Your privacy.
Clearly stated.

Who we are and what this covers

Tally is operated by S3 AI Labs LLC. This policy covers keeptally.net and summarizes the current Tally iPhone beta. The full app privacy notice explains the app’s version-specific sharing, limits and deletion controls. Contact privacy@s3ailabs.com with privacy questions.

Tally is available through TestFlight, subject to beta capacity. It is not yet a public App Store release. Material changes to optional website measurement require a new choice; an earlier acceptance does not enable this policy’s expanded analytics.

What website analytics measures

With consent, first-party analytics records page visits; sections read; 25%, 50%, 75% and full-page scroll milestones; visible-page time milestones up to five minutes; TestFlight button clicks and their placement; FAQ openings; guide tabs; example-week interactions; calculator use; navigation; and categories of external links clicked. We measure the action, not what you type or the values you enter into the calculator.

Each event has a random event ID, browser identifier, session identifier, page path, event category and time rounded to the minute. We record broad screen-size, browser-family and operating-system categories, plus numeric page-load, layout-shift and interaction timing summaries when supported. Errors are counted as script, resource or promise failures; we do not send error messages, stack traces, page text or screenshots.

Referral information is reduced to a fixed category such as Google, Instagram, email, campus, friends or other. Only recognized source, medium and campaign labels are recorded. Current campaign labels are beta-launch, campus-fall-2026 and friends-invite; other values become “other.” Full referrer addresses, raw query strings and advertising click IDs are not stored in our analytics database.

Our own website analytics database does not collect names, email addresses, precise location, IP addresses, raw browser headers, full fingerprints, typed text, app account IDs or attendance records. The optional email signup and external services described below have separate data practices. Random browser identifiers can connect visits for up to 30 days. They are pseudonymous, not a guarantee of anonymity. We do not link first-party website analytics to Tally app accounts. Separately consented advertising lets Meta associate website events with activity across its participating services and websites. Hosting providers separately process connection information and operational logs to deliver and protect the site.

Optional external analytics, recordings and advertising

Cookie settings shows which services are connected. Each category starts off until you choose it under version 3. Google Analytics measures visits and interactions when Site analytics is enabled. Microsoft Clarity records page interactions such as clicks and scrolling when Session replay is enabled. Signup fields are masked, and we do not send email addresses to Google Analytics or Clarity. Microsoft advertising consent remains disabled.

Advertising enables Meta Pixel and server-side Conversions API for website visits, TestFlight link clicks and consented email signups. Meta may receive event times, page information, browser and ad-click identifiers, IP address and browser headers. These signals can be matched to Meta accounts and used for attribution, audience building and personalized Tally ads across participating services. External providers may also receive referring-page information. A TestFlight click is not proof of an install. Browser restrictions and ad blockers can limit collection.

We load these providers only after the appropriate choice. Declining, an unavailable consent check, or Global Privacy Control keeps optional tracking off. Withdrawing stops future collection; it does not recall information already received by a provider. See Google’s privacy policy, Microsoft’s privacy statement and Meta’s privacy policy. Contact us for assistance requesting deletion from these providers.

Optional email signup and matching

If you request updates, we store your email, signup time and recorded choices. A separate unchecked option permits sharing a SHA-256 hash of that email with Meta for matching this signup, only when Advertising is also enabled. Hashing does not make an email anonymous. We do not send raw email addresses to Meta, and do not import app account emails into website tracking.

Signing up does not require advertising or replay consent. Duplicate requests do not change an existing subscriber’s choices. “Remove my email signup” deletes the request created in the current browser while its 180-day deletion cookie remains. For an older signup, unsubscribe, matching-consent withdrawal or provider deletion, contact privacy@s3ailabs.com. Email delivery is not yet connected; the form records an update request and does not send a confirmation email. Requests older than one year are removed on the next signup, which may be later on an inactive site.

To limit automated submissions, our server uses a daily salted hash of the connection address and short-lived event receipts. Raw IP addresses are not retained in that table. Receipts older than two days are removed on the next signup or advertising request.

Cookies and your choices

The essential tally_consent cookie remembers your choice for 180 days. After analytics acceptance, tally_visitor connects visits for 30 days and tally_session groups events until 30 minutes of inactivity. Cookies are first-party, HttpOnly and SameSite=Lax, with Secure on HTTPS. Cloudflare also uses its separate __cf_bm security cookie, which can be present with optional analytics off. See the cookie policy.

