Privacy Policy
Last updated: 2026-07-09
The short version
Wallekan works without an account. We store only what's needed to run your groups, and the parts that identify people — member names, expense labels and notes — are end-to-end encrypted before they reach our servers. We don't sell your data or run ad trackers.
What we collect
To run a shared expense tracker, we store:
- Group data — a random share token that addresses the group, plus expense amounts, currencies, dates and split shares used to compute balances.
- Encrypted fields — member names, expense labels and notes are encrypted in your browser; we store only ciphertext we cannot read.
- Push subscriptions — if you opt in to notifications, the browser-issued push endpoint is stored so we can deliver alerts.
What we don't collect
- No accounts, passwords, emails or phone numbers are required.
- No advertising identifiers and no third-party ad or analytics trackers.
- No selling or renting of your data to anyone.
How your data is protected
Identifying content is encrypted in your browser with AES-256-GCM. The key is derived from your group's share link, so anyone without the link — including us — sees only ciphertext.
Because the share link is effectively the key to the group, treat it like a password and share it only with people you trust. Traffic is served over HTTPS, with a strict Content-Security-Policy and other hardening headers.
Cookies & local storage
Wallekan uses no tracking cookies. Your browser's local storage keeps small conveniences on your device — your theme, language, and recently opened groups. This data is not sent to us.
Third-party services
- Supabase — hosts the database and API storing group and expense data.
- Frankfurter — a currency exchange-rate API; only currency codes are sent, no personal data.
- Web Push services — if you enable notifications, your browser’s push provider delivers them.
Data retention & deletion
Group data persists so you can return via the share link. You can delete a group from its settings, removing its expenses and related data. Disabling notifications removes the stored push subscription.
Children
Wallekan is for general audiences and not directed at children under 13. We do not knowingly collect personal information from children.
Changes to this policy
We may update this policy as the app evolves. Material changes will appear here with a new date.
Contact
Questions about privacy? Send us a message through the feedback form.