Last updated October 19, 2026
dally is built and run by Kevin Kheira, an independent developer. Kevin is responsible for how your data is handled (the “data controller” in some privacy laws). Questions go to support@planwithdally.com.
dally is for adults. It isn’t meant for anyone under 18, and dally doesn’t knowingly collect information from anyone under 18. If you think someone under 18 is using it, tell us and we’ll delete what’s ours to delete.
If you sign in, dally receives from Apple your name (if you share it), an email address (possibly a private relay address) and a stable account identifier. Your name and photo are shown to people on trips you share with them. Your email isn’t shown in the app and isn’t added to trips you share. It’s kept in your private iCloud record so your profile comes back on a new phone. Trips shared with test versions of dally before October 2026 may still carry it on the other people’s phones. When you delete your account, dally also asks Apple to revoke the sign-in.
dally makes no account for you. Trips you create are stored in your phone’s iCloud, the same way as everyone else’s. A few things ask you to sign in first, and the app tells you when. Without an account there’s no Delete account button: delete your trips one by one instead. Deleting the app alone leaves your trips in your iCloud.
To join from a link, dally asks only for a name, and a photo if you want. You don’t need a dally account or an email, but your phone does need to be signed in to iCloud, because the trip is shared through iCloud. iCloud adds an identifier to your copy that isn’t your email. Your name and photo are shown to the people on that trip.
Your home city and profile photo are optional and live in your private iCloud record.
Everything you add to a trip is stored in your iCloud: flights, stays, plans, notes, receipts and their photos, and the places you save. dally’s server only gets what you choose to send it, like a bill link.
On a shared trip, everyone on the trip can see everything on it. Keep anything private on a trip you haven’t shared.
Calendar: if you allow it, dally looks through your calendar on your phone for flights and stays. Nothing from your calendar is uploaded. Only the trip details you approve are saved.
Camera and photos: dally only receives the photos you pick or take yourself. It never browses your library, and only saves to Photos when you choose to from the share sheet.
Notifications, widgets and the Lock Screen: these are built on your phone from your own trips.
A bill link lets people at the table tap what they had, without the app. It’s the one thing you make that’s stored on dally’s server. It holds the merchant, currency and total, each item and its price, tax, tip and fees with their labels, the first names of the crew, any name someone types on the page, and who claimed what.
It never holds the receipt photo, emails, phone numbers, the trip’s name or your notes. Anyone with the link can read the bill and claim lines, so share it like you would the bill itself. Only the phone that made the link can change or stop it.
Bill links delete themselves after 7 days. Stopping one deletes it straight away, and deleting your account stops all of yours.
When you save, plan or visit a place, dally sends its server a small count: the place and its location to about 100 meters, its city and country, its kind, which of the three it was, and the month. It isn’t linked to your account: it carries a random number made on your phone, stored only in scrambled form. A place only shows counts once at least five people have contributed. You can turn this off in Settings › Your data › Count my saves on Explore.
City art is made by Google’s Gemini, which receives only the destination’s name and a fixed style, through dally’s server. Each city is drawn once and reused for everyone.
Place photos come from Wikidata and Wikimedia Commons. dally’s server gets the place’s name and its location to about 100 meters; Wikimedia gets only the name. Hotels and rentals are never looked up.
City art, and Explore pictures where no free photo exists, are made by a machine. They’re illustrations, not records of what a place looks like.
Usage counts. To learn which features people use and where they get stuck, the app counts moments like opening the app, starting a trip, sending an invite, adding a plan or receipt, voting, settling up, saving a place or seeing an error. Each count says what happened in a few fixed words, for example that a trip was started from an import, has 3 to 4 people and starts within two weeks. Never your name, email, trip names, places, notes, amounts or location. Counts carry a random number this install made for this alone, not your iCloud account or Apple ID, and dally’s server scrambles it, and any trip’s ID, before passing them to PostHog. Turn it off in Settings › Your data › Help improve dally.