“Accept all” enables the connected optional purposes together, while “Necessary only” keeps them all off. Dismissing the notice does not consent. Reopen Cookie settings anytime. Choosing necessary only stops future optional collection and removes optional cookies accessible to this site. It does not delete third-party records. To erase previous events linked to this browser, use “Delete this browser’s Tally analytics” before its identifier expires or is cleared; deletion also opts out. Global Privacy Control overrides acceptance. If consent cannot be checked or saved, optional tracking stays off.

How the iPhone app uses information

Setup and attendance. Current beta setup requires Sign in with Apple. Selected schedules and attendance records are stored on your phone. You can use iPhone calendars, scan a timetable, or enter classes manually. The offline scanner processes images on-device. Optional guided setup sends chosen messages, images and drafts through Supabase to Nebius, voice to ElevenLabs, and school-only searches to Tavily after a separate disclosure. Apple Maps handles building searches and maps under its own policies. Tally does not edit your calendar.

Attendance location. New classes use movement-based nearby time covering at least 51% of scheduled class duration. Earlier saved results retain their prior rules. Only scheduled class time earns attendance credit. The full timing and inference details appear below.

Friends. Private groups share tracked class names, scheduled meeting times and attendance outcomes within group dates, plus display names, membership, predictions, play-credit balances, totals and approvals. Existing members explicitly enable class sharing. Friends does not receive precise coordinates, building pins, written excuses, schedule images or testing logs. Group information is used to operate Friends and understand participation and outcomes. Credits have no cash or redemption value; the alpha has no purchases or cash prizes.

Required app sharing and day replay

Using Tally requires acceptance of account-linked school-time precise location, class details, class-window diagnostics and Tally app activity. Build 61 narrows location collection under the existing sharing agreement. Older builds may retain their previously disclosed all-day behavior until updated, and existing history is not retroactively deleted. There is no separate opt-out for these required categories; sign out to stop account-linked collection, or delete your account to remove its server data. iOS location permissions remain under your control.

With automatic attendance, Always and Precise Location enabled, Tally keeps its location service active across your school day, including breaks between tracked classes. Opening Tally once before your first class can start the service early; it stops after the last tracked class’s departure buffer. School time is based on the classes you track and their saved building pins, not your school’s general opening hours. A day with no pinned classes has no school-time recording. Changing your tracked schedule changes these boundaries.

After you accept the sharing agreement, Tally saves precise coordinates, timestamps, accuracy and available speed only in scheduled collection windows: 30 minutes before the first class in a group until 10 minutes after the last. Classes separated by no more than 60 minutes form a group. Longer breaks keep the location service active but their readings are discarded. Early service startup does not widen collection windows. Outside-window readings are not saved, uploaded or counted toward attendance. These account-linked readings are uploaded to Supabase to provide day replay and improve Tally. You and authorized Tally administrators can view them; Friends group members cannot.

Recording follows movement and saves at most one reading per minute. The protected on-device retry queue keeps up to 1,440 readings for less than 24 hours and is excluded from backups. Server replay history is limited to 30 days and 43,200 readings. Older readings are hidden and pruned on synchronization; provider backups follow their normal retention. Day in review → Replay options → Delete replay history removes saved all-day locations and invalidates pending earlier uploads. New recording continues under the agreement.

Replay motion estimates straight lines only between nearby, recent, sufficiently accurate readings. It is not an exact route. Long gaps stay visible. Outside-class readings never earn attendance credit. iOS can interrupt delivery, and school-day battery performance remains under field testing.

Required class details include tracked names, times, buildings, saved pins, import method and attendance outcomes; the latest snapshot is capped at 2,000 classes. Class-window diagnostics run from eight minutes before through five minutes after class and include location accuracy, building distance, nearby results, wake/error categories, battery and permission state, device model and iOS version. App activity includes opens, time in Tally, named screens, setup steps and import outcomes. It excludes typed text, screenshots, audio and other-app activity. Diagnostics and activity have up to 30 days of visible history, capped at 10,000 records per category. Full local testing logs and written excuses are not automatically uploaded.

Attendance calculation and background limits

New classes after this update use location updates requested at a 10-metre movement interval. A usable fix must be no more than 60 seconds old with accuracy of 75 metres or better. Tally treats you as nearby only when distance plus reported accuracy fits within a 110-metre building radius, and as away when distance minus accuracy exceeds it. Uncertain boundary readings do not change the last clear state.

