Privacy policy
What we read, what we remove, what we keep.
Tally (the "Service") grades how well you use AI coding tools and estimates what your AI spend produced. To do that, a small program you run on your own computer (the "collector") reads the session transcripts your coding tool already stores, removes personal and secret information, and uploads a reduced, redacted record to us. This policy explains, in plain English, exactly what that involves. Where we make a judgment call about wording, we have tried to err on the side of telling you more, not less.
Short version. You do not give us an email to get a score: the first run creates an anonymous account identified only by a token stored on your machine. You can attach an email later if you want to see your card in a browser. The collector runs on your machine. Raw transcripts, source code and secrets never leave it. What we receive is a per-prompt record with redacted text, token counts, model and tool names, file names, timestamps and your machine account name. We keep it while your account exists, delete it within 30 days of your request, and keep only de-identified aggregate statistics after that.
Contents
- 1. What the collector reads on your machine
- 2. What is removed before upload
- 3. What is uploaded, and what never is
- 4. What we compute and store, and where
- 5. How long we keep it
- 6. Models and processors we use
- 7. Security
- 8. Your rights
- 9. A note on employer data
- 10. Children
- 11. Changes to this policy
- 12. Contact
1. What the collector reads on your machine
When you run the collector (for example, npx tally-score score), it looks for the session logs that your AI coding tool writes to your computer. For Claude Code that is the ~/.claude/projects directory; other supported tools have their own locations, which the collector prints before it starts. It reads only those logs. It does not read your repositories, your shell history, your browser, your email or any other files, and it does not install anything that runs in the background.
From each session log the collector reconstructs "episodes": one prompt you typed (or a scheduled or automated follow-up), and everything the assistant did until your next prompt. For each episode it records the prompt text, the assistant's final message, the models called and their token counts, the tools called and how many times, the names of files the assistant touched, timestamps and duration, and whether the episode was triggered by you, by a schedule or by the system. Sub-agent runs delegated within a session are read the same way.
You can limit what is read with the collector's flags, for example to one project, a date range or a number of recent prompts, and you can exclude any directory by name. The collector prints a summary of what it is about to upload and asks you to confirm before the first upload.
2. What is removed before upload
Before any text leaves your computer, the collector replaces the following with placeholders such as [email] or [name]:
- Credentials and secrets: API keys, tokens, passwords, private keys and connection strings, matched by pattern.
- Email addresses.
- Phone numbers.
- Payment card numbers (checked with the Luhn algorithm so ordinary long numbers are not over-redacted).
- Government identifiers such as social security numbers, and bank account identifiers such as IBANs.
- IP addresses.
- People's names, including public figures, are removed on receipt, before analysis. Names need judgment rather than a pattern: our service proposes capitalized phrases as candidates and a model decides which are real people, then every occurrence is replaced with
[name]and the stored copy of your upload is overwritten with the redacted version. Decisions are cached so the same name is treated the same way every time. Until that step completes, which is normally within minutes of upload, the names in your prompts are held in your account's private storage. - Home-directory usernames in file paths, which are collapsed to
~.
Redaction is best-effort. Pattern matching and model judgment both miss things: an unusually formatted secret, a name written in lower case, personal information embedded in a way we did not anticipate. We test the redactor and improve it, but we cannot promise that no personal or secret information ever reaches us. If you notice something that got through, tell us at [contact email] and we will remove it. If you are not comfortable with best-effort redaction of a particular project, exclude it.
3. What is uploaded, and what never is
| Uploaded | Never uploaded |
|---|---|
|
|
Note that the assistant's messages may quote fragments of your code (a function it wrote, a line it explained). Those fragments are inside the redacted text we receive. We do not receive files, but we may receive the pieces the assistant chose to write out in conversation.
When you create an account we also collect the usual account information: the email address you sign up with, a display name if you choose one, and, for team accounts, the company you belong to. We use standard server logs (IP address, browser, pages requested) to run and secure the site; these are kept separately from your episode data.
4. What we compute and store, and where
From the uploaded episodes, our service computes and stores:
- Tasks: groups of consecutive episodes that make up one piece of work, with a task type, scope, reasoning demand, outcome and an estimate of the hours a person would have needed.
- Deliverables: groups of tasks that make up one shipped outcome, with a short generated name, an hours estimate, and the freelance, internal and agency prices derived from it.
