Privacy Policy

Who we are

This policy describes how Wallexa ("Wallexa", "we", "us", "our") collects, uses, and shares personal information when you use the Wallexa mobile application or related services (the "Service"). It applies to everyone who creates an account or interacts with the Service.

The operator responsible for this processing is Ans Mahmood. Privacy questions and requests: ans991998@gmail.com.

What we collect

Information you give us directly

• Account information: identifiers and profile details supplied through Google, Apple, email/password, or phone sign-in when available, plus your chosen name, username, profile photo, currency, and phone number. Supabase handles authentication and password hashing.
• Expense and wallet data: amounts, descriptions, currencies, dates, splits, participants, groups, income, wallet accounts, ledger transfers, saved recipients, payment-method labels, and scheduled entries you choose to save. Do not enter payment-card security codes or banking passwords.
• Historical voice recordings and transcripts: earlier releases used Google Gemini for transcription. New AI voice processing is disabled. Existing recordings associated with expenses remain subject to the deletion controls below.
• Friend graph: the people you add as friends and the groups you belong to.
• Group chat: messages and selected images you share with a group.
• Saved contacts: names, phone numbers, and email addresses you manually add so you can split expenses, match existing Wallexa users, and send invitations.
• Safety reports: report type, subject, details, and optional related group, expense, or user identifiers when you flag content, AI output, a user, a group, or an account safety issue.
• Support correspondence: if you contact us, we keep your messages and any information you include.

Information we collect automatically

• Technical data: infrastructure providers process IP addresses, request timestamps, authentication events, and error information to operate and protect the service. The app uses device capabilities, locale, and permission state for its features. Biometric templates remain with your operating system; Wallexa receives only the local authentication result.
• Crash and error logs: technical information about errors so we can fix bugs. We try to scrub personal data from these logs.

The website uses essential session cookies for sign-in. The mobile app stores authentication data using operating-system secure storage. Typed navigation commands are interpreted locally. Permission controls and signing out are available in the app or device settings.

Things we do not collect

• We do not collect precise location.
• New voice recording and AI processing are disabled in this release.
• We do not run third-party advertising or marketing trackers in the app.
• We do not sell your personal information.

How we use the information

We process the information described above to:

• Provide the Service: authenticate you, store your expenses, and sync data across your devices.
• Help you find people you already know on Wallexa (contact matching).
• Communicate with you about service updates and important account or security notices.
• Detect, prevent, and fix bugs, abuse, fraud, and security issues.
• Review safety reports, moderate objectionable content, respond to blocking requests, and enforce our Terms.
• Comply with legal obligations.

Wallexa does not train general-purpose AI models with your data or share it with advertisers. Historical processing by an AI provider was governed by that provider’s terms and account configuration, as explained below.

Voice processing and AI

Voice processing is temporarily disabled. Earlier releases sent recordings and relevant friend names, group names, and currency context to Google Gemini for transcription and expense extraction. The current release does not send new recordings to Gemini.

• Earlier releases transmitted audio over an encrypted connection (TLS).
• Google’s Gemini API terms distinguish paid and unpaid service data use. We cannot promise that all historical requests qualified for paid-service protections. Google describes its processing at https://ai.google.dev/gemini-api/terms. Contact support with questions about historical processing.
• Historical audio, where still stored, may remain linked to an earlier expense. Voice processing is currently disabled. Delete the related expense or contact support to request removal.

You can continue entering expenses manually while voice processing is unavailable.

Who we share information with

We share personal information only as described below.

Service providers

• Supabase — authentication, database, file storage.
• Google (Gemini) — historical voice transcription; new processing is disabled.
• Vercel — website hosting and essential request logs.
• Google Play — subscription billing and purchase verification; Wallexa retains verification identifiers and a purchase-token hash.
• Twilio — SMS authentication when enabled.

Providers process data under their applicable terms, privacy notices, and data-processing arrangements. Some also process account, security, or billing data for their own service operations.

Other Wallexa users you choose to interact with

When you add someone as a friend or include them in an expense or group, the relevant information (your name, profile photo, the expenses you share) becomes visible to them. Removing a friendship or leaving a group does not retroactively delete records of past shared expenses.

Shared links and photos

An administrator can create an expiring read-only group link. Anyone with that link can view the included group and expense summary without signing in. Treat the link as private and share it only with intended recipients. Profile photos are served from a public storage bucket and may be accessible to someone with the photo URL; do not use sensitive images as profile photos.

Legal and safety

We may disclose information when required by law, legal process, or government request, or where we believe disclosure is necessary to protect the rights, safety, or property of Wallexa, our users, or the public.

Business transfers

If Wallexa is involved in a merger, acquisition, or asset sale, your information may transfer as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Where your data is stored

Your data is stored on infrastructure operated by Supabase. Storage regions may include the United States and other countries. By using the Service, you understand that your information may be transferred to and processed in countries other than the country in which you reside, which may have different data protection laws.

International transfers require safeguards under applicable law. Contact support for the storage region and transfer arrangements relevant to your account; using the app does not waive your statutory rights.

How long we keep it

• Account and expense data: retained while your account is active.
• Voice recordings: retained as long as the corresponding expense exists. Deleting an expense deletes its recording.
• Safety reports: retained while needed to review, enforce safety rules, and document abuse-prevention decisions.
• Backups and provider logs: residual copies may remain for the configured retention period and are not used to restore a deleted account to active service. Contact support for the applicable retention schedule.
• After account deletion: successful deletion removes your sign-in account, profile, private wallet records, private expenses, authored chat and uploaded files. Shared financial amounts, shares, confirmation states and settlements remain available to the other people entitled to see them, using “Deleted user” in place of your account identity. Referenced private contacts are reduced to “Deleted contact” records without contact details. Shared groups pass to a remaining member; groups with no remaining account holder are removed. A historical label is not a sign-in account. Other people may still identify a transaction from its context or keep their own independent copies. We do not claim this is irreversible anonymization. If deletion fails, retry or contact support; the app reports success only after the deletion steps finish. Rights requests and legally required retention are assessed under applicable law.

Your rights

Depending on where you live, you may have rights to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your information ("right to erasure").
• Object to or restrict certain processing.
• Receive a portable copy of your information.
• Withdraw consent at any time, where we rely on consent.
• Lodge a complaint with your local data protection authority.

You can exercise most of these rights directly in the app:

• Edit profile: Account → profile.
• Delete an expense and its recording: open the expense → Delete.
• Delete your entire account: Account → Delete Account in the app, or use https://split-audiv-wallet.vercel.app/delete-account without reinstalling the app.

For requests we cannot fulfil in-app or through the web deletion page, email ans991998@gmail.com and we will respond within the timeframe required by applicable law.

Children's privacy

The Service is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children below that minimum age. If you believe a child has provided us with personal information, please contact us and we will delete it.

Security

We use industry-standard technical and organizational measures to protect your information, including:

• TLS encryption for data in transit.
• Encryption at rest for data stored by our infrastructure providers.
• Row-level security policies that restrict access according to ownership and authorized sharing.
• Administrative access controls and provider security logging where configured.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you in the app or by email before they take effect, and we will update the "Last updated" date above.

Contact

Questions, requests, or complaints about this policy? Email ans991998@gmail.com.