1. What Data We Collect
You provide directly
- Google account email and user ID (Google Sign-In)
- Apple user ID, email, and name (Apple Sign-In on iOS)
- Profile names you create
- Financial records: transactions, categories, wallets, balances (fiat and cryptocurrency)
- Optional AI content: questions you send to Wally and the minimum financial context needed to answer them
- Optional receipt images: a photo you explicitly take or select for one-time receipt recognition
- Optional ChatGPT and Claude connector: your Google account email, name, and ID, and an encrypted Google sign-in token, if you connect Wally to ChatGPT, Claude, or another AI assistant (see Section 6B)
- Optional bank import: transactions the App recognizes on your device in notifications of banking apps you connect (Android) or receives from an Apple Pay automation you create in Shortcuts (iOS): amount, currency, merchant, and date; on iOS also the card's name, used only to avoid duplicates (see Section 6C)
- App settings: language, theme, default currency
Generated automatically
- Anonymous device identifier: a random string used for sync only; not linked to your identity
- Sync metadata: timestamps, version counters
- Pseudonymous usage analytics, only if you allow them: screen views, feature interactions, and bucketed financial amount ranges (see Section 5)
- Crash and performance data, only if you allow them: stack traces and diagnostic information when errors occur (see Section 5)
We do not collect payment card numbers, banking login credentials, location data, biometric data, cryptocurrency wallet addresses, or blockchain data. The App never connects to your bank. We do not access your whole photo library. The system photo picker gives the App access only to the image you select, and receipt photos are not added to your financial database or cloud backup.
2. Legal Basis for Processing (GDPR)
- Core app functionality → performance of contract
- Firebase Authentication (Google and Apple Sign-In) → performance of contract
- Google Drive sync (optional) → your consent
- Wally AI questions and receipt recognition (optional) → your explicit consent (Art. 6(1)(a) GDPR)
- ChatGPT and Claude connector (optional) → your consent, given when you connect it and sign in with Google (Art. 6(1)(a) GDPR)
- Bank notification and Apple Pay import (optional) → your consent, given when you connect a bank or Apple Pay and turn on Notification access or create the Shortcuts automation (Art. 6(1)(a) GDPR); withdraw it at any time as described in Section 6C
- Subscriptions → performance of contract
- Firebase Analytics and Firebase Crashlytics (optional) → your consent (Art. 6(1)(a) GDPR; for storing and reading the analytics identifier on your device, Art. 5(3) of the ePrivacy Directive), asked before anything is collected; withdraw it at any time as described in Section 5
3. How We Use Your Data
To provide and operate the App; authenticate your account; sync data via Google Drive (if enabled); record and categorize, on your device, transactions from bank notifications or Apple Pay (if you turn this on); process subscriptions; monitor app stability and fix bugs; understand how features are used to improve the App; provide optional AI answers and create reviewable receipt drafts when you request them; let an AI assistant you connect (ChatGPT, Claude) read and change your records at your request; respond to support requests; and comply with legal obligations.
4. Google Drive Backup
If you enable sync, the App uses Google Sign-In and the drive.appdata scope — access limited
exclusively to the App's private folder in your Google Drive. No other Drive files are accessed.
Backup data is encrypted on-device before upload using AES-GCM with a key derived via PBKDF2 (200,000 iterations). The encryption key is automatically derived from your Google account — you do not need to remember a separate passphrase. Backups can only be decrypted by the same Google account that created them.
5. Firebase Services
Firebase Authentication
Stores your email, user ID, and auth tokens to manage sign-in. The App supports two sign-in methods:
- Google Sign-In: used on Android and iOS for authentication and Google Drive sync.
- Apple Sign-In: available on iOS only. Uses Apple’s secure credential system with Firebase as the identity provider. The App stores your Apple user ID and authorization tokens securely in the device Keychain.
Firebase Analytics
If you allow it, the App uses Firebase Analytics to collect pseudonymous usage events, including:
- Screen navigation (screen names, record types)
- Onboarding flow events (completion, currency selection, sync preferences)
- Transaction and transfer events (type, anonymised amount ranges, category)
- Wallet lifecycle events (creation, editing, deletion)
- Settings changes (currency, theme, language)
- Account events (sign-in, sign-out, deletion, profile creation)
- History interactions (search usage, sorting, date ranges)
- Bank import events (connection steps, the bank picked from our built-in list and the country, counts of imported records; see Section 6C)
Firebase assigns an anonymous app-instance identifier (a pseudonymous identifier under GDPR) to each device.
