Privacy
Tally Universe is a free maths app for children in grades 4 to 7. Your child can play without an account, and then nothing about them leaves the device. If you, as their grown-up, create an account and give consent, we keep only what Tally needs to teach your child and show you their progress.
This is the privacy policy for the Tally Universe app and for this website, tallyuniverse.org. It is written for parents and other grown-ups. It says what we collect, why, where it is kept, who can see it, how long we keep it, and how you can see, save or delete it.
On this page:
- The short version
- If you are a child
- Who is responsible
- What we do not do
- In the app
- How long we keep data
- Your choices and rights
- Service providers
- This website
- When you email us
- Changes to this policy
- Contact
The short version
- Your child can play without an account. Until a grown-up gives consent, everything stays on the device.
- Accounts are for grown-ups. Your child never signs in.
- With an account, we keep a nickname (not a real name), a school grade, what your child does in Tally, and your email address. The nickname and your email address are encrypted.
- No ads. No tracking. No code from advertising or analytics companies in the app. We never sell or share your child's data.
- We never ask for a real name, a birthday, a photo or a location.
- At any time, in Grown-ups → Privacy, you can save a copy of the data, delete it, or withdraw your consent.
If you are a child
If you are a child, ask a grown-up to read this with you. Here is what it says, in short:
- Tally never asks for your real name, your birthday, a photo of you, or where you are.
- What you do in Tally stays on your iPad, unless a grown-up in your family says yes to keeping it in their Tally account.
- A grown-up in your family can see how you are doing.
- Your answers are never shown to anyone outside your family. There is no chat.
- Tally has no ads, and it never sells anything about you.
- A grown-up can delete everything at any time.
- If something in Tally worries you, tell a grown-up you trust.
Who is responsible
Tally Universe is run by Cuong Nguyen, the parent who builds Tally, who decides how Tally handles data and is responsible for it. In this policy, "we" and "Tally" mean Cuong Nguyen.
For any question, request or worry about privacy, email support@tallyuniverse.org.
What we do not do
- We do not show ads, in the app or on this website.
- We do not track you or your child across other companies' apps or websites.
- We do not put advertising, analytics or tracking code from other companies (third-party SDKs) in the app. The app sends information only to Tally's own server, apart from signing in with Apple or Google when a grown-up chooses to.
- We do not sell, rent or share your child's data, or yours. The only companies that handle it are the service providers named below, and only to run Tally for us.
- We do not ask for a real name, a birthday, a photo, a voice recording, contacts or a location. We do not keep your name either.
- We do not use your email address for marketing.
- We do not send notifications to your child.
- Children cannot chat, send messages, or post anything that other people can see.
- We do not use your child's data to make decisions about them outside the app. Tally does not rank children or send anything to a school.
In the app
Without an account: everything stays on the device
Your child can play Tally without any account. Until a grown-up creates a Tally account and gives consent, nothing about your child leaves the device. Tally keeps these on the device:
- each child's profile: a nickname, an age or school grade, the interests chosen for them, and the choices they make in the app;
- everything your child does in Tally: every answer, hint and time, and the stars and planets they earn;
- the grown-ups' PIN, stored scrambled, never as typed;
- the settings.
Where the law requires it, Tally may ask Apple for your child's age range (for example "under 13"), never a birth date. The answer stays on the device too.
This data stays on the device until you erase it in Grown-ups → Privacy or remove the app. We cannot see it, and we cannot recover it for you. You can save a copy as a file at any time.
With an account and your consent
A Tally account keeps your child's progress safe if the device is lost, and lets another device carry on. Only a grown-up has an account. Your child never signs in.
We treat every child who uses Tally as under 13, so the same protections apply to every child. This is how consent works:
- A grown-up opens Grown-ups on the child's device. It is protected by a grown-ups' check and a PIN.
- You sign in with Apple, with Google, or with your email address and a 6-digit code that works for 10 minutes.
- You read our notice in the app and ask us to email you a consent link.
- You open the link on any device and tap “I agree”. Opening the link alone does nothing. The page it opens sets no cookies, sends no analytics and loads nothing from other companies.
- Two days later, we email you again to confirm your consent and to say how to withdraw it.
Before you give consent, our server keeps only your sign-in details and nothing about your child. It refuses to store a child, a nickname or any learning record until consent is given. A consent link works for 7 days. If you do not give consent, we delete your email address and the account 30 days after you started it.
Once you agree, your child's nickname, grade and learning history, including the rounds they played before, go to your account. We record your consent with the version of the notice you read, how you gave it, and when.
