Privacy Policy

Last updated: 19 June 2026. WealthS is designed so your financial data has nowhere to leak to.

In short: your money data lives on your device. We don't run ads, we don't sell data, and we don't embed third-party trackers. The only personal data we store on a server is the minimum needed for a few optional features — splitting expenses with other people, syncing across your own devices, and answering your support messages — and even then we never store your contacts' phone numbers (only one-way hashes), and we can't read your synced ledger, your sync key, or your backups.

1. Data that stays on your device

Your financial ledger — accounts, balances, transactions, investments, commodities, real estate, loans, categories and notes — is stored in a local database on your device. It is never uploaded to our servers. The app works fully offline. If you uninstall the app without making a backup, this data is gone.

2. Data we store on a server (Splits, cross-device sync & in-app support)

If — and only if — you choose to use Splits to share expenses with other people, you sign in with your phone number (one-time password). For that feature we store:

  • Your own profile: your name and phone number, which you provide at sign-in.
  • The shared split data itself: groups, expenses, shares and settlements needed to sync between the people in a group.

The phone numbers of other people you add to a split are never stored on our server in readable form. Each number is converted to a one-way cryptographic hash (a "blinded token") using a secret key held only on our server: the number is sent to the server, hashed, and the plaintext is immediately discarded — only the hash is stored and synced, so the server can match people without ever retaining their plaintext number. The name you give a person when you add them to a shared group is stored so it can appear (instead of a generic "Member") on the devices of the other people in that same group — it is visible only to that group's members, never publicly. The optional "Match contact names" feature (off by default) compares these hashes against your phone's contacts: to do that, your contacts' numbers are sent to our server only to be hashed and are never stored, and your contact list itself is never saved.

Cross-device sync (optional). You can sync your full ledger across your own devices. The ledger itself never travels through our servers — an end-to-end-encrypted copy moves directly device-to-device over your local network, through your own Dropbox, or via a file you share yourself. To let your devices find and trust each other, we store on our server, under your account: a short label, platform and app version for each of your registered devices, each device's public key, and small "sealed envelopes" that pass your encryption key securely from one of your own devices to another. Those envelopes are encrypted to a specific device — our server cannot open them, and we never see your encryption key or any of your synced financial data.

Inviting people to a split. When you add someone who isn't on WealthS yet, you can tap "Invite on WhatsApp". This opens WhatsApp (or your device's share sheet) with a pre-filled message containing a download link — you choose whether to send it. The invitee's number and message are then handled by WhatsApp under its own privacy policy; we don't send the invite for you and store nothing extra about it.

In-app support (Help & Assistant). Searching the in-app help articles happens entirely on your device and sends nothing. If you use the feature to message our team about an issue or suggestion, those messages — plus an optional email address you may add so we can reply — are stored on the same Supabase server so our team can read and respond. We attach a random, support-only reference (not your device identifier, not linked to any other feature) so you can see replies on this device; your financial data is never attached, and there is no AI processing of your messages. Support messages are not shared with anyone outside the infrastructure that hosts the feature, are never used for advertising, and are deleted when you delete your account (§9). You can also email us directly at wealths@singlemonkey.com.

3. What we do not collect

  • No advertising identifiers, no ad networks, no behavioural tracking SDKs.
  • No selling or renting of personal data to anyone.
  • No access to your bank logins. Broker import (below) uses your own API key.

4. Broker connection (optional)

If you connect Zerodha Kite to import your portfolio, you provide your own Kite API key and secret. These credentials and the resulting access token are stored on your device (in the platform's secure storage on mobile, or your browser's storage on web). The exchange and portfolio fetches happen directly between your device and the broker. We do not store your broker credentials or portfolio on our servers.

5. Service providers

To deliver Splits sync and sign-in we use:

  • Supabase — database, authentication and real-time sync hosting for the Splits data described above.
  • Twilio — to deliver the one-time password (OTP) SMS for phone sign-in.
  • Expo Push Service (exp.host) — delivers the notifications described in §6 (for example, activity in a split group). It receives an opaque device push token and the notification's title, body and in-app link; it does not receive your name, phone number, or any financial data.

These providers process only the data necessary for those functions.

For optional live-price features the app may also query the following keyless public market-data endpoints, sending only the symbol or code that you have stored on your device (no account, no cookies, no personal data):

  • open.er-api.com — currency exchange rates (currency codes).
  • api.gold-api.com and Yahoo Finance (query1.finance.yahoo.com) — gold and silver spot prices (symbols XAU, XAG) and stock / non-INR mutual-fund prices (tickers).
  • AMFI India (amfiindia.com) and api.mfapi.in — Indian mutual-fund NAVs (numeric scheme codes).

These calls send only the symbol / code plus standard HTTP headers; we do not attach any cookies, auth tokens, device identifiers, or other personal data.

To let you know when an app update is available or required, the app also asks our own server for the minimum and latest supported version, sending only your platform (iOS / Android) and the installed app-version number — with no account, cookies, identifiers, or other personal data. Nothing about this check is stored.

If you choose to back up to Dropbox (see §7), the app communicates directly with Dropbox using your account. We do not see or store your Dropbox credentials. If you connect Zerodha Kite (see §4), the app communicates directly with Kite using your API key. We do not see or store your broker credentials.