Your choice
Usage statistics and crash reports are optional, and one question covers both. The App asks before it collects anything: at the end of onboarding (on the home screen right after it, if restoring a backup ended onboarding early), or, if you set the App up before this question existed, once on the home screen after updating. Until you answer, nothing is sent: usage events wait in the App's memory and crash reports stay on your device.
- Allow: collection starts, and the events and crash reports kept while the question was open are sent.
- Don't allow (or closing the question): the kept events are discarded, the stored crash reports are deleted, and nothing is sent to Firebase.
You can change your choice at any time in Settings → Legal → Usage statistics and crash reports. Turning it off stops collection from that moment. The App records when you answered and which version of the question you saw. Analytics is never used for advertising: the advertising identifier is not collected, and Google's advertising storage, ad user data and ad personalisation signals are switched off.
Firebase Crashlytics
If you allow usage statistics and crash reports, both platforms use Firebase Crashlytics to collect crash reports, non-fatal error logs, and performance diagnostics. This data is not linked to your personal identity and is used solely for app stability monitoring and bug fixing.
Firebase is operated by Google LLC (USA). Data is subject to Google's Privacy Policy and Data Processing Terms.
6. Currency Exchange Rates
The App fetches exchange rates from two open-source services, called in parallel:
- Currency API (
cdn.jsdelivr.net/npm/@fawazahmed0/currency-apiwith fallback tocurrency-api.pages.dev) — provides rates for 149+ fiat and cryptocurrency pairs - Frankfurter API (
api.frankfurter.app) — provides fiat currency rates sourced from the European Central Bank
Frankfurter rates take priority for fiat currencies where both sources overlap. These requests contain no personal or financial data — only the base currency code (EUR). Rates are cached locally for up to 12 hours.
We have no control over these third-party services' data practices, availability, or accuracy. Exchange rates (including cryptocurrency rates) are provided for informational purposes only and do not constitute financial advice.
6A. Optional AI Features
The App offers two optional AI features: the Wally assistant and receipt recognition. These features are disabled until you see a prominent disclosure and give explicit consent. You may decline and continue using manual records, reports, wallets, and all non-AI features.
Wally assistant
When you send a question, the App may send the question, selected language, currency, category names, wallet names and balances, aggregated spending results, and limited matching transaction details such as date, amount, category, merchant or comment. The App sends only the context needed for the requested answer. Wally is clearly identified as an AI assistant.
Receipt recognition
When you choose Scan receipt, the App lets you take a photo using the system camera or select one image using the system photo picker. The image may reveal purchase history, merchant, items, date, total, currency, loyalty identifiers, or other text printed on the receipt.
Processor, retention, and training
Mistral acts as our service provider under its commercial terms and data processing agreement. We configure the service not to train models on App inputs. Under Mistral's standard API configuration, inputs and outputs may be retained for up to 30 days for abuse monitoring. If Zero Data Retention is enabled for our production workspace, the data is not retained beyond the request. We will not claim Zero Data Retention in the App unless it is active and contractually confirmed.
Do not submit identity documents or receipts containing information you do not want processed by AI. Avoid medical, religious, political, or third-party personal information where possible.
Consent and withdrawal
You can withdraw consent at any time under Settings → Legal → AI data processing. Withdrawal prevents future AI requests and does not delete financial records you previously reviewed and saved. A later AI request will ask for consent again. To ask about an earlier request or exercise your data rights, contact support@watch-my-wallet.com.
6B. ChatGPT and Claude Connector
You can connect Wally: Budget Tracker to ChatGPT, Claude (including Claude Code), or another AI assistant that supports the Model Context Protocol, and then ask about your spending or add, edit, and delete records in the chat. The connector is optional and off until you add it in the assistant and sign in with Google there. It works with the data you sync to Google Drive; you do not need the App to start, as the connector can create your account in Google Drive.
How it works
Our connector service runs on Google Cloud (Firebase) in the EU (Belgium). With the drive.appdata
scope it reads and writes the same encrypted backup in your Google Drive's private App folder as the App does, acting as one
more synced device. The backup is decrypted only in memory while a request runs. Your financial data is not stored on our
servers and is not written to our logs.
The connector is for bookkeeping only: it records expenses, income, and transfers between your own wallets in your budget. It never moves money, makes payments, or connects to your bank accounts.
