Privacy Policy
TALA Dinero Inteligente
This policy explains how this application handles information and how to contact us about privacy.
Information we process
TALA stores the financial information you enter, including your optional local profile name, opening balance, currency, transactions, loan balances, recorded payments, savings goals and app preferences, on your iPhone. If you choose synchronization, the app creates a random installation secret stored in your iOS Keychain and sends an encrypted snapshot of your app data to the TALA backend over HTTPS. The backend stores an installation authentication digest, encrypted snapshot, revision number and update time. Hosting infrastructure necessarily processes connection information such as IP addresses and operational request metadata. TALA does not request an account, access your bank account or collect advertising identifiers.
How we use information
Your local information is used to display and calculate your financial plans and progress. Optional synchronization stores and retrieves your encrypted snapshot for this installation. Revision numbers help reject outdated writes. Optional local notifications remind you about information configured in the app. Operational connection information is used to provide, protect and troubleshoot the service. TALA does not use your financial information for advertising or marketing.
Service providers and sharing
Cloudflare terminates public HTTPS and proxies requests to the TALA service hosted on Railway. Cloudflare processes connection information, request metadata, installation authorization headers and encrypted snapshot traffic to deliver this service. The optional backend and its PostgreSQL database are hosted on Railway, which processes service data as an infrastructure provider. The app does not include advertising or analytics services and does not sell your information. A JSON export is created only when you request it and is unencrypted; anyone who receives that file can read it. Choose its destination carefully. Third-party apps or storage providers you choose for an export apply their own privacy practices. Information may also be disclosed when legally required.
Data retention
Local records remain until you delete them or remove the app; device and iCloud backups are governed by your Apple settings. Optional synchronized ciphertext remains in the live database until you replace or delete it. A deletion tombstone containing the installation digest, revision and update time is retained to reject old synchronization retries. The installation secret may remain in the iOS Keychain after app removal. Cloudflare and Railway infrastructure logs, and Railway database backups, may retain information separately; no specific retention period or immediate backup erasure is promised because these provider settings have not been independently confirmed.
Deleting your information
Use Delete all data in Profile to clear your local financial plan and request deletion of this installation’s synchronized ciphertext from the live database. When offline, the app retains a pending deletion marker and retries when connected; it does not upload new snapshots while deletion is pending. A minimal server tombstone remains. Deletion does not recall copies you exported or erase provider backups immediately. If you enable synchronization again after deletion, a new encrypted snapshot may be uploaded. The installation secret and revision remain to prevent outdated writes. Without the secret, the service cannot identify or recover your installation’s snapshot from an email address because TALA has no account or email registration.
Permissions and your choices
TALA asks for notification permission only for optional local reminders. You can deny permission or change it in iOS Settings and continue using the financial tools. Export uses the system document picker when you request it. TALA does not require access to your contacts, microphone, camera, photos, location or bank credentials for its core features. Network access is used for optional synchronization and opening the privacy policy.
Your privacy rights
You can review and edit your local information, export a JSON copy, clear local records, and request deletion of synchronized data from inside the app. Your available privacy rights depend on applicable law. Privacy questions or rights requests can be sent to daniel.m.pettersson@icloud.com. An email does not establish ownership of an anonymous installation; technical access requires its secret. Do not include financial records or your installation secret in an email.
Security
Local app data uses iOS file protection. The installation secret is generated from 32 cryptographically random bytes and stored in the iOS Keychain when synchronization is first used. Before upload, the app encrypts its snapshot with AES-GCM using a SHA-256-derived key. Public HTTPS terminates at Cloudflare, which proxies requests to the pinned Railway HTTPS origin. The backend stores a separately domain-separated authentication digest rather than the secret, encryption key or readable financial records. The bearer secret is processed transiently to authorize requests, so client-side encryption is not a claim that the server or the infrastructure providers processing authorization headers are technically incapable of deriving the key while handling a request. Rate limits, bounded requests and revision checks protect the API. No security system is infallible; protect your device and unencrypted exports.
Children’s privacy
TALA is intended for people managing their own finances and is not directed to children under 13. It does not knowingly collect personal information from children under 13. If you believe a child has submitted information, contact daniel.m.pettersson@icloud.com without sending financial records or an installation secret.
Changes to this policy
This policy is effective November 12, 2026. Updates will be published at this privacy-policy address with a revised effective date. Review it before enabling synchronization or after an app update that changes data handling. Questions about this policy can be sent to daniel.m.pettersson@icloud.com.