Privacy policy

The controller responsible for processing your data is WalletCalm.

WalletCalm is an online-only business: we have no shop or public office, and we're reached by e-mail.

E-mail: support@walletcalm.com. Write to this address about anything concerning your data.

Your accounts, transactions, budgets, goals, investments, plans, receipts and backups are encrypted in your browser, with keys only you hold, before they reach us. We store them only as ciphertext and can't read them. What we can see is how many encrypted records of each type you have, how large they are and when they changed.

Your password never reaches us either: sign-in uses the OPAQUE protocol, so the server stores only a record that lets it check your password without learning it.

When you open walletcalm.com, your browser sends technical data with every request: your IP address, the date and time, the address requested, the referring page and your browser's user agent. Our hosting provider Cloudflare needs it to deliver the pages and to protect them against attacks (for example with its firewall). The server's request logs (time, address requested, status, error messages) are kept by Cloudflare for a few days.

There are no analytics, no tracking pixels, no advertising and no third-party scripts on walletcalm.com. Fonts and images are served by us.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a website that works and is secure.

To create an account we need your e-mail address and a password, which never reaches us (see section 2). A display name is optional. We also store your plan, settings that aren't financial (such as theme, time zone and the first day of your week), when the account was created, and your sign-in sessions: when each started and was last used, and the browser's user agent, so you can recognise your devices.

If you share a household, we store its name, its members (e-mail address and display name) and their roles; the other members see them too.

Legal basis: Art. 6(1)(b) GDPR (providing the service you signed up for).

To protect accounts against password guessing and abuse, we count requests per IP address, per e-mail address or per account for a short time (for example sign-in attempts in 15 minutes). The counters store only a shortened cryptographic hash, not the address itself, and are deleted after 24 hours at the latest.

Password reset links and household invitations are single-use, are stored only as hashes and expire: a reset link after 30 minutes.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is keeping your account and the service secure.

We send e-mails only when your account needs them: password resets and household invitations you ask for. In Settings you can also turn on reminders by e-mail or as push notifications (a weekly recap and a reminder the day before a bill is due). They contain fixed texts only, never names, amounts or counts from your budget; for bill reminders your browser tells us just the date of the next bill.

WalletCalm's e-mails are sent through Cloudflare's Email Service or through Resend (resend.com, USA). It receives the recipient's address and the e-mail itself (a link or a fixed text).

If you turn on push notifications, your browser gives us a push address at its maker's push service (for example Google, Mozilla, Microsoft or Apple). Our pushes carry no content: your device then asks us which fixed message to show. We keep the push address until you turn notifications off or remove the device.

Legal basis: Art. 6(1)(b) GDPR for account e-mails and reminders you turn on; for push notifications, your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time by turning them off.

If you write to support@walletcalm.com, we use your e-mail address and your message to answer you. E-mails to walletcalm.com addresses are received by Cloudflare (Email Routing) and forwarded to our mailbox.

Legal basis: Art. 6(1)(b) GDPR where your message concerns your account or a purchase, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering you).

Pro is sold by Paddle.com Market Ltd (London, United Kingdom), our merchant of record. The checkout page, pay.walletcalm.com, loads Paddle's checkout, and you enter your payment and billing details directly with Paddle. Paddle processes them as an independent controller under its own privacy policy (https://www.paddle.com/legal/privacy).

We give Paddle your e-mail address and an internal account ID so the payment can be matched to your account. Paddle tells us your subscription's status: subscription and customer IDs, monthly or yearly, the status and its dates (renewal, end, trial). We never receive your card details, and Paddle never receives your financial data.

Legal basis: Art. 6(1)(b) GDPR (the subscription contract).

Once a day our server downloads price lists for whole stock exchanges from EOD Historical Data (EODHD, eodhd.com) and the euro reference rates from the European Central Bank. These requests contain no personal data: they're never about anyone's holdings, and every user's browser downloads the same price file. EODHD and the ECB receive no data about you.

If you open the demo, we create a temporary account with fictional data, without an e-mail address or password. It's deleted automatically, with everything in it, after 24 hours. How often a demo can be started is limited per IP address (see section 5).

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is letting you try WalletCalm without signing up.

We store information on your device only where it's strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG). That's why there's no consent banner: nothing is used for tracking or shared with anyone.

A session cookie (__Host-sb_session) keeps you signed in. It's HttpOnly, Secure and bound to walletcalm.com, and it expires after 30 days at the latest, or after 7 days without use.

Your browser's local storage and IndexedDB hold your theme, view preferences (such as columns and sort order), an encrypted copy of your data for fast and offline use and, only if you choose to stay unlocked on a device, the key that keeps it unlocked. A service worker stores the app's files so it also loads offline. Signing out deletes the encrypted copy; clearing your browser's site data removes everything.

Push notifications use your device only after you allow them in your browser. The checkout page (pay.walletcalm.com) loads Paddle's script, which may store data needed for the payment; that happens only when you open the checkout to buy Pro.

Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) runs our hosting: the website, the app and the API (Cloudflare Workers), the database (D1), the storage for encrypted receipts and backups (R2), protection against attacks, and the receiving of e-mails to walletcalm.com addresses (Email Routing). Cloudflare processes data on our behalf under a data processing agreement (Art. 28 GDPR).

WalletCalm's e-mails are sent through Cloudflare's Email Service or through Resend (resend.com, USA). It processes data on our behalf under a data processing agreement.

Paddle (section 8) is an independent controller for payments. Push services are chosen by your browser, not by us (section 6). EODHD and the ECB receive no personal data (section 9).

We don't sell data and don't pass it to anyone else, unless the law requires it (for example a court order).

Cloudflare processes data in its worldwide network, including in the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has decided that it ensures an adequate level of protection (Art. 45 GDPR); in addition, the EU standard contractual clauses in Cloudflare's data processing agreement apply (Art. 46(2)(c) GDPR).

If e-mails are sent through Resend, the data is processed in the USA on the basis of the EU standard contractual clauses (Art. 46(2)(c) GDPR). Paddle is based in the United Kingdom, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR).

Your account and everything in it, until you delete the account in Settings. Deleting it removes the account, its encrypted records, receipts and backups at once; records you added to a shared household stay with the household. Of the encrypted monthly backups, only the last 12 are kept.

Sign-in sessions: a session ends after 7 days without use and after 30 days at the latest; its record is deleted within an hour of those 30 days, and at once when you sign out. Rate-limit counters: 24 hours at the latest. Reset links: removed within an hour of being used or expiring. Household invitations: 30 days after they were used, revoked or expired. Demo accounts: 24 hours.

Deleted data can remain in the database's point-in-time recovery (Cloudflare D1 Time Travel) for up to 30 days before it's gone for good. E-mails you send us are kept as long as we need them to deal with your request, or longer where commercial or tax law requires it. Paddle keeps payment records under its own policy and the law that applies to it.

You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). Where we rely on your consent, you can withdraw it at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f)), you can object at any time on grounds relating to your particular situation.

Much of this you can do yourself in Settings: export your data as CSV, change your name or e-mail address, or delete your account. For everything else, write to support@walletcalm.com. Because your financial data is encrypted, only you can see its content; we can tell you everything else we store about you.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live, where you work or where you think the infringement took place.

No law requires you to give us data, but without an e-mail address and a password you can't create an account (the demo works without). We don't make automated decisions about you or create profiles (Art. 22 GDPR).

We update this policy when WalletCalm changes; the date at the top shows the last change.