The instrument, not the theater. This page states what the server keeps and what it never sees.
Tally keeps its records on the phone. The app works fully offline, signed out, indefinitely. An account is optional.
With an account, private data — log entries, days, meals, foods — syncs to the operator's server so a second device can carry the same tape. It is never shared, except with the one partner you link yourself. It is never sold.
Linking is something both people do: one invites with a code, the other types it in. From then on each sees the other's tape — what was logged, day by day — the kcal and protein targets, the name typed for the link, and the meals cooked and not yet finished. Never your weigh-ins, never the planner, never the micronutrient panel. Symmetric: nobody sees without being seen. A portion one of you serves the other is written onto the other's tape and belongs to them from then on. Either side unlinks at any time; nothing more is shared after that.
The server verifies one purchase: the YEAR, from the signed transaction Apple gave the app, to decide who may invite a partner. It keeps the product, the transaction number and the expiry date. Every other purchase stays between you and Apple.
A product you verify against its package joins a shared base as an anonymous food fact — name, brand, values per 100 g. The fact carries no person; only the package's numbers travel.
Cross-check sends product facts — never personal data — to xAI, once per barcode, ever. The model advises; the package decides.
Delete the account in Settings. Everything private is erased, the partner link and the verified purchase with it. Contributed food facts are withdrawn. The phone keeps its own tape, and a partner keeps the portions already served to them.
Contact: martin@uncondetional.com