TALLY
Tally — Privacy Policy
Effective date: 4 September 2026
Who we are (the responsible party): Alternative Investment Holdings (Pty) Ltd, registration number 2026/423446/07, Kleine Parys, Paarl, Western Cape, 7646, South Africa. Email: info@tallyitall.com.
Information Officer: the Information Officer of the company, contactable at info@tallyitall.com.
The app: Tally, a scorekeeping app for real-world social competitions.
In one paragraph
Tally keeps score for real-world competitions among friends. To do that we store your account, your profile, and what happens in the events you play. We never take, hold or move money, we do not sell your data, we do not use it for advertising, and we send no marketing. You can see, correct, export or delete your information at any time. You must be 18 or older to use Tally — and that is a data-protection rule, not a hint about the content. See "Children" below.
What we collect, why, and on what legal basis
We only collect what the app needs to work. POPIA requires a lawful justification for each purpose. Ours are set out below.
To give you an account
- Email address — to sign you in and to send account emails (password
- Your date of birth, and the date and time you gave it, so we can show you
resets). Your password is stored only as a secure one-way hash by our authentication provider; we never see or store the password itself.
confirmed you are 18 or older.
*Legal basis: necessary to perform our contract with you (POPIA s11(1)(b)), and compliance with our obligation not to process children's data (s34).*
To let you appear in an event
- Profile — the display name and nickname you choose, your avatar (an image
you upload or one you pick), an optional real name, and the home suburb you type in. The suburb is free text you enter for transport planning; it is not your GPS location and we do not track your location.
*Legal basis: necessary to perform our contract with you (s11(1)(b)).*
To keep score
- Events you create or join, and the settings of those events.
- Your scores ("check-ins"), each kept as a permanent row — corrections are
- Optional photos you attach to a score or to going out (e.g. a chip stack).
- Payment status — whether a host has ticked you as having paid, and figures
new rows, never edits, so the history everyone agreed on stays intact.
the host recorded about what was agreed. This is a note of what happened in the real world. Tally never processes, holds or transfers any money, and stores no card, bank or payment-account details of any kind.
*Legal basis: necessary to perform our contract with you (s11(1)(b)). Optional photos are processed on your consent (s11(1)(a)), which you may withdraw by deleting them.*
To be social within an event
- Chat messages and images you send in an event's group chat.
- Reactions you add to the live feed.
- Head-to-head challenges you make with other players and their outcomes.
Tally records only who was right. It records no amount and nothing owed.
*Legal basis: necessary to perform our contract with you (s11(1)(b)).*
If you upload a photo of someone else, you are responsible for having their
agreement. Do not upload images of people who have not agreed to appear.
To send you notifications
- A device push token, so we can send round reminders and messages from your
host. You can turn notifications off on your device or in the app.
*Legal basis: your consent (s11(1)(a)), which you may withdraw at any time.*
To keep the service running and secure
- Standard technical logs created by our hosting providers (for example
timestamps and error records). We do not build advertising or tracking profiles from these.
*Legal basis: our legitimate interests in keeping the service available, secure and free from abuse (s11(1)(f)).*
We do not collect: precise or GPS location, contacts, biometric data, payment or financial-account details, or any special personal information as defined in POPIA. Tally contains no third-party advertising or analytics-tracking SDKs.
Automated decision-making
We do not make any decision about you that has legal or similarly significant consequences based solely on automated processing (POPIA s71). Leaderboards and finishing positions are arithmetic applied to scores you and your fellow players entered yourselves.
Direct marketing
We do not do any marketing. We send no promotional email, no promotional push notifications, and we run no advertising. The only email we send about your own play is a recap after a night you took part in, and you can stop it in one tap from the email itself without signing in. We will never sell or rent your details to anyone (POPIA s69).
Who can see what
- Other players in the same event can see your display name, avatar, home
- The host of an event additionally sees the payment and transport figures
- Your full or real name (if you provided one) is shown only to people in the
- The public sees nothing about you unless you personally share it. Where a
suburb, scores, challenge results, and your chat and feed activity within that event. That is the point of a shared scoreboard.
they recorded for that event.
same event.
host lists an event publicly, strangers see the event — its name, venue, date, cost and how many are in — and the host's display name, and nothing else.