- Judgments: the model answers behind those classifications, with their confidence, cached so that re-running does not cost anything.
- Scores and grades: the six dimension scores, the overall grade, and the coaching text on your card.
- Reports: your report card and, for team accounts, the team dashboard and exports (CSV and JSON).
- Benchmarks: de-identified, aggregated statistics across all users, used to set grade cut points (see section 5).
All of this is stored on servers operated for us by the providers listed in section 6, located in [jurisdiction]. Your data is associated with your account and, for team accounts, with your company's workspace, where the people your company designates as administrators can see per-person cards and the dashboard.
5. How long we keep it
- Individual data (episodes, tasks, deliverables, judgments, scores, reports) is kept for as long as your account exists, so that later cards can show change against your earlier ones.
- Deletion. When you delete your account, or ask us to delete your data, we delete everything tied to you, including cached judgments, within 30 days. Backups that include your data expire on their own schedule, no more than [backup retention period] later, and are not restored except to recover from a failure.
- De-identified, aggregated benchmark statistics (for example, the distribution of correction rates across all users, or the median value per dollar for a task type) are retained indefinitely. They are computed across many accounts, contain no text, file names, account names or identifiers, and cannot be traced back to you. They are not affected by deletion.
- Team accounts. If your company runs a pilot, your company decides retention for its workspace within the limits above, and you should ask your employer how it handles the data. See section 9.
6. Models and processors we use
To compute the tasks, deliverables, judgments and names described above, we send redacted episode text to the model providers and hosting providers below. Each is bound by a contract that limits its use of your data to providing its service to us. We do not sell your data and we do not use it to advertise to you.
[list of subprocessors]
We will update this list before adding a processor that handles episode text, and, for team accounts, notify the workspace administrator.
7. Security
- Uploads travel over TLS. Data is encrypted at rest with the hosting provider's managed encryption.
- Access to production data is limited to the staff who operate the service, is logged, and is used only to run the service, investigate a problem you reported, or comply with the law.
- Model-provider API keys live on our servers, never in the collector; the collector authenticates to us with a token tied to your account, which you can revoke from your account page.
- The collector is open to inspection: its source is published so you can read exactly what it reads, removes and sends.
- If we discover a breach that affects your data, we will tell you without undue delay and in any case within the time the law of [jurisdiction] requires.
8. Your rights
Wherever you live, you can:
- Access what we hold about you. Your account page shows your episodes, tasks, deliverables and cards.
- Export it. The same page offers a JSON and CSV export of everything tied to your account.
- Correct account details, and tell us if a judgment or a redaction is wrong.
- Delete everything, by running
npx tally-score delete, from the account page, or by email, within 30 days (section 5). - Object or restrict particular processing, and, where your local law provides it, complain to a supervisory authority.
To exercise any of these, write to [contact email]. We may ask you to confirm you control the account before acting. We will respond within 30 days.
If you live in a place whose law requires us to name a legal basis: we process your data to perform our agreement with you (providing the Service), and, for benchmarks, security and improvement of the redactor, on the basis of our legitimate interest in running a service that is accurate and safe, which we have weighed against your interests by de-identifying and minimising what we keep.
9. A note on employer data
If you use AI coding tools for work, your session logs describe your employer's work: what you built, in which repositories, on which schedule. Check your employer's policy before uploading work data to any third-party service, including this one, and prefer a team account set up by your employer where one exists. If your employer runs a Tally pilot, the workspace administrator can see your card and dashboard, and your employer, not us, decides who at the company has access. For an individual account, exclude work projects with the collector's flags if you are not sure.
10. Children
The Service is for people who write software professionally or as a serious hobby. It is not directed at children, and we do not knowingly collect data from anyone under 16 (or the higher age your local law sets). If you believe a child has created an account, contact us and we will delete it.
11. Changes to this policy
When we change this policy we will post the new version here with a new effective date and summarise what changed at the top. For changes that expand what we collect or how we use it, we will email account holders at least 14 days before the change takes effect. Continuing to use the Service after that date means you accept the new policy; if you do not, delete your account and we will delete your data as described above.
12. Contact
[Company Legal Name]
[postal address]
[contact email]
This policy is governed by the law of [jurisdiction]. Nothing in it limits rights that your local law gives you and that cannot be limited by agreement.