does the app process, for what purpose and on what legal basis?

3.1 Account and sign-in

When you sign up, you enter your email address and your first name, and your last name if you want to. There is no password: every time you sign in, we send you a one-time code by email. The sign-in and the sending of these codes are handled by the service Clerk (section 6). The codes come from a sender address on our domain tally.borstessi.de. Clerk also stores technical details about the session, such as IP address, device type and time of sign-in. If you change your email address, you confirm the new one with a code as well.

For the review of the app by Apple and Google we have set up a separate review account that signs in with a password. No other account has a password.

In our database we create a profile with your email address, your name, the language and time zone of your device, your notification settings and the time at which you agreed to the terms of use.

• Purpose: to provide your account, sign you in securely, give times in notifications in your local time and record when you agreed to the terms of use.
• Legal basis: performance of the contract of use, Art. 6(1)(b) GDPR.

3.2 Groups, evenings and matches

So that Tally can do the maths, we store what you and the other members enter:

• groups with name, optional description, colour, points rules and members, and the role of each member (admin or member),
• evenings with date, participants, matches and the player of the evening,
• matches with game, scoring, points per person, placings, wins, teams and tournaments,
• planned evenings with date, host, a location entered as free text, the people invited and whether they said yes, no or maybe,
• matches without a group that you start outside a group, with the names of the other players,
• games and templates you create yourself, and which scoring you last chose for a game.

This data is stored with our database service Convex (section 6).

Please only enter as the location of a planned evening what the group needs to know. Everyone invited sees it, and it can appear in notifications on their lock screen.

• Purpose: to provide the features of Tally.
• Legal basis: Art. 6(1)(b) GDPR.

3.3 Information about other people

In Tally you can add people who do not use the app, so-called guests. For a guest we store the name you give them and the matches they are part of. We also store the names you enter for the other players in a match without a group.

An admin can assign an email address to a guest. If someone signs up with that address, Tally offers to let them take over the guest's matches. Tally does not email this address. Alternatively, an admin can create a guest link and pass it on themselves. Whoever opens the link can take over the guest's matches into their own account. A guest link is valid for 14 days.

Please only enter what is needed for the game about other people, usually a first name or a nickname.

• Purpose: to record matches with people who do not use the app.
• Legal basis: the legitimate interest of the group in complete results, Art. 6(1)(f) GDPR.

3.4 Join code and group preview

Every group has a join code and a link of the form tally.borstessi.de/beitreten/…. Anyone who knows the code or the link sees, on the website and in the app, the name of the group, the number of members, their initials and the name of an admin, and can request to join. An admin decides on the request. With the request we store who made it, which code they used and how the admin decided.

• Purpose: to bring groups together without an email invitation.
• Legal basis: Art. 6(1)(b) GDPR.

3.5 Published templates

A template describes how a game is scored. You can keep your own templates to yourself, share them with your group or publish them for everyone. For a published template, signed-in users see your first name as its author. We also count how often a template was taken over and store who took it over.

• Purpose: to share templates between game groups.
• Legal basis: Art. 6(1)(b) GDPR.

3.6 Notifications

If you allow notifications in your operating system, we store the push token of your device. When we send you a notification, such as the invitation to a planned evening, it goes with this token through the push service of Expo to Apple (iPhone) or Google (Android) and from there to your device. Depending on the occasion, notifications contain the name of the group, date and time, the name of the host, the location and the name of the person who planned, moved or cancelled the evening. Reminders about a running evening contain no names.

You choose which notifications you get in the app under "Profile", "Notifications". If you sign out, we delete the push token. If Apple or Google report that the device no longer accepts messages, for example because you deleted the app, we delete it as well. If another account signs in on the same device, we remove the token from your account.

Two kinds of notice are created only on your device and do not go through our server: the reminder three days before the first charge of a Plus subscription, and the Live Activity of a running evening on the lock screen of your iPhone.

• Purpose: to tell you about planned evenings, missing final scores and your year in review.
• Legal basis: your consent through the dialog of the operating system, Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time in your device settings.

3.7 Tally Plus and purchases

You buy Tally Plus in Apple's App Store or on Google Play. The payment is handled by the store. We do not see your payment details. What Apple or Google process in the course of this is governed by their own privacy policies.