Nearby time is inferred between clear readings, including quiet periods while stationary, and counts only during the scheduled class. At least 51% is required. A later departure reading can correct an earlier estimate. Known permission loss or a tracking restart ends continued-presence inference at the last sample. Earlier saved attendance and personal records are preserved; a class already underway at the update retains its earlier rule unless it already has movement evidence.

iOS controls background execution and privacy indicators. Opening Tally before your first class helps establish tracking. Force-quitting, restarting the phone, permission changes, battery restrictions or system suspension can interrupt it. Scheduled background wakes are not guaranteed. Startup and interruption notifications are best-effort prompts to reopen Tally, not proof that you closed it. Keeping tracking active through breaks can use more battery.

Read the complete Terms of Use and app Privacy Policy.

Service providers and purposes

OpenAI Sites and Cloudflare host the website, email signup records and first-party analytics database. Optional website services include Google Analytics, Microsoft Clarity and Meta as described above. Apple supports sign-in, permissions, Maps and TestFlight. Supabase supports accounts, groups, required sharing and day replay. Providers may process data in countries other than your own under their respective terms and policies. TestFlight has its own usage, crash and feedback collection.

We use information to provide requested features, answer support, protect services and—with consent—understand website use and improve reliability. Where required, optional analytics relies on consent; requested services and proportionate security/support rely on the applicable service or legitimate-interest basis. We may disclose information when legally required, to protect rights and security, or during a business transfer subject to applicable protections.

Retention and deletion

Website analytics is capped at 200 stored events per browser per UTC day. Events older than 90 days are removed on the next accepted analytics write; without another write, older records may remain longer. The deletion control immediately removes events linked to the current browser identifier. Once that identifier is cleared or expires, we may not be able to match older events to you.

Local app information remains until removed with app or device controls; backups and exports may retain copies. Use the app’s account-deletion controls to remove associated live-service data, including required uploads and day replay. Uninstalling alone does not delete server data. Replay-history deletion leaves local attendance and separate Friends data intact. Provider backups follow their own retention. Support correspondence is kept as needed to resolve requests and meet applicable obligations.

Legal bases and international processing

Where the GDPR, UK GDPR, or a similar law applies, consent is the legal basis for optional analytics, replay, and advertising. We rely on performance of a requested service for account, signup, group, and support functions; legitimate interests for proportionate security, abuse prevention, service administration, and business records; and legal obligation where law requires processing. You may withdraw consent prospectively at any time without affecting processing already performed.

S3 AI Labs LLC and its providers primarily operate in the United States. Google, Microsoft, Meta, Apple, Cloudflare, OpenAI, Supabase, Nebius, ElevenLabs, and Tavily may process information in the United States and other countries. Where required, transfers use an adequacy decision, contractual safeguards offered by the relevant provider, or another lawful transfer mechanism. Contact privacy@s3ailabs.com for information about safeguards available for a particular transfer.

California and other United States privacy rights

During the preceding 12 months, the website may have collected identifiers, internet or electronic activity, approximate location inferred by providers, and inferences used for analytics or advertising. Sources are you, your browser or device, and service providers. Business purposes are providing and securing the service, support, measurement, product improvement, attribution, and advertising with consent. Recipients are the providers identified above. We do not sell personal information for money. Advertising consent may constitute “sharing” for cross-context behavioral advertising under California law; “Necessary only” and recognized Global Privacy Control signals opt out.

If an applicable state law grants you rights, you may request access, correction, deletion, portability, or information about collection and disclosures; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain sensitive-information uses; or appeal a refusal. We do not discriminate for exercising applicable rights and do not offer a financial incentive for website data. An authorized agent may submit a request where permitted, subject to verification of authority and identity.

EEA, UK, and other privacy rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or objection; withdraw consent; and complain to a supervisory authority. The right to object to direct marketing applies at any time. Website analytics is not used for decisions producing legal or similarly significant effects, including decisions about grades, eligibility, or academic standing. Contact privacy@s3ailabs.com; we may request information reasonably necessary to verify and locate records.

Tally is for college students and students preparing for college, and is not directed to children under 13. Contact us if you believe a child under 13 supplied personal information. We use access controls and encrypted connections, but no system guarantees absolute security. External links, email and TestFlight have their own privacy practices. Please do not send sensitive logs or location histories unless you intend to share them.

Changes and contact

S3 AI Labs LLC is responsible for the processing described here. Email privacy@s3ailabs.com for privacy questions or rights requests. We may update this policy as services, providers, or law change. The effective date identifies the current version. If a material change requires consent, the relevant optional processing remains off until a new affirmative choice is obtained.