Allay

Privacy

Updated Nov 9, 2026

Allay is made by It Could Be Simple, LLC, a Washington company ("we"). This page explains what we collect when you use the Allay app, this website and its free tools, why, and what you can do about it. Questions go to hello@allayapp.com.

The short version

  • Your organization's records belong to your organization. We use them only to run Allay for you.
  • We don't sell personal information, show ads, or let anyone train AI models on your data.
  • We don't send anything to your funders or anyone else unless someone in your workspace chooses to.
  • You can ask us to show, fix, export or delete your information at any time.

Signing in

You sign in to the app with Google or Microsoft. From them we receive your name, your email address, whether they verified that email, and an account number they use for you. We use this only to sign you in and show who did what in your workspace. We don't get your password, and we don't read your email, contacts, calendar or files. If we add Apple sign-in later, Apple may give us a private relay address instead of your real email.

Our use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.

What your workspace holds

Your organization decides what goes into Allay: grants, funders and their contacts, budgets, expenses, allocations, claims, reports, reporting dates, outcomes, applications, and files uploaded as evidence. Allay also keeps a history of who changed what and when, so records stay traceable. We act on your organization's behalf for these records.

Owners and admins choose who joins a workspace and what role they have. If your organization works with a fiscal sponsor through Allay, the sponsor's staff can see the projects they have been added to, and nothing else.

Soyo, Allay's guide

Soyo answers from Allay's own help guides. When an owner or admin turns on Soyo's writing help (it starts off), Soyo also uses Claude, an AI service from Anthropic, to answer questions, read award letters, suggest where expenses belong and draft report wording.

  • Only what the task needs is sent. For a question, that's the question, a short summary of the workspace (counts and upcoming dates), recent turns of the conversation and facts your team asked Soyo to remember. For a report draft, it's the figures for that one grant and period. For an award letter, it's the letter you chose.
  • Personal details are hidden first where we can. Email addresses, phone numbers, ID, card and bank-like numbers and street addresses are swapped for placeholders before text is sent. This can't be done inside a PDF, so the screen tells you before a letter is read.
  • No training. Anthropic doesn't use what Allay sends to train its models. It keeps it for a limited time for safety checks, under its commercial terms.
  • We don't keep your conversations. A chat with Soyo lives in your browser tab until you reload or choose Start over. Nothing Soyo writes is saved unless a person reviews it and saves it.
  • How Soyo gets better. Your team can ask Soyo to remember short facts; owners and admins can see and remove them in Settings. We count whether suggestions were accepted, edited or turned down, never the text. If an owner turns on Help improve Soyo, those counts can be combined with other workspaces' counts, with no names or text, and only when at least three workspaces contribute.
  • Safety records. If someone tries to trick Soyo, we record which check stopped it and a one-way fingerprint of the text, never the text itself. These records are deleted after 90 days.

Emails from Allay

When a teammate asks you something in Allay or replies to you, Allay can email you about it. The email goes to the address you sign in with. You can turn these emails off in Settings, or with the unsubscribe link in any of them.

QuickBooks

If your organization connects QuickBooks Online, Allay reads what it needs to track grant spending: purchases, bills, vendor credits and refunds, deposits, and journal entries, with their dates, amounts, names, descriptions and memos, plus the class, location and customer or project on each line. It also reads your company name, home currency and chart of accounts (it keeps only each account's type). Deposits are only shown to you as suggestions. Allay never writes to your books. The access Intuit gives us is encrypted before it's stored, and disconnecting revokes it. QuickBooks data is never used for advertising or analytics. If Soyo is on, it may see an expense's payee, description, amount and date to suggest a grant, the same as any other expense.

Sharing with funders and other tools

Someone in your workspace can send one saved report or claim to a funder contact inside Allay. The funder sees only that item, must sign in with the email it was sent to, and the share ends after 90 days or when you revoke it. Owners and admins can also create access tokens so other software can read workspace data; that data goes wherever the token is used, and removing the token stops it.

Payments

Paid plans are handled by Stripe. Your card details go to Stripe, never to us. We keep your plan, its status and Stripe's reference for your organization, and a billing address if tax is collected.

This website and the free tools

  • Report calendar. Everything you type stays in your browser. Nothing is sent to us.
  • Award letter reader. The letter you add is sent to Anthropic's Claude to be read once, and the answer comes straight back to you. We don't keep the letter or the answer.
  • Design partner sign-up. The form sends your name, email, organization, website, budget range and whether you'd like a kickoff call to our customer list in HubSpot, so we can follow up.
  • Visits. We count visits with Cloudflare Web Analytics, which uses no cookies and doesn't follow you across other sites. If you arrive from one of our links, your browser remembers which one. It stays on your device and only travels with you if you start using Allay or fill in a form.
  • Fair use. To keep the tools free, we count how often they're used from each connection for a day. The connection is stored only as a one-way fingerprint, then forgotten. Some forms may use Cloudflare's bot check.
  • Emails. If you write to us, we keep your message only to help you.

Cookies and your browser

The app uses three cookies, all required: one keeps you signed in (up to 30 days), one links a sign-in attempt to your browser for 10 minutes, and one protects a QuickBooks connection while it's being set up. Your look, font, motion and tip settings are stored in your browser only. We don't use advertising or third-party tracking cookies.

Who helps us run Allay

  • Cloudflare: hosting, database, file storage, sending and forwarding email, visit counts and bot checks.
  • Google and Microsoft: sign-in.
  • Anthropic: the AI behind Soyo's writing help and the award letter reader.
  • Stripe: payments.
  • Intuit: QuickBooks, only if your organization connects it.
  • HubSpot: our customer list, for people who sign up as design partners or write to us.

Each one handles information only to do its part. We'll update this list before adding anyone new.

How long we keep things

  • Workspace records: while your organization's account is open. After it closes, we delete them within 90 days, and our backups roll off within the following 90 days.
  • Change history: kept with the records it describes.
  • Billing records: as long as tax and accounting law requires.
  • Connection fingerprints used for fair use: about an hour in the app, a day on this website.
  • Soyo's safety records: 90 days. Soyo's short-lived suggestion notes: 7 to 180 days, then deleted.

Your choices

Anyone can ask us to show, correct, export or delete their personal information by writing to hello@allayapp.com. Organization owners can download their reports in the app, and can ask us for a full export or to close their account. Some history may need to stay with your organization's records for grant compliance; if a request affects that, we'll explain before acting. Depending on where you live, you may have more rights under local law, and we'll honor them.

Keeping it safe

Data is encrypted on its way to and from Allay. Accounting access is encrypted where it's stored, and sign-in sessions are kept only as one-way fingerprints. We limit how fast requests can come in and record every change. No system is perfectly secure; if a breach affects you, we'll tell you as the law requires.

Children

Allay is for organizations and the adults who work with them. It isn't meant for children under 16.

Changes

When this page changes we'll update the date above. For important changes, we'll tell workspace owners in the app before they take effect.