Privacy Policy

The short version

Wallekan works without an account. We store only what's needed to run your groups, and the parts that identify people — member names, expense labels and notes — are end-to-end encrypted before they reach our servers. We don't sell your data or run ad trackers.

What we collect

To run a shared expense tracker, we store:

• Group data — a random share token that addresses the group, plus expense amounts, currencies, dates and split shares used to compute balances.
• Encrypted fields — member names, expense labels and notes are encrypted in your browser; we store only ciphertext we cannot read.
• Push subscriptions — if you opt in to notifications, the browser-issued push endpoint is stored so we can deliver alerts.

What we don't collect

• No accounts, passwords, emails or phone numbers are required.
• No advertising identifiers and no third-party ad or analytics trackers.
• No selling or renting of your data to anyone.

How your data is protected

Identifying content is encrypted in your browser with AES-256-GCM. The key is derived from your group's share link, so anyone without the link — including us — sees only ciphertext.

Because the share link is effectively the key to the group, treat it like a password and share it only with people you trust. Traffic is served over HTTPS, with a strict Content-Security-Policy and other hardening headers.

Cookies & local storage

Wallekan uses no tracking cookies. Your browser's local storage keeps small conveniences on your device — your theme, language, and recently opened groups. This data is not sent to us.

Third-party services

• Supabase — hosts the database and API storing group and expense data.
• Frankfurter — a currency exchange-rate API; only currency codes are sent, no personal data.
• Web Push services — if you enable notifications, your browser’s push provider delivers them.
• Stripe — processes the optional one-time premium payment. Card details are entered on Stripe and never reach our servers.
• Upstash (Redis) — powers rate limiting that protects the service; it briefly holds a key derived from your IP address.
• Resend — delivers messages you send through the feedback form to our inbox, including any reply address you provide.
• Vercel & Cloudflare — host and serve the app; like any web host they process your IP address and approximate location to deliver and protect it.

Data retention & deletion

Group data persists so you can return via the share link. You can delete a group from its settings, removing its expenses and related data. Disabling notifications removes the stored push subscription.

To keep the free service sustainable, groups on the free tier with no activity for about 90 days are deleted automatically, along with their expenses and related data. Groups upgraded to premium are kept until you delete them.

Your rights

Because Wallekan has no accounts, your data is tied to holding a group’s share link rather than to an identity we can look up. Anyone with the link can view, correct, export (via “Copy as text”), or delete that group’s data directly in the app.

Subject to your local laws, you may have the right to access, correct, delete, or port your personal data and to object to certain processing. To make a request or ask a question, contact us through the feedback form; since we cannot identify you from an account, we may need the relevant share link to act on it.

Children

Wallekan is for general audiences and not directed at children under 13. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy as the app evolves. Material changes will appear here with a new date.

Contact

Questions about privacy? Send us a message through the feedback form.