Tally
Connector Privacy Policy
This policy explains how the Tally workout app and its AI-assistant connector
(the Model Context Protocol server at https://mcp.tallyworkout.app/api/mcp) handle your
data when you connect Tally to an assistant such as Claude or Meta Muse.
Who we are
Tally is operated by Vegh Labs LLC. For any privacy question or request, contact support@tallyworkout.app.
What the connector accesses
When you connect Tally to an assistant and ask it to plan or review workouts, the connector — acting only for your signed-in account — can:
- Read your upcoming planned workouts and recent workout summaries.
- Read your completed workout history in set-by-set detail: exercises, weights, reps, durations, distances, ratings, and any notes you logged.
- Search the public exercise library by keyword — only your search term is sent, no personal data.
- Create, update, or delete planned workouts in your account — normally future days; past days only when you ask for a backfill.
All access is scoped to your account only, enforced server-side by per-user row-level security. The connector never reads or writes another user's data.
What we store, and where
- Your workout data (planned workouts and completed sessions) is stored in our database (Supabase) as part of normal Tally use — the connector reads and writes that same data; it does not create a separate copy.
- Connection credentials: when you authorize an assistant, we store OAuth tokens only as irreversible SHA-256 hashes (never in plaintext), with the client identifier and granted scope. Authorization codes are likewise stored hashed and are single-use.
- Tool-call records: for each request an assistant makes, we keep a short technical record (which tool, the result, the dates involved, timing) for up to 180 days to find and fix problems. It never includes exercise names, notes, or weights.
- We do not store the contents of your assistant conversations. Data you ask the assistant to read is returned to that assistant's operator (Anthropic for Claude, Meta for Muse) to answer you; their handling of it is governed by their own privacy policies.
What the connector does not collect
- It does not expose your name, email, or account settings to the assistant. From your app preferences it reads only your weight unit (and, after the next app update, your time zone), so it plans in the right unit and on the right day.
- Standalone cardio entries stay on your device only and are never synced or shared through the connector.
Data retention
- Access tokens expire after 1 hour; refresh tokens after 30 days.
- Signing out of Tally on a device asks our server to revoke all connector tokens. Removing the connector in your assistant makes the assistant discard its tokens. In both cases the tokens also expire on their own (access: 1 hour; refresh: 30 days).
- Deleting your Tally account permanently deletes your workout data and all connector tokens and authorization codes.
Third parties
- Supabase — database and authentication.
- Vercel — hosting for the connector.
- The AI assistant you connect (Anthropic's Claude, Meta's Muse, or another MCP client you choose) — the connector client; receives the workout data you ask it to read and the plans you ask it to write.
- exerciseapi.dev — public exercise library; receives only your search keywords.
- Apple / Google — only if you choose those sign-in methods.
Your choices
- Disconnect anytime by signing out in the Tally app or removing the connector in your assistant.
- Delete your account in Tally (Settings → Account) to erase your data and revoke all access.
- Contact support@tallyworkout.app with any privacy question or request.
Changes
We may update this policy; the effective date above reflects the latest version.