Privacy

• Account — your email address and an identifier from our authentication provider. Passwords are never stored by us; sign-in is handled by Clerk.
• What you write — if you use the journal: your theses, criteria, positions, fills, notes, reviews, and the session summaries you choose to save through the AI connector. Decision-history summaries record the sequence of events, decisions, reasons and personal rules you approve. They are private to your account. It's yours.
• Product feedback — when you submit feedback in the signed-in app or through your AI assistant, we save how you use Tally, your suggested improvements, your account identifier and any reply email you choose to include. Feedback is sent to the Tally team and kept separately from your private decision history. We do not automatically forward journal entries or chats as feedback. Temporary submission counters expire after an hour and are removed on subsequent submissions.
• Optional broker data — Connected subscribers may authorize read-only brokerage access through SnapTrade. We encrypt the provider user secret and save holdings, recent transactions, account labels and sync status. Your broker password is not stored by Tally. Background reads require an active Connected subscription and explicit consent. Your connected AI can retrieve saved broker context when it requests your Tally checkup. Disconnecting stops reads; ending the plan removes the new Connected broker enrollment. Journal records and saved observations remain until you delete your Tally account.
• Your Propr account — the API key you paste, which is encrypted at rest with AES-256-GCM before it touches the database, using a key held outside it, and is never shown again; the Propr account you chose, by its identifier and challenge name; the markets you chose; and the time you authorized the agent. Our web app decrypts the key in memory to list accounts during setup. Our agent service decrypts it in memory for one setup pass or one tick at a time and uses it to read the account (balances, positions, orders, trades, daily metrics) and to place and cancel orders on that one account. It never buys a challenge, moves funds or requests a payout. Removing the account from Tally deletes the key.
• The agent's records — the engine's status after every tick (equity, the distance to each limit, whether anything halted) and its daily report (every order, fill, stop, signal and decision of the day), kept for as long as your account exists. The account documents it reads from Propr live on the service's private storage until the account is removed. We do not receive or store your full AI chat transcripts. Your assistant can save the relevant summaries you explicitly approve through Tally tools.
• Connected AI assistants — if you add the Tally connector in Claude or ChatGPT, your assistant reads and writes your journal through an OAuth grant you approve and can revoke. The assistant acts on your behalf under your own account with that provider; we don't send your journal to Anthropic or OpenAI ourselves. The assistant can read the agent's status through the connector; it can never read your Propr key, place an order, or stop the agent.
• Alerts — the email address you choose for alerts, which may differ from your account email. Until you choose one, alerts go to your account email, because an alert nobody receives is the failure this product exists to prevent. Turn them off or redirect them at any time in settings.
• Billing — your plan and the customer/subscription identifiers issued by Stripe. We never see or store your card details; payment data goes directly to Stripe.

No advertising trackers, no third-party analytics scripts, no cross-site profiling. We don't sell or rent personal data to anyone, and we don't use your journal content to advertise to you. The only cookies we set are the ones the product needs: your session, and a referral code if you arrived through someone's link.

Your agent's status and reports, your theses, and your positions are scoped to your account; other users cannot see them. The one exception is deliberate: a receipt page you share is public by design, and shows only the process record (title, statement, dates, criteria counts, status, and, once closed, the return as a multiple of your risk budget). Receipts never include dollar amounts, position sizes, wallet addresses, or venue details.

We use a small number of subprocessors:

• Clerk — authentication and account management
• Neon — the Postgres database
• Vercel — web hosting
• Fly.io — the agent service that runs the engine, with a private volume for each account's state and reports, and the hourly worker
• Propr — the prop firm. The agent reads your Propr account and places orders on it with the key you gave Tally, under Propr's own terms and privacy policy
• Hyperliquid — public market data (prices and market metadata), read without any personal information
• SnapTrade — optional read-only brokerage connections and data for Connected subscribers
• Stripe — payments and subscription billing
• Resend — alert and notification email

These providers operate in several countries, so your data may be processed outside where you live. Market and news data we read (for example public options data and news-volume indices) is fetched without sending your personal information.

Traffic is encrypted in transit. Your Propr API key is encrypted at rest with AES-256-GCM using a key held outside the database, decrypted by the web app for account selection and by the agent service for account operations, in memory, for one setup pass or one tick, and never written to a report or a log. The engine places and cancels orders on the one account you authorized by name and refuses every other write to Propr, by code. No system is perfectly secure; don't give any application more permission than it needs, and revoke the key in Propr if you ever doubt it.

Email support [at] tally.markets from your account address to get a copy of your data, correct it, or have your account and its contents deleted. Deletion removes your journal, connections, and preferences; we keep the minimum billing records we're required to retain for tax and accounting purposes. Depending on where you live you may have additional statutory rights (for example under GDPR or UK GDPR) — those apply, and the same address reaches us.

You can stop the agent and remove your Propr account from Tally at any time from the status screen or Settings; removal is available after Tally confirms shutdown and deletes the stored key. If shutdown cannot be confirmed, manage positions and orders directly at Propr before revoking the key. You can also revoke the key in Propr's own settings. The AI connector's access can be revoked by removing the connector in Claude or ChatGPT. Alert emails turn off in Settings.

We keep your journal, the agent's status and its daily reports for as long as your account exists, because the record is the point. Disconnecting Propr removes its connection and stored API key. Recorded account observations, report revisions and closed-trade history remain associated with your Tally account after disconnecting. Deleting your Tally account deletes this history. Temporary account documents on the service are removed after confirmed shutdown. We do not use this private history to train models for other customers. Legacy SnapTrade connections are not automatically reactivated. New Connected enrollments require subscription and consent. Saved snapshots may contain cached or delayed broker data. If we materially change this policy we'll post the update here with a new date. Questions: support [at] tally.markets.