Privacy Policy

WinaltTrack ("the App", "we", "us") is a personal expense and budget tracking app developed by Winalt Technologies (SMC-Private) Limited ("Winalt Technologies", "the Company"). This policy explains what information the App collects, how it's used, and the choices you have.

1. Information we collect

1.1 Account information

When you create an account, we collect your email address and a securely hashed password (we never store your password in plain text). If you add a display name or profile photo, we store those too.

1.2 Financial and personal data you enter

WinaltTrack is built around data you choose to enter yourself, including:

• Expenses, income, and transfers between your accounts
• Loans and loan repayments, including the name and (optionally) phone number of the other party
• Assets you own (vehicles, precious metals, property, and other items), including purchase/sale details and any contributors or shareholders you add
• Investments, funds, and safekeeping items you track
• Budgets, savings goals, and recurring transaction schedules
• Receipt photos or other images you choose to attach to a transaction or asset

1.3 Contacts (only when you choose to use this feature)

When adding a loan, safekeeping item, or asset contributor, you can optionally pick a name and phone number from your device's contacts to save time. WinaltTrack only stores the specific name and phone number you select. It does not read, sync, or store your full contacts list.

1.4 Information about other people

If you add another person as a loan counterparty, safekeeping contact, or asset contributor, you are providing us with that person's name and (optionally) phone number. You are responsible for having a reasonable basis to share this information, for example because it reflects a real financial or personal arrangement between you and that person. These individuals are not WinaltTrack users and have not created an account or agreed to this policy.

1.5 Device, usage, and verification information

We may collect basic technical information needed to operate the App reliably, such as device type and operating system version. On Android, crash and error reports are collected automatically by Google Play's own crash-reporting infrastructure, not by WinaltTrack's own code; we don't run a separate crash-reporting SDK.

When you sign in or sign up, a bot-detection check (Cloudflare Turnstile) runs in the background and may process technical signals such as your IP address and browser characteristics to confirm you're not an automated script. It only activates a visible challenge for suspicious traffic; most sign-ins never see it.

1.6 Subscription status (Android)

If you purchase a premium subscription on Android, purchase and subscription status information (such as which plan you're on and whether it's active) is processed through RevenueCat, our subscription management provider, and linked to your account so your premium access can be activated. Payment details themselves are handled by Google Play, not by us or RevenueCat.

1.7 Camera, photos, and notifications (Android)

If you choose to photograph a receipt, the App asks for camera access, and when you pick a profile picture or an existing photo it uses your device's photo picker. Photos are used only for the entry you attach them to. If you allow notifications, the App shows reminders you set up (such as due bills) and the progress of a sync; these are created on your device and we do not use them for advertising. You can turn any of these permissions off in your device settings at any time.

1.8 Google Drive backup (Android, optional)

If you turn on Google Drive backup, the App saves backup files of your data (and, on paid plans, your attached photos) in a hidden folder of your own Google Drive that only the App can see. The files go from your device straight to your Google account; they do not pass through our servers, and we cannot read them. You can protect them with a passphrase that is never sent to us, and if you forget it the backups cannot be opened. Disconnecting Google Drive in the App stops new backups; existing backups stay in your Drive until you delete them, including after you delete your WinaltTrack account, because they belong to your Google account and not to us (you can remove them in Google Drive's settings under Manage apps). The App asks Google only for access to its own hidden folder, not to your other Drive files.

1.6 Website analytics (winalttrack.com)

This applies to visitors of our marketing website, winalttrack.com, not to the App. If you click Accept on the cookie notice, we use Google Tag Manager and Google Analytics to count visits, see which pages are read, and see how many people go on to Google Play or the web app. Google Analytics sets cookies (such as _ga) and receives your IP address, browser and device details, and the pages you view; it does not receive anything you enter in the App. If you click Decline or ignore the notice, no Google Analytics or Google Tag Manager code is loaded. You can change your choice at any time with “Cookie settings” in the footer. Google acts as our service provider for this; see how Google uses data. We do not use advertising cookies or sell this data.

2. How we use your information

• To provide the App's core functionality: storing and syncing your financial records across your devices
• To authenticate you and keep your account secure
• To respond to support requests
• To maintain and improve the App's reliability and performance
• To activate and manage your premium subscription, if you purchase one

We do not use your financial data for advertising, and we do not sell your data to third parties.

3. How your data is stored and protected

Your data is stored using Supabase, a backend infrastructure provider, with the following protections:

Where your data lives depends on your plan. On the free plan your records and attachments are stored only on your phone and are not sent to us. With the Premium + Web plan they are also copied to your account in the cloud so the web app and your other devices can see them, and your app settings are saved with your account so they match everywhere.

• Row-level security ensures your financial records (expenses, income, loans, assets, and the other data described in Section 1.2) are only accessible to your own authenticated account, not to other users, and not directly to us without deliberate administrative access for support or legal purposes
• Data is encrypted in transit
• Optional in-app biometric/PIN lock is available to protect access to the App on your device

Receipt photos, profile pictures, and other images you attach are stored the same way: access requires your own authenticated account. Viewing a photo generates a short-lived (1 hour) signed link scoped to your account, rather than a permanent public one.

Offline access. To let the App work without a connection, recent data is cached on your device. On mobile, this cache is encrypted (AES-256) with a key held in your device's own secure hardware storage (Keychain on iOS, Keystore on Android). On web, this cache exists only in your browser's memory for the current session and is never written to disk; it disappears when you close the tab.

4. Data sharing

We do not sell or rent your personal data. We share data only with the service providers who help us run the App, each acting as a data processor on our behalf, and only for the purpose listed:

We also share data with authorities or third parties where required by law, or to protect the rights, safety, or property of Winalt Technologies, our users, or the public.

5. Your rights and choices

When you delete your account, your data is permanently removed from our systems, except where we are required to retain certain records for legal, security, or fraud-prevention purposes, which we will disclose to you on request. A deletion request made without the app installed (by email) is completed within 30 days, with confirmation once it's done; deleting in-app is immediate.

6. Children's privacy

WinaltTrack is not directed at children and is not intended for use by anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

7. Not a regulated financial service

WinaltTrack is a personal record-keeping tool. It does not process payments, issue loans, hold funds, or provide financial, investment, or lending services of any kind. All financial figures you enter are self-reported by you for your own tracking purposes and are not verified, insured, or regulated by any financial authority.

8. Data retention

We retain your data for as long as your account remains active. If you delete your account, your data is deleted as described in Section 5: immediately if deleted in-app, or within 30 days if requested by email without the app installed, subject to limited legal/security retention exceptions.

9. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you within the App or by email before the changes take effect.

10. Contact us

If you have questions about this policy or your data, contact us at info@winalttechnologies.com, Winalt Technologies (SMC-Private) Limited.