Privacy
Last updated 24 September 2026.
Tallyclock is made by one person. It has no advertising, no analytics, and nothing to gain from knowing more about you than it needs to run. This page describes exactly what it stores and where that data goes.
What Tallyclock stores
When you create an account, Tallyclock stores your email address and a cryptographic hash of your password. It never stores the password itself.
When you use the app, it stores the things you asked it to track:
- The names of your trackers, and whether each one measures duration or counts events.
- Duration sessions: when each one started and ended.
- Events: the moment each tap happened.
- Pomodoro sessions and your pomodoro settings.
- Any tracker you have shared, who you shared it with, and whether they can view or edit.
- An optional display name on your account.
- Any note you attach to a session or an event: free text, up to 2,000 characters. Write nothing there you would not want stored.
That is the whole list. There is no location data, no contacts, no photos, no device identifiers, and no behavioural profile.
What leaves your phone
Your trackers and sessions are stored on a server so that they survive losing your phone and so that sharing can work at all. The server runs on a DigitalOcean droplet. The PostgreSQL database it stores your data in is a managed DigitalOcean database cluster, reached over an encrypted connection. Traffic between the app and the server is encrypted in transit.
Two other services are involved, both narrowly:
- Amazon SES delivers the handful of transactional emails the app sends — confirming your address, and sending a password reset code. Your email address is passed to SES to deliver those messages, and for nothing else. There is no mailing list.
- A self-hosted Grafana stack receives operational telemetry from the server: request timings, error traces, and logs. This is how a crash gets diagnosed. It records request paths and timings, and — when the API sends you a message — the address it was sent to. It does not record tracker names, notes, or session contents.
Face ID and Touch ID are handled entirely by iOS on your device. Tallyclock is told only whether the check succeeded. Your access token is stored in the iOS keychain marked as device-only, so it is never included in an iCloud backup and never syncs to another device.
Who else can see your data
Only people you deliberately share a tracker with, and only the trackers you shared. A viewer can see that tracker’s sessions; an editor can also add to it. Everything you have not shared stays private to your account, and you can revoke a share at any time.
Sharing is possible only with accounts that have confirmed their email address, so a tracker cannot be shared to an address nobody controls.
When someone shares a tracker with you, they can see your email address, and your display name if you have set one, in that tracker’s list of people it is shared with. That list is visible only to the person who owns the tracker. You are not shown their name in return — only that the tracker is shared with you.
What Tallyclock does not do
- It does not sell, rent, or trade your data. There is no arrangement under which that could happen.
- It does not use advertising networks or third-party analytics.
- It does not track you across other apps or websites.
- This website sets no cookies and loads nothing from any other domain.
Deleting your data
Delete your account from inside the app: Settings → Delete Account. Deletion is immediate and complete. Your account, your trackers with their sessions, events and notes, your shares, and your pomodoro history, settings and activities are removed from the database at once. Trackers you had shared disappear for the people you shared them with. If you use Sign in with Apple, the app’s access to your Apple ID is revoked as part of the deletion.
Database backups keep deleted data until they expire, at most 7 days later. They are used only to recover from a failure and are never restored selectively. Operational telemetry expires on its own retention schedule and contains no tracker contents.
If you can no longer get into the app, write to support@summersetsoftware.com from the address on your account and we will delete it for you.
Children
Tallyclock is not directed at children under 13 and does not knowingly collect their data.
Changes to this policy
If this policy changes in a way that affects what is collected or who can see it, the date at the top of this page changes and the previous version is replaced here. There is no separate archive.