What we keep, and why
| What we keep | Why |
|---|---|
| Your email address, encrypted. If you use Apple's Hide My Email, we keep the address Apple gives us. | To sign you in, to ask for and confirm your consent, and to write to you about your account: for example when a sign-in method is added or removed, when you delete data, or before an unused account is deleted. Also the weekly email, if you switch it on. |
| Your Apple or Google sign-in, if you use one. | To know it is you when you sign in. We keep it only as a scrambled code that cannot be turned back into your account details. For Apple, we also keep an encrypted token, used only to cancel Sign in with Apple for Tally when you delete the account. |
| Your child's nickname, encrypted. A name used at home is enough. | To show it on your family's devices. |
| Your child's grade: 4 to 7, or "not sure". | To start the questions at the right level. |
| What your child does in Tally: each question (its type and level), the answers, hints and times, rounds, the planets and stars earned, check-ins, and the settings a grown-up chose for the child. | To choose your child's next questions, to show you what your child can do, to keep their progress in step across your family's devices, and to count, in totals only, how many children are learning each week. |
| Details sent with each learning record: the versions of the app and its content, the language, iOS or web, the kind of device (phone, tablet or computer), and your child's local date and time zone. | To check each record, and to count days in your child's own time. |
| Your family's devices: a random ID for each signed-in device, iOS or web, the kind of device, and when it was last used; an ID for each installation of the app, carried on learning records; and, for each installation, a key that Apple's App Attest service confirmed belongs to the real Tally app, kept without any link to you or your family. | To list your family's devices, and to check that sign-in requests come from Tally's own app. These IDs are used only to run Tally, never for advertising or to contact anyone. |
| Account records: your consent (the notice version, how it was given, when) and its receipts; a log of what was deleted and when; and which duplicate child profiles you merged, and when. | To show that you gave consent, as the law requires, and to stop an old device from bringing back a deleted child. |
| Your weekly email choice: on or off, and your time zone and language when you switched it on; and a list of the weeks it was sent. | To send it once a week at the right time. It is off unless you switch it on. It says the week's check-in is ready and has nothing about your child in it. |
| App health records, when the app sends them: the app opening, closing or failing, with the app version, the device model and system version, a random ID for that run of the app, and a short error code. They are about the app, not your child. | To count crashes and lost-data problems for each version of the app, so we can fix them. |
The list of your child's interests stays on the device. So do free-text notes in a check-in.
What Tally works out from this
Tally chooses each child's next question from their earlier answers. That is how it teaches. It does not lead to any decision about your child outside the app.
From your child's learning records, our server works out a weekly learning measure for each child: their rounds, milestones and weeks, under the child's random ID. We never send it back to the app or share it, and it is deleted with the child. From these we count weekly totals, such as how many children practised this week. Totals carry no ID of any child or family. We may publish totals, for example in a yearly report. Before we do, groups of fewer than 10 children are combined, so that no number can point to one child.
Where it is kept, and who can see it
- Where: on Tally's server, which runs on Cloudflare. Cloudflare stores the data for Tally and may not use it for anything else. Cloudflare's servers are in many countries, so your data may be kept or handled outside the country where you live.
- Your family: the grown-ups signed in to your account, and your family's devices, see your children's nicknames and progress. Your child sees their own progress in the app.
- Tally's server reads the data only to do its job: to sign you in, send your emails, keep your devices in step and work out progress.
- Us: to see how Tally is doing, we look only at weekly totals, which name no child or family. If you write to us, we read your email.
- No one else. No advertiser, data broker or other company sees your child's data.
How we protect it
- Everything between the app and our server travels over an encrypted connection.
- Your email address, your child's nickname and Apple's sign-in token are each encrypted (AES-256) before they are stored. The keys are kept apart from the database. The database itself is also encrypted where it is stored.
- Learning records carry random IDs, never a name or an email address. They are not encrypted one by one, because our server reads them to work out progress.
- Sign-in codes and session tokens are kept only in a scrambled, one-way form. We never keep an IP address in readable form.
- Every sign-in ends after 90 days at most. Deleting data or withdrawing consent asks you to sign in again first. We email you whenever a sign-in method is added to or removed from your account.
- In a web browser, Tally keeps you signed in with cookies that only Tally's server can read. They are used for nothing else.
- The grown-ups' area in the app is behind a PIN.
- Emails with a sign-in code contain no links, and Tally never asks for your password.
How long we keep data
- On your child's device: until you delete it (Grown-ups → Privacy) or remove the app.
- If you do not give consent: we delete your email address and the account 30 days after the account was started.
- While you use Tally: we keep your child's nickname, grade and learning history, your email address and your consent records for as long as you use your account.
- If you stop using Tally: if nobody signs in, and no device sends anything, for 12 months, we delete the account and everything in it. We email you 30 days before, so that you can keep it by signing in.
- When you delete: when you delete a child or your account, or withdraw consent, we delete the data from our database at once. Our database provider keeps backups of the whole database for 30 days, so deleted data stays in those backups until they expire, at most 30 days later. We restore a backup only to recover from a failure, and we then delete that data again at once.