6. Notifications

With your permission, the app sends notifications — for example a chit-fund payment due, a bond maturity, or activity in a split group. You can revoke this permission at any time in your device settings. Cross-user notifications (such as split-group activity) are delivered through the Expo Push Service (§5); to route them we store an opaque push token for each of your devices, which is removed when you sign out or delete your account.

7. Backups

You can create an encrypted backup of your local ledger and either save it to your own Dropbox (under the app folder /Apps/WealthS/backups/) or hand it to your device's share sheet to send wherever you like (email, file storage, AirDrop, etc.). The backup file itself is end-to-end encrypted with XChaCha20-Poly1305 before it leaves your device.

The 32-byte symmetric encryption key is per-user, generated server-side on first use, and stored on Supabase under your account (table user_backup_keys, RLS-locked to your auth.uid()). This server-escrowed-key model means that signing in with the same phone number on a new device lets you restore an old backup without you having to remember a password. The trade-off: we (and Supabase) hold the key; you alone hold the encrypted data file. Neither party alone can read a backup.

If you'd rather not have the key escrowed, simply don't use the Backup feature — the rest of the app does not depend on it. When you delete your account (§9), the backup key is removed and any existing backup files become permanently undecryptable.

8. Your choices & rights

  • Use the entire core app without ever creating an account.
  • Sign out at any time from Settings → PROFILE → Sign out. Sign-out does not delete your data; you can sign back in with the same phone number to restore it.
  • Delete the app to remove the on-device ledger.
  • Permanently delete your account and all server-side data — see §9 below.

9. Account deletion

If you signed in to use Splits, you can permanently delete your WealthS account, your server-side Splits data and your Dropbox-backup encryption key — at any time.

9a. In-app deletion (the primary path)

  1. Open WealthS on the device where you are signed in.
  2. Go to Settings → DANGER ZONE → Delete account.
  3. Read the warning, then wait the 8-second confirmation timer.
  4. Tap Delete account.

What this does, in order: (1) erases all of your data on that device — accounts, transactions, splits, holdings, any connected broker / Dropbox credentials, and locally-cached settings; (2) on our servers, deletes your profile, every Splits group you own and its contents, your shares in other people's groups, your settlements, your comments, your recurring expense templates, your friend rows, your registered devices, your push tokens, your backup encryption key, and finally your authentication record; (3) signs you out and returns the app to first-launch state.

This action is irreversible. There is no undo, no recovery, no grace period.

9b. Web-only deletion (if you cannot install or open the app)

If you cannot reach the in-app flow — for example you have lost the device, uninstalled the app or never installed it but were added to a Splits group by someone else — email wealths@singlemonkey.com with the subject line "Delete my WealthS account" and include:

  • The phone number you used to sign in (in international format, e.g. +919876543210).
  • A brief note confirming that you want your account permanently deleted.

We will verify the request by sending an OTP to the phone number provided, and on confirmation will run the same server-side deletion described in §9a. Requests are processed within 7 calendar days (typically within 24 hours).

9c. What is deleted vs. retained

Deleted: everything in §9a above plus any encrypted backup files we can reach (only the encryption key, which is held server-side, is automatically deleted; backup files live in your own Dropbox or wherever you saved them and must be deleted by you).

Retained, on a best-effort basis, for legal compliance only: minimal log entries (timestamp + redacted phone hash) of the deletion request itself, kept for up to 90 days for fraud prevention and audit purposes. These records contain no financial data.

10. Data retention

  • Local on-device data — retained until you delete the app, sign in with a different phone number (which prompts a destructive-confirm wipe), or use the in-app account-deletion flow.
  • Splits server-side data — retained until you delete your account (§9). There is no automatic expiry; we minimise instead.
  • Device-sync records — each device's label, public key and push token are kept until you remove the device, sign out, or delete your account; the sealed key-envelopes are deleted as soon as the receiving device collects them.
  • OTP delivery records — held by Twilio per their retention policy (typically < 30 days).
  • Backup files — held in your Dropbox or wherever you saved them. We do not have a copy and cannot delete them on your behalf.
  • Backup encryption keys — held on Supabase, deleted with your account.

11. Children

WealthS is not directed at children under 13 (or the minimum age in your jurisdiction) and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us at wealths@singlemonkey.com and we will delete it.

12. Your rights under India's DPDP Act 2023

If you are a resident of India, the Digital Personal Data Protection Act 2023 ("DPDP Act") gives you certain rights with respect to your personal data. WealthS acts as a "Data Fiduciary" for the limited personal data described in this policy (your phone number and display name; your contacts in hashed form; the Splits content you produce). You can:

  • Request access to a summary of personal data we hold about you.
  • Request correction of inaccurate data (display name + phone can be updated in Settings; for other data, contact us).
  • Request deletion of your data (see §9).
  • Nominate another person to exercise these rights in the event of your death or incapacity — write to us.
  • File a complaint with the Data Protection Board of India if you believe your rights have been violated.

We will respond to verified requests within 7 calendar days. The grievance officer for DPDP-related queries is reachable at wealths@singlemonkey.com.

13. Changes

We may update this policy as the app evolves. Material changes will be reflected here with a new "last updated" date at the top.

14. Contact

Questions about privacy? Email wealths@singlemonkey.com.