Privacy Policy

Last updated: 6 November 2026

MoneyShip ("we", "our", "the app") is a personal finance tracking application. Your privacy matters to us. This policy explains what data we collect, why, how we store it, and your rights.

MoneyShip was previously called Tally.

1. What Data We Collect

Data you provide

• Financial tracking data - bill names, amounts, due dates, categories, payment status; debt names, balances, interest rates, payment history; savings goal names, targets, deposits, withdrawals
• Preferences - monthly income, currency, theme, notification settings, calculator settings
• Account data (optional) - email address and authentication credentials if you choose to create an account for cloud sync

Data we collect automatically

• Anonymous usage events (optional, can be turned off in Settings). When enabled, we collect a small set of structured events describing how you interact with the app - which screens you open, which buttons you tap, where you stop in a flow. These events are tied to a randomly-generated identifier stored in your device's secure storage, NOT your email or any personal information. Each event also carries basic details about your phone and the app, such as your phone's model, operating system, language and time zone, which the analytics software adds by itself. The full list of events is published at moneyship.app/analytics-events.html and updated whenever it changes. See section 5 "Usage Analytics" below for details.
• If you choose to send a bug report via Settings, details that help us find the problem are added to the email: your device (model, OS version, screen size, battery level, connection type, language), the app version and your settings (such as theme, currency or how lists are sorted), sync status, how many bills, debts and goals you have, and recent app activity (on Android, also crash details). You can read everything before you send it. It never includes amounts, your income, names you have typed, your email address or your account ID.

Data we do NOT collect

• Bank account numbers, sort codes, or card details
• Location data
• Contacts, photos, or files
• Bill names, debt names, savings goal names, merchant names, or any free-text you type into the app (these never appear in usage analytics)
• Amounts, balances, or any financial values (these never appear in usage analytics)
• Advertising identifiers (IDFA, GAID, etc.)
• Browsing history outside the app

2. Why We Collect It

• Financial tracking data - to provide the core bill, debt, and savings tracking features you use the app for
• Preferences - to remember your settings (currency, theme, notification time) between sessions
• Account data - to authenticate you and sync your data across devices if you choose to sign in
• Diagnostic data (only when you send a bug report) - to help us fix issues you report

3. How We Store Your Data

On your device (local storage)

All your financial data is stored locally on your device in a private database that only the MoneyShip app can access. This works without an internet connection or account.

In the cloud (optional)

If you sign in, your data is encrypted in transit (HTTPS/TLS) and synced to our cloud database hosted by Supabase (PostgreSQL). Supabase provides encryption at rest for all stored data. Only your signed-in account can read your data through MoneyShip: other users can't see it. Your synced data isn't end-to-end encrypted, so MoneyShip's team can technically access the cloud database that stores it. We don't look at your data, except to fix a problem you've asked us to help with (and only with your permission), or where the law requires it.

4. Third-Party Services

We use a small number of third-party services, only for core functionality:

• Supabase (EU region) - cloud database and authentication. Stores your synced financial data if you sign in.
• Google Sign-In - optional sign-in method. Google shares your name, email address and profile photo link with us, and they're stored with your account.
• Resend (EU region, Ireland) - sends your account emails (sign-up confirmation and password reset). Receives your email address and the email it sends, nothing else.
• PostHog (EU Cloud, Frankfurt) - anonymous usage analytics, only when enabled in Settings. Receives the events listed at moneyship.app/analytics-events.html. Never receives financial data, anything you type into the app, your name or your email address.

We do not use:

• Google Analytics, Firebase Analytics, Meta Pixel, or any other tracker
• Advertising networks or ad SDKs
• Crash reporting services (Crashlytics, Sentry, etc.)
• Social media tracking pixels

5. Usage Analytics

To understand how people use MoneyShip, we collect a small set of anonymous usage events - for example, "user opened the import screen" or "user added a bill". This helps us decide what to build next and what to improve. We never collect your financial data, the names you give to bills, debts or goals, the merchants on your statements, any amounts, or any free-text input.

Where the data goes

Analytics events are processed by PostHog Inc. on PostHog's EU Cloud infrastructure (Frankfurt, Germany). Data is stored in the EU and is not transferred to the United States. Our lawful basis under UK GDPR is consent, which you give when you tap "Got it" on the analytics card on second launch, or when you leave the toggle on in Settings.

Identification

Events are tied to a random UUID generated on first launch and stored in your device's secure keystore (iOS Keychain / Android EncryptedSharedPreferences). It's a random ID the app creates, not your email, your name or your phone's advertising ID. If you sign in, the random UUID is linked to your MoneyShip account ID for retention analysis - we still do not use your email or other personal information as an identifier.