What we store
We keep the following in Google Cloud Firestore in the EU (Belgium):
- Your Google account email, name, and account ID, and when you last used the connector
- A Google sign-in (refresh) token, encrypted with a server key, so the connector can reach your Drive
- The sign-in tokens we issue to the assistant, stored only as one-way hashes, and the assistant's registration
- A daily count of your requests (limited to 500 a day)
- For about a minute, the result of your last change, encrypted, so a repeated request does not add records twice
Our server logs record technical events with your email address masked, never amounts, comments, or record contents.
We do not sell connector data, use it for advertising, or use it to train AI models.
What the AI assistant receives
Our connector does not receive or store your chat messages. It gets only the details the assistant sends for a request, such as the amount, date, category, and comment of a record.
When you ask a question or give an instruction, the assistant (operated by OpenAI for ChatGPT or Anthropic for Claude) sends a request to our connector and receives the result: for example, category and wallet names, balances, totals, and matching records with their date, amount, category, wallet, and comment. The assistant provider processes this data as part of your conversation under its own terms and privacy policy, which you accepted when you started using that assistant; we do not control how it stores or uses your conversations. Send only what you want the assistant to see.
Disconnecting
Remove the connector in your assistant's settings (in ChatGPT among its apps, in Claude under Connectors). To revoke its Google access, remove Wally at myaccount.google.com/permissions; this also stops the App's Google Drive sync until you sign in again. When the connector notices revoked access or a deleted App account, it deletes your stored sign-in. It also deletes the stored sign-in automatically when the connector has not been used for 90 days; you then sign in again the next time. To have it deleted right away, contact support@watch-my-wallet.com.
Reporting a security issue
To report a security issue in the connector, email support@watch-my-wallet.com.
6C. Bank Notifications and Apple Pay
The App can record your bank transactions for you. This is optional and off until you connect a bank or Apple Pay in the App. Everything happens on your device: we receive no notification text, transactions, or merchants, and no AI is involved. The App never connects to your bank, never asks for banking logins, and cannot move money.
Android: bank notifications
You choose your banking app and a wallet, then allow Wally Notification access in Android settings. Android then passes notifications from all apps to Wally, which handles them like this:
- Banking apps you connect: Wally reads the notification's title and text on your device (including notifications still shown when you connect) and recognizes the amount, currency, and merchant, or the sender for money received. Codes, declined or upcoming payments, and other messages that are not a completed transaction are skipped.
- Other apps: Wally only checks, in memory, whether a notification names an amount with a currency. If it does, Wally remembers that app's name and package name on your device for 30 days, so it can offer the app in the bank list; the text is not kept. Mail, SMS, and chat apps, and banking apps you have not connected, are ignored.
Apart from the details saved below, notification text is not stored, logged, or sent off your device.
iOS: Apple Pay
Wally cannot read Apple Pay or Apple Wallet by itself. You create a Transaction automation in the Shortcuts app; each time you pay with Apple Pay, it passes three fields to Wally: the amount with its currency, the merchant name, and the card's name. Wally saves the payment as an expense on your iPhone, even while the App is closed. It never receives card numbers or bank account details.
What is saved
Each transaction becomes an ordinary record in the wallet you chose, with:
- the amount and currency (converted to the wallet's currency with cached exchange rates, keeping the original)
- the merchant as the record's comment, or, when a notification names none, the short line around the amount as your bank wrote it
- the date: when the notification arrived, or when Wally received the Apple Pay payment
- a one-way hash of the transaction's details, so the same transaction is never added twice; the iOS card name is used only in this hash and is not stored in readable form
- a simplified merchant name used to pick the category
Wally also saves each connection: the banking app's name and identifier (or Apple Pay), the country you chose, its wallet, the time of the last imported transaction, and the anonymous device identifier (Section 9) of the phone that imports.
Categories
Categories are picked on your device, first from your own earlier choices (change the category of a merchant's purchase once and the merchant's next purchases follow), then from a built-in list of shops. Nothing is sent to us or to an AI service.
Where it is stored
Analytics
Firebase Analytics (Section 5) receives only events about using this feature: the steps of connecting, which bank from our built-in list you picked (its app identifier, or Apple Pay) and the country chosen in the list, the connection type, how many records an import added and what share your choices or the built-in list categorized, undo, disconnecting, and lost notification access. An app detected on your phone is reported only as "detected". Notification text, amounts, merchants, and card names are never sent.
Your control
- Undo one import: on Android, tap Undo on the notification Wally shows after each import; on any device, delete the record in the App.
- Stop importing (withdraw consent): disconnect the bank or Apple Pay in the wallet's Bank section, turn off Notification access for Wally in Android settings, or turn off the automation in Shortcuts.
