This policy is written in plain words. It says what the app actually does with your information.
In one sentence: CareTally keeps everything you enter on your phone. It sends none of it to us or anyone else. The only time it goes online on its own is to ask Apple whether you have a Pro subscription.
Who makes CareTally
CareTally is made by River.io LLC. We have no server, no user database, and no way to see what is in your app. There is no account and no sign-in.
What stays on your phone
CareTally stores these things inside the app, on your phone only:
- The people you care for: a name, and optionally a role and a timesheet code.
- The tasks you log: start and end times, which task, which person, and any notes you write.
- How much help each task took, if you record it.
- A reason, if you write one, for care given outside your program's usual hours.
- Your state and program, if you choose them, so the app can show your program's limits.
- People who may sign off your hours: a name, how they are related, and whether you confirmed they meet your program's minimum age. No date of birth is stored.
- Signatures collected in the app, stored as an image.
- Location at clock-in and clock-out — one reading each time, and only if you allow Location. No background location. The app works without it.
- PINs for signing and for locking the app. They are scrambled with PBKDF2-HMAC-SHA256 (200,000 rounds) before they are stored. The original numbers cannot be recovered.
- A tamper-evident log of every change, each entry sealed to the one before it with SHA-256.
- Settings you enter for your timesheet: your name and phone, a supervisor, your pay period, your billing provider.
- On the free plan, the dates you made a PDF, to count the one-a-month allowance.
What we do not collect
- No account and no sign-up.
- No analytics. We do not know when you open the app or what you tap.
- No crash reports sent by the app.
- No advertising identifier and no tracking across other apps or websites.
- No background location, no microphone, no contacts, no photos, no health data.
When anything leaves your phone
- When you share a PDF. Timesheets, Care Summaries and reports leave your phone only when you tap to share one, and they go where you send them. They contain what you would expect: names, times, tasks, notes and signatures.
- When the app checks your subscription. To know whether you have Pro, CareTally asks Apple's App Store. Apple handles payment. We never see your card or your Apple Account. This check sends nothing about the care you record.
- Your phone's own backup. If iCloud Backup is on, your iPhone backs up the app's data to your private iCloud along with your other apps. That is iOS, not CareTally.
CareTally does not send anything to any agency, fiscal agent, state system, or EVV aggregator — including the AHCCCS EVV aggregator. It is not an EVV vendor.
Children
CareTally is made for adult caregivers. The person being cared for may be a child, and a household member aged 13 or older may sign off hours on the caregiver's phone; the app stores only their name and relationship. CareTally is not directed at children and asks no one for a date of birth.
Health information
The notes you keep about care may be health information. CareTally keeps it on your phone, sends it to no one, and lets you lock the app with a PIN or Face ID. If you work for a home-care agency or another organization covered by HIPAA, ask your compliance officer before using CareTally for work records. We do not sign Business Associate Agreements.
Deleting your data
Settings → Erase all local data removes everything. Deleting the app does the same. Because we hold nothing, there is nothing for us to delete.
Changes
If CareTally ever changes what it does with your information, this page will change first and its version number will go up.