When dally reads a pasted booking, it can record how well that went: whether it worked, which reader ran and its version, whether it read text or a scan, how many pages, dates and airport codes there were, the airline or hotel brand, a country-level region, and whether you changed or deleted the result right after. Never the booking’s text, your name or your email. These go to the public part of dally’s iCloud database, where Apple attaches your iCloud account’s identifier, so they’re linked to your account even though they hold nothing about you. A small signal about whether a settings file loaded goes to dally’s server with no identifier.
Both are on by default. Turn them off in Settings › Your data › Help improve dally. Import diagnostics are deleted when you delete your account.
dally keeps a short log of what synced on your phone, the last 600 lines, with email addresses left out. It never leaves your phone.
Download: with an account, Settings › Your data › Export a backup saves your trips, profile and receipt photos as one file (not your saved places), and Import a backup brings it back. A trip’s owner can also export it as a spreadsheet from the trip’s menu.
Delete: delete anything, or a whole trip, at any time. A trip you own leaves your iCloud right away, and a recovery copy stays on your phone for 30 days. Deleting a trip someone shared with you just takes you off it. Settings › Account › Delete account offers you a download first, then:
Some things stay. People you shared a trip with keep their own copy of it, which no longer changes, and what you added to someone else’s trip stays on that trip. Explore, settings and usage counts stay, because they were never linked to you. If dally can’t reach iCloud, nothing starts; if it stops part way, your account stays and you can try again. iCloud backups you made yourself are yours to manage.
| What | Where | How long |
|---|---|---|
| Trips, notes, receipts, photos, saved places | Your iCloud | Until you delete them or your account |
| A deleted trip’s recovery copy | Your phone | 30 days |
| Bill links | dally’s server | 7 days, or until you stop them |
| Invite pages and join requests | dally’s public iCloud database | Until you stop sharing, make a new link, or delete the trip or your account |
| Import diagnostics | dally’s public iCloud database | Until you delete your account |
| Explore and settings counts | dally’s server | Kept, not linked to you |
| Usage counts | PostHog, for dally | 1 year, not linked to you |
| City art | dally’s server and public iCloud database | Kept. In iCloud it carries Apple’s identifier of the account that uploaded it |
| Daily limit counters (a scrambled form of your network address) | dally’s server | 7 days |
| Place photo lookups (name and location to about 100 meters) | dally’s server | Kept as a cache; a place with no photo is checked again after 30 days. Not linked to you |
| Flight route lookups | dally’s server | A cache, refreshed after 30 days. Not linked to you |
| Sync log | Your phone | Last 600 lines, never sent anywhere |
Can’t use the app, say after losing your phone? Email support@planwithdally.com from the address linked to your Apple Account and we’ll help within 30 days. What’s on dally’s server we delete ourselves; what’s in your iCloud we’ll help you delete from another device.
Wherever you live, you can see, download, correct and delete your data, and most of that you can do yourself in the app. For anything else, including objecting to or limiting how your data is used, email support@planwithdally.com. We may need to confirm it’s you, and we’ll reply within 30 days. Using your rights never costs you anything or changes how dally works for you.
Why dally may use your data (for EU and UK readers): to provide the service you asked for (your account, syncing, sharing, bill links); with your consent, which you can withdraw at any time (location, calendar, camera, diagnostics, usage counts, Explore counts, TikTok links); and for dally’s legitimate interest in keeping the service working and safe from abuse.
Selling: dally doesn’t sell or share personal information for money or for cross-context advertising, as California law defines them, and it honors Global Privacy Control signals.
Where it’s processed: dally relies on Apple, Cloudflare, Google and PostHog, all based in the United States, plus Wikimedia, adsbdb and Open-Meteo, which receive no personal information. Cloudflare and Google are certified under the EU-US Data Privacy Framework, and Apple and PostHog use standard contractual clauses. Their policies: Apple, Cloudflare, Google, PostHog.
In the EU or UK you can complain to your data protection authority, and in California to the Attorney General. You don’t need to contact us first.
Changes: if this policy changes in a way that matters, the date at the top changes too.