Stopping keeps the wallet and the records already imported; you can delete them in the App like any other record.
7. Subscriptions and Billing
On Android, payments are handled by Google Play; on iOS, by the Apple App Store. We receive only subscription status and a transaction identifier — never payment card details. Subscription status may be stored via Firebase services to verify entitlement across devices.
Payment processing is subject to Google's Privacy Policy (Android) and Apple's Privacy Policy (iOS).
8. Data Sharing
We do not sell your personally identifiable financial data.
We share data with service providers (Google LLC, Apple Inc., and Mistral AI SAS) only as necessary to operate the feature you request and under applicable data processing terms.
For optional AI features, Mistral processes receipt images, questions, and limited financial context solely to return the requested recognition result or answer (see Section 6A). This is a user-initiated transfer based on explicit consent. We do not sell this data, use it for advertising, or permit cross-app tracking.
If you connect Wally to ChatGPT or Claude, the records and totals you ask about are sent to the assistant you chose (OpenAI or Anthropic) at your request, and that provider processes them as part of your conversation (see Section 6B).
Transactions imported from bank notifications or Apple Pay are processed on your device and are not sent to us or shared with anyone; like your other records, they reach only your own Google Drive backup and, if you connect one, your AI assistant (see Section 6C).
We may share or license Aggregated Data — aggregated, de-identified information that cannot identify any individual — with third parties, including for commercial purposes. Aggregated Data is not personal data under GDPR.
We may disclose data if required by law, court order, or to protect our rights or user safety. In a merger or acquisition, data may be transferred with prior notice.
9. Device Identifier
The App generates a persistent anonymous device ID stored locally. It is used only for sync operations, is not shared with advertisers, and is reset when you clear App data or reinstall.
10. Apple Platform Disclosures
App Tracking Transparency
The App does not track users across other companies' apps or websites. No Identifier for Advertisers (IDFA) is collected. No tracking domains are configured. The App does not request App Tracking Transparency permission because no cross-app tracking occurs.
Background App Refresh
The iOS version uses Background App Refresh to sync financial data with Google Drive when you have sync enabled. No data is sent to third parties during background refresh — only encrypted backup operations with your Google Drive.
Shortcuts and Apple Pay
If you set up Apple Pay import, the Shortcuts automation you create runs Wally's Log Transaction action after each Apple Pay payment. Wally receives only the amount, merchant, and card name that the automation passes, saves the expense on your iPhone, and sends nothing to us (see Section 6C).
Privacy Nutrition Labels
In accordance with Apple's App Store requirements, the following data is declared:
| Data Type | Linked to Identity | Used for Tracking | Purpose |
|---|---|---|---|
| Email Address | Yes | No | App Functionality |
| Name | Yes | No | App Functionality |
| User ID | Yes | No | App Functionality |
| Device ID | No | No | Analytics (app-instance identifier, only if you allow usage statistics) |
| Product Interaction | No | No | Analytics (only if you allow usage statistics) |
| Purchase History | No | No | Analytics (bucketed amount range and built-in category of a saved record, only if you allow usage statistics) |
| Other Financial Info | No | No | Analytics (the bank picked from the built-in list and its country, only if you allow usage statistics) |
| Coarse Location | No | No | Analytics (country and city derived by Firebase from the IP address, only if you allow usage statistics) |
| Crash Data | No | No | Analytics (only if you allow crash reports) |
| Other Diagnostic Data | No | No | Analytics (only if you allow crash reports) |
Third-Party SDK Data Collection
The App integrates Google Sign-In SDK, Apple Sign-In (AuthenticationServices), Firebase services, and an authenticated backend that calls Mistral AI for optional AI features. Google Sign-In SDK may independently collect additional data types as declared in its own privacy manifest, including device identifiers and coarse location. This collection is governed by Google's Privacy Policy and is not controlled by us. Apple Sign-In is handled natively by iOS using Apple’s AuthenticationServices framework; data processing is governed by Apple's Privacy Policy. The App itself does not request device location or phone number data; if you allow usage statistics, Firebase Analytics derives an approximate location (country and city) from the IP address.