Device details sent with each event

The analytics software MoneyShip uses (PostHog's own code inside the app) adds some basic details to every event by itself. MoneyShip adds which platform you use (iPhone or Android) and the app version. Together, an event can carry:

• The app - its name, version, build number and package name. On iPhone, also whether it was installed through TestFlight or side-loaded
• Your phone - its maker and model, whether it's a phone or a tablet, the operating system and its version, the screen size, and whether it's an emulator or simulator. On Android, also the device's code name (for example "lynx" for a Pixel 7a), the screen density and Android's standard system "user agent" text, which repeats the Android version and the model
• Language and time zone - your phone's language (on Android, with its region, for example en-GB) and its time zone (for example Europe/London)
• Your connection - whether you're on Wi-Fi or mobile data (on Android, also Bluetooth). On Android, also the name of your mobile network (for example "EE"). Never the name of your Wi-Fi network or your phone number
• Random IDs - the random identifier described below and a random ID for each session of use. Never your phone's hardware or advertising identifiers

It never includes the name you've given your phone. As with any service on the internet, PostHog also receives your phone's IP address when events are sent.

Your controls

• Turn analytics on or off at any time: Settings → Privacy → Share usage analytics
• Request deletion of all your analytics data: email moneyshipapp@gmail.com from the address linked to your MoneyShip account
• Retention: events are kept for 12 months rolling, then deleted automatically
• Full event list: moneyship.app/analytics-events.html - we update this whenever we add, remove, or change an event

6. Data Sharing

We never sell, rent, or trade your personal data. We do not share your financial information with advertisers, data brokers, or any third party for marketing purposes.

Your data is shared only with:

• Supabase - our cloud database provider, solely for the purpose of storing and syncing your data
• Google - solely for authentication if you use Google Sign-In
• Resend - our email provider, solely to send your account emails (sign-up confirmation and password reset)
• PostHog - our analytics provider, solely to receive the usage events described in section 5, and only while analytics is on

7. Data Retention

• Local data - stored on your device until you delete it via Settings or uninstall the app
• Cloud data - stored as long as your account exists. You can delete it at any time while signed in with Settings > Delete Account & All Data. See Delete your account for what is deleted and what is kept
• Authentication data - managed by Supabase. Session tokens expire and are refreshed automatically

8. Your Rights

Under UK GDPR, EU GDPR, and applicable data protection laws, you have the right to:

• Access - view all your data within the app at any time
• Rectification - edit any of your data through the app's edit screens
• Erasure - while signed in, Settings > Delete Account & All Data deletes your cloud data and the data on that device. Signed out, Settings > Clear Local Data (Clear All Local Data on Android) deletes the data on the device. To delete your sign-in record too, email us. See Delete your account
• Portability - your data is stored in standard formats and can be accessed through the app
• Restriction - you can use the app entirely offline without sharing any data
• Withdraw consent - sign out at any time to stop cloud sync

To exercise any of these rights, contact us at moneyshipapp@gmail.com.

9. Security

• All data transmitted between your device and our servers is encrypted using HTTPS/TLS
• Cloud data is encrypted at rest by our database provider (Supabase)
• Our cloud database lets each signed-in account read only its own data. Synced data isn't end-to-end encrypted, so MoneyShip's team can technically access it; see "In the cloud" in section 3 for when we would
• Passwords are hashed using industry-standard bcrypt (never stored in plaintext)
• Local data is stored in Android's private app sandbox, inaccessible to other apps
• Authentication uses secure JWT tokens with automatic expiry and refresh

10. Android Permissions

This is the full list of permissions the Android app has. Only notifications needs your agreement: Android asks you first (on Android 13 and later), and you can say no. Android grants the others when you install the app.

• INTERNET Cloud sync and sign-in, and usage analytics if you leave it on
• ACCESS_NETWORK_STATE Tells the app whether you're on Wi-Fi or mobile data, not which network. It's used for the connection type in bug reports you choose to send, and the analytics software adds it to usage events while analytics is on (section 5)
• POST_NOTIFICATIONS Bill and debt payment reminders (Android asks you first, optional)
• VIBRATE Vibration feedback, such as when you pay off a debt
• RECEIVE_BOOT_COMPLETED Reschedules your reminders after the phone restarts
• USE_BIOMETRIC USE_FINGERPRINT Added by Android's sign-in library (Credential Manager, which MoneyShip uses for Sign in with Google). MoneyShip never asks for your fingerprint or face and doesn't use them

The app also carries one internal permission, DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION, which Android's support library (AndroidX Core) adds so that only MoneyShip itself can send messages to parts of the app. It gives no access to anything on your phone.

We do not request access to your camera, contacts, location, microphone, calendar, SMS, or files.

11. Children's Privacy

MoneyShip is designed for adults managing their personal finances. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated through the app or via email if you have an account. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact Us

If you have questions about this privacy policy or how your data is handled, contact us at:

moneyshipapp@gmail.com

For help using MoneyShip, see our support page.