To manage purchases we use the service RevenueCat (section 6). The app signs your account in to RevenueCat with the internal ID of your Tally account, not with your name or email address. RevenueCat receives the details of your purchases from the store, such as product, purchase date, trial period, renewal, cancellation and refund, and reports them to our server. From these we store whether and until when you have Plus, which subscription, in which store, the ID of the original transaction and which notices about your subscription you have already seen. We delete the individual reports from RevenueCat after 90 days.

From an earlier version of Tally there may be bookings of Taler coins. You get these bookings in the data export.

• Purpose: to unlock Plus, restore purchases and prevent a free month from being used more than once.
• Legal basis: Art. 6(1)(b) GDPR, for the assignment after an account deletion Art. 6(1)(f) GDPR (section 9).

3.8 Data export

Under "Profile", "Export data" you download your evenings and matches as a table (CSV) or as a JSON file. The export contains what you took part in yourself. For other people it only contains the name of the winners of each match, no points and no email addresses. Our server creates the file, the app stores it on your device and opens the share dialog of the operating system. You decide who you send it to.

• Legal basis: Art. 6(1)(b) GDPR and Art. 20 GDPR.

3.9 Error reports

To find crashes and bugs, the app uses the service Sentry (section 6). When an error occurs, Sentry receives a report with the error message, app version, device type, operating system and your last steps in the app. We do not send a user ID, names or email addresses.

In 10 percent of sessions and with every error, Sentry also records the screen history as a replay. Text and images are masked.

Sentry processes the app's data in the EU (data centre in Frankfurt), does not store IP addresses and deletes the data after 90 days at the latest.

• Purpose: to detect and fix errors.
• Legal basis: legitimate interest in an app that works, Art. 6(1)(f) GDPR, and for access to your device Section 25(2) no. 2 TDDDG.

3.10 Loading times

The app uses EAS Observe by Expo to measure how long it takes to start and to build individual screens. Expo receives the measurements, the name of the screen, technical IDs such as that of a group or an evening, app version, device type and operating system and, for technical reasons, the IP address. The app filters out free text such as names, email addresses, game names and guest links beforehand.

• Purpose: to find slow screens and make the app faster.
• Legal basis: Art. 6(1)(f) GDPR, and for access to your device Section 25(2) no. 2 TDDDG.

3.11 Emails to us

If you email us at hello@borstessi.de, we process your address and your message to reply.

• Legal basis: Art. 6(1)(f) GDPR, for requests about your account Art. 6(1)(b) GDPR.

4. What do others see?

Members of a group see your name and everything entered in that group, that is evenings, matches, points, placings, rankings, statistics, planned evenings and replies. They do not see your email address.

Anyone who knows the join code of a group sees the preview from section 3.4. Signed-in users see your first name on templates you have published. Other players in a match without a group see the name under which you play there.

If you share cards from your year in review or an export, the file is created on your device. You decide who you send it to.

5. What does Tally store on your device?

The app stores your sign-in status in the protected keychain of the operating system. It also remembers the language you chose, whether you finished the introduction, your Live Activity settings and, while joining a group or taking over a guest is not yet complete, the code used for it. An exported file stays in the app's cache until the operating system clears it. This data does not leave your device.

This storage is necessary for the app to work, Section 25(2) no. 2 TDDDG.

6. Who do we share data with?

We do not sell data and do not share it for advertising. To run Tally we use these service providers, who process data only on our behalf (Art. 28 GDPR):

Notifications are also delivered by Apple (Apple Push Notification Service) and Google (Firebase Cloud Messaging). Purchases are handled by Apple (App Store) and Google (Google Play) under their own responsibility.

Transfers to countries outside the EU

Some of these providers are based in the USA. For the USA, the EU Commission has adopted an adequacy decision (EU-US Data Privacy Framework, Art. 45 GDPR). It applies to companies certified under it. Clerk, Expo (650 Industries), Sentry (Functional Software) and Vercel are certified. Convex and RevenueCat are not certified. For them, the standard contractual clauses of the EU Commission apply, which are part of the data processing agreements with these providers (Art. 46(2)(c) GDPR).

7. The website tally.borstessi.de

Hosting and server logs

The website is hosted by Vercel. On every visit, Vercel stores technical details such as IP address, requested address, time, browser and operating system in logs and deletes them after 7 days.

• Purpose: to deliver the website and protect it from abuse.
• Legal basis: Art. 6(1)(f) GDPR.