11. Data Retention
- Local financial data: until you delete it or uninstall
- Google Drive backup: until you delete your account or revoke Google access
- Firebase Auth records: until account deletion
- Firebase Analytics data: 14 months (Google default retention)
- Firebase Crashlytics data: 90 days (Google default retention)
- Receipt photos: not stored by the App or its Firebase backend; processed in memory for the request
- Wally inputs and AI outputs: not stored by our backend; conversation history remains in App memory for the active chat
- Mistral AI processing: up to 30 days for abuse monitoring under the standard API configuration, or no post-response retention when contractually confirmed Zero Data Retention is active
- ChatGPT and Claude connector sign-in (email, name, encrypted Google token): until you revoke Google access, delete your App account, or ask us to delete it, and deleted automatically after 90 days without use; tokens we issue to the assistant also expire after 90 days without use
- Connector request counters and retry results: deleted automatically within a few days
- Conversations in ChatGPT or Claude: kept by OpenAI or Anthropic under their own policies
- Imported bank and Apple Pay transactions and connections: like your other records, on your device and, if sync is enabled, in your encrypted Google Drive backup; never on our servers
- Apps detected on Android (app name and package name only): on that phone, removed 30 days after the app last showed an amount
Upon account deletion we remove your personal data within 30 days, subject to legal obligations.
12. Your Rights (GDPR)
If you are in the EEA or UK, you may:
- access, correct, or delete your data
- restrict or object to processing
- receive your data in portable format
- withdraw consent at any time
- lodge a complaint with your data protection authority (Latvia: dvi.gov.lv)
Withdrawing AI consent in Settings stops future transmission to Mistral. For access or deletion requests relating to an AI request that may still be within the processor retention window, contact us using the address below and provide the approximate request date; do not email a copy of the receipt unless requested.
To exercise rights: support@watch-my-wallet.com — we respond within 30 days.
13. How to Delete Your Data
- Delete your account: Settings → Delete Account. This permanently removes your Firebase account, revokes authentication tokens (Google or Apple), erases all cloud backup data, and deletes all local data from the device.
- Delete without an account: If you use the App without signing in, go to Settings → Delete All Data & Reset. This removes all local data and resets the App.
- Without the App: email support@watch-my-wallet.com from the email address of your Google or Apple account and ask us to delete your account. We delete your Firebase account within 30 days. Your encrypted backup is in your own Google Drive: remove it under Google Drive → Settings → Manage apps → Wally → Delete hidden app data.
- Stop bank import: open the wallet → Bank section → Disconnect, or turn off Notification access for Wally in Android settings; on iOS, also turn off the automation in Shortcuts. Imported records stay in the App until you delete them (see Section 6C)
- Stop sync: Settings → tap the Google Drive section → Sign out
- Disconnect ChatGPT or Claude: remove the Wally connector in the assistant's settings and, to revoke its Google access, at myaccount.google.com/permissions (see Section 6B)
- Revoke Google access: myaccount.google.com/permissions
- Revoke Apple access: iOS Settings → [your name] → Sign-In & Security → Sign in with Apple → Wally → Stop Using Apple ID
- Local data: clear App data in system settings or uninstall
Account deletion is irreversible. All data is deleted immediately from the device and within 30 days from Firebase servers.
14. California Residents (CCPA)
You may request information about data collected, request deletion, and opt out of any sale of personal data. Aggregated, de-identified data that cannot be linked to you is not considered a "sale" under CCPA. To exercise CCPA rights: support@watch-my-wallet.com.
15. International Transfers
Your data may be processed in the United States (Google/Firebase infrastructure) and other jurisdictions where Apple operates. Optional AI requests are processed by Mistral AI SAS, headquartered in France. Where a service provider or subprocessor processes data outside the EEA, transfers rely on an adequacy decision or Standard Contractual Clauses and supplementary safeguards, as applicable.
If you connect Wally to ChatGPT or Claude, the data you ask about is sent at your request to OpenAI or Anthropic, which may process it in the United States under their own terms.
16. Security
All data in transit is protected via HTTPS/TLS. Google Drive backups are encrypted on-device using AES-GCM before upload. Auth tokens are stored in encrypted device storage (Keychain on iOS, EncryptedSharedPreferences on Android). Receipt images are size-limited, re-encoded on-device, handled in memory by the backend, and excluded from application logs, analytics, crash reports, Room, Firebase Storage, and Google Drive backup. The text of bank notifications is processed on your device and is never written to logs or sent to us. No method of storage or transmission is 100% secure.
17. Children
The App is not directed to children under 16. We do not knowingly collect data from children. Contact us if you believe a child has provided data.
18. Changes to This Policy
We will update the "Last updated" date above for any changes. Material changes will be notified within the App or by email. Continued use after changes constitutes acceptance.