Who processes your data for us
We use these providers, who are "operators" under POPIA and handle data only on our instructions, under a data processing agreement with each (POPIA s20–s21):
| Operator | What they do | Where | |---|---|---| | Supabase | Database, authentication and file storage | Ireland (EU) | | Expo | Delivery of push notifications | United States | | Vercel | Hosting of the web version and invite links | United States, served globally |
Where your data is stored, and transfers outside South Africa
Your data is stored and processed outside South Africa by the operators above — principally in Ireland, where the database and all uploaded files live, and in the United States for push notifications and web hosting.
We transfer it on the basis set out in section 72(1)(a) of POPIA: each operator is bound by a written agreement with us imposing obligations substantially similar to the conditions for lawful processing under POPIA, including restrictions on onward transfer. Where the transfer is also necessary to perform our contract with you, we additionally rely on section 72(1)(c).
How long we keep it
| What | How long | |---|---| | Your profile and event history | While your account exists. Permanent results are the point of the service. | | Everything identifying you, after you delete your account | Removed immediately, as described below | | Backups | Purged on our provider's normal backup cycle | | Technical and security logs | Up to 12 months | | Records we need to establish, exercise or defend a legal claim | 3 years, limited to the minimum necessary |
We do not keep personal information for longer than we need it for the purpose we collected it (POPIA s14).
Your rights
You can, at any time:
- See and correct your profile in the app (Edit profile).
- Export a copy of your data — in the app, from Profile → Download my data.
- Ask what we hold about you. Email info@tallyitall.com. We will respond
- Delete your account and personal data — in the app, from Profile → Delete
- Withdraw consent to notifications and to optional photos, at any time.
- Object to processing we carry out on the basis of legitimate interest.
- Complain to the Information Regulator (details below).
within a reasonable time and in any event as POPIA requires.
my account. See below.
What happens when you delete your account
When you delete your account we remove everything that identifies you: your email address, your login, your date of birth, your push token, your avatar, any real name you gave us, the photographs you uploaded, and your chat messages.
Your name is replaced with "Deleted user" in any event you took part in, and the events themselves stay in place. We do this deliberately. The scores and results in an event belong to everybody who played, not only to the person who set it up, and it would not be right for one person's decision to erase another person's record of their own night.
For the same reason, if you are still hosting a night that has not finished, you will be asked to end it first — or to make another player a co-host so they can run it — before you can delete your account. An event whose host has vanished cannot be operated by anyone, and leaving a group stranded mid-night is not an acceptable side effect of one person leaving.
Once anonymised, the remaining rows are no longer personal information about you and cannot be traced back to you by us.
Children
Tally is for adults. You must be 18 or older.
This is a data-protection rule and nothing more. There is nothing adult about Tally — it is a scoreboard. But POPIA counts anyone under 18 as a child, and processing a child's personal information requires a competent person's consent (s34–s35). Rather than build and run that machinery for a scorekeeping app, we keep the door at 18. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.
Security
- Passwords are hashed and never stored in plain text.
- All traffic between the app and our servers is encrypted in transit (TLS).
- Data at rest is encrypted by our storage providers.
- Access to the database is protected by row-level security, so players and hosts
- Access by our own people is limited to those who need it.
can only reach the data they are entitled to.
If something goes wrong
If personal information under our control is accessed or acquired by anyone unauthorised, we will notify the Information Regulator and every affected person as soon as reasonably possible after establishing what happened, and tell you what we know and what you can do about it (POPIA s22).
Changes to this policy
If we change this policy we will update the date above and, for material changes, tell you in the app before the change takes effect.
Contact
Us, and our Information Officer: info@tallyitall.com
Access to information: our PAIA manual is at tallyitall.com/paia-manual.
The Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 Telephone: 010 023 5200 General enquiries: enquiries@inforegulator.org.za POPIA complaints: POPIAComplaints@inforegulator.org.za Website: inforegulator.org.za