Visitor statistics and loading times

We count visits with Vercel Web Analytics and measure loading times with Vercel Speed Insights. Neither tool sets cookies or recognises you across several days. We only see aggregated numbers, such as how many visits a page had, which country they came from and how fast it loaded. We remove join codes and guest links from the addresses first.

• Legal basis: Art. 6(1)(f) GDPR.

Error reports

The website does not send error reports to Sentry or to any other service.

Cookies

The website sets a single cookie: if you choose a language on the website, it remembers your choice in the cookie "locale" for one year. It only contains the language code. You triggered this storage yourself, Section 25(2) no. 2 TDDDG. We load fonts and images from our own server, not from third parties.

Join codes and guest links

When you open a link such as tally.borstessi.de/beitreten/… or tally.borstessi.de/gast/…, the page asks our server for the group preview (section 3.4) and passes you on to the app if it is installed. The page only passes the code of a guest link on to the app.

Deleting your account

tally.borstessi.de/delete-account explains how to have your account deleted without the app. The page processes no input.

8. How long do we keep your data?

• Account and content: until you delete your account. What remains after that is described in section 9.
• Push token: until you sign out, another account signs in on the device, the device no longer accepts messages or you delete your account.
• Guest links: valid for 14 days.
• Reports from RevenueCat about purchases: 90 days.
• Details of your Plus subscription: also after an account deletion, attached to an ID without name or address (section 9).
• Error reports at Sentry: 90 days at most.
• Website logs at Vercel: 7 days.
• Sign-in sessions at Clerk: expire after 7 days.
• Emails to us: until the request is dealt with, then 6 months.

9. What happens when you delete your account?

You delete your account in the app under "Profile", "Account", "Delete account". The deletion takes effect immediately. If you can no longer get into the app, write to hello@borstessi.de from the address you use to sign in to Tally, with the subject "Delete account". We then delete the account within 30 days, with the same consequences.

A Plus subscription does not end when you delete your account. Cancel it first in the App Store or on Google Play.

We delete:

• your sign-in at Clerk,
• your name, your email address, language and time zone, your notification settings, the push token and the time you agreed to the terms of use,
• your membership in all groups; in their matches your name is replaced by "Former member",
• groups in which nobody but you is a member with an account, with all evenings, matches, points, tournaments, planned evenings, guests and invitations,
• matches without a group that you created and in which nobody else with an account took part,
• open invitations to your email address and your open join requests,
• the scoring Tally remembered for you per game,
• your customer record at RevenueCat with the purchase history RevenueCat received from the store. What Apple or Google themselves store about your purchases is not affected.

If you are the only admin of a group with other members, Tally makes the member with an account who has been there longest the admin.

What remains:

• evenings and matches in groups with other members, with your points but without your name, otherwise their rankings would no longer add up,
• matches without a group in which someone else with an account took part; they show "Former member" instead of your name,
• games and templates you created; published templates no longer show a name,
• an account ID without name or address. It prevents Tally from creating the deleted account again, and Taler bookings from an earlier version of Tally stay attached to it if there are any. The legal basis is our legitimate interest in not recreating a deleted account by accident, Art. 6(1)(f) GDPR.

Push messages that have already reached a device cannot be recalled.

10. Your rights

You have the right

• to get information about the data stored about you (Art. 15 GDPR),
• to have incorrect data corrected (Art. 16 GDPR),
• to have your data deleted (Art. 17 GDPR),
• to have processing restricted (Art. 18 GDPR),
• to receive your data in a common format (Art. 20 GDPR); the data export in the app serves this as well,
• to object to processing based on our legitimate interest (Art. 21 GDPR),
• to withdraw a consent at any time with effect for the future (Art. 7(3) GDPR).

Write to hello@borstessi.de for any of these. If you ask for information, we send you your data as a file.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

11. Do you have to provide your data?

Without an email address and a first name you cannot create an account and cannot use Tally. Everything else, such as your last name, notifications or Plus, is optional.

12. Children and young people

Tally is meant for people aged 16 and over. If you are younger, you need your parents' consent.

13. Automated decisions

Tally makes no decisions about you based solely on automated processing (Art. 22 GDPR). Rankings and statistics are plain calculations from your entries.

14. Changes to this privacy policy

If the way Tally processes data changes, we update this policy. The current version is always at tally.borstessi.de/privacy. We tell you about significant changes in the app.