- What stays after a deletion: a record that a deletion happened (a random ID, the date and the reason, with no name or email), so that an old device cannot set up a deleted child again. A copy of the deletion, consent and merge records, with random IDs and dates only, is kept apart from the database for 400 days, so that restoring a backup cannot undo a deletion. Records of signed-in sessions end when the session would have expired, at most 90 days after the last sign-in. A request to Apple to cancel your Sign in with Apple authorization is retried for up to 30 days.
- Security records: to stop misuse, we keep, without your email address or IP address in readable form: one-time sign-in codes for 10 minutes (or until a 15-minute lock ends); counters of attempts for 2 days; daily counts of uploads for 2 days for each child and 31 days for each family; and device-check keys for 400 days after their last use.
- Weekly email: the list of weeks it was sent, for 8 weeks.
- Totals: weekly totals contain no information about any child or family, and we keep them.
Your choices and rights
You can do all of this yourself in the app, in Grown-ups → Privacy. Anything that changes data on our server asks you to sign in again first.
- See your children's progress and your consent (its date and notice version) in Grown-ups.
- Save a copy. Save one file with everything on the device. With an account, you can also save a file with your account's data.
- Correct your child's nickname or grade at any time.
- Delete one child's data from our server: their profile and every answer.
- Delete the account. The account, every child and all of their data are deleted from our server. We email you to confirm. If you signed in with Apple, we also cancel Sign in with Apple for Tally.
- Erase everything on this iPad. Removing the app also removes its data from the device. Neither deletes your account on our server.
- Withdraw consent. Uploads stop at once, and every child and all of their learning data on our server are deleted. The data on the device stays until you erase it. You stay signed in, so you can still delete the account or give consent again.
- Stop the weekly email by switching it off, or with the stop link in any weekly email.
If you cannot do something in the app, or have any question or request about your data, email support@tallyuniverse.org.
Depending on where you live, you may have other rights over your data, and you can complain to your data protection authority, such as the Information Commissioner's Office in the UK. We would like to hear from you first, so that we can put things right.
Service providers
These are the only companies that handle data for Tally.
| Provider | What it does for Tally | What it receives |
|---|---|---|
| Cloudflare | Runs Tally's server and database, keeps the 30-day backups, and hosts this website. | Everything our server receives and keeps: your sign-in details and, after consent, your child's records. Also the requests your browser makes to this website. |
| Our email delivery company | Sends sign-in codes, consent emails, account emails and, if you switch it on, the weekly email. We will name it here before it sends any email for Tally. | Your email address and the text of each email. Open and click tracking is switched off. |
| Apple | Offers the app on the App Store. If you choose Sign in with Apple, confirms who you are. Its App Attest service confirms that requests come from the real Tally app. | That you signed in to Tally with your Apple account. Nothing about your child's learning. |
| Only if you choose to sign in with Google: confirms who you are, in your device's browser. | That you signed in to Tally with your Google account. Nothing else. |
Cloudflare and our email delivery company work for us. They may use the data only to provide their service to Tally, under written data protection terms, and must protect it as this policy does. When you use Apple's or Google's own services, such as the App Store or your Apple or Google account, their own privacy policies apply to that.
Apple also gives app makers statistics about their apps, such as downloads and, if you chose to share analytics with app developers in your device's settings, how the app is used. These come from Apple, under Apple's privacy policy. Tally sends nothing for them.
This website
tallyuniverse.org tells you about Tally. When you visit it:
- it sets no cookies;
- it runs no analytics, advertising or tracking code;
- it loads nothing from other companies: its fonts, pictures and videos all come from tallyuniverse.org itself.
The site is hosted on Cloudflare. As with any website, Cloudflare's servers receive your device's IP address and the details your browser sends with each request, because they are needed to deliver the page. We have switched off request logs for the site, and we keep no record of your visit.
If you press Pause motion, your browser remembers that choice in its own storage on your device, so the site stays still next time. It is never sent to us.
Links to the App Store take you to Apple, whose privacy policy applies there.
When you email us
If you write to support@tallyuniverse.org, we receive your email address and what you write. We use it only to answer you, never for marketing.
In the app, Grown-ups → Quick guide → Report a problem opens your own mail app with an email to help@tallyuniverse.org. It is filled in with the app version and the last few questions (their type, level and whether the first answer was right), and nothing about your child. You can read and change every line, and nothing is sent unless you send it yourself. We use it only to fix the problem.
Changes to this policy
When we change this policy, we update this page and the date at the top.
If a change is important, we publish a new version of our consent notice. The app then stops sending data about your child, and Grown-ups asks you to read the new version and give consent again. Your child can keep playing, and their data waits on the device. Consent given to an earlier version does not count for the new one.
Contact
Email support@tallyuniverse.org with any question about privacy, any request about your data, or any concern.