Privacy Policy

Introduction

Where Is My Money? ("we," "us," or "our") operates the Where Is My Money? mobile application and paulkreations.com/wimm (together, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Service.

A note on how this app is built: by default, your financial data — expenses, income, investments, debts, budgets, and everything else you enter — is stored only on your device, encrypted, and never transmitted anywhere. It only leaves your device if you explicitly turn on Premium cloud sync, or take one of the specific actions described below (like enrolling in the Referral Program). This Privacy Policy describes what happens in every case, including that offline-by-default one.

Information We Collect

Information you provide directly

• Financial data— expenses, income, bank/card/ investment/debt records, budgets, goals, and similar entries you create in the app. Stored locally, encrypted, on your device by default. Only transmitted to our servers if you turn on Premium cloud sync, in which case it's stored to keep your data available across your own devices — see "Premium Cloud Sync" below.
• Account identity — if you sign in (for Premium cloud sync, to enroll in the Referral Program, or to view or apply a Promo Offer), we receive your name, email address, and profile photo from your chosen sign-in method (Google Sign-In, or email/OTP).
• Financial profile details — job type, income stability, years in current role, marital status, number of dependents, and similar fields you may optionally fill in under Financial Profile, used to power in-app affordability calculations. Local-only unless you turn on Premium cloud sync or enroll in the Referral Program (see below).
• Payment information — if you subscribe to Premium, your payment is processed by Apple, Google Play, or RevenueCat (Android/iOS/macOS), or by Razorpay (India, alternate platforms). We do not receive or store your card/bank details ourselves — we receive confirmation that a payment was made, a subscription identifier, and its status.
• Attachments — receipts, invoices, certificates, and similar documents you choose to upload against an expense, income entry, investment, or tax record. Stored in encrypted cloud storage (Supabase Storage) only if you upload one — this is a Premium feature.
• Location data— only if you use the Trip Journal feature and choose to search for or confirm a place; used to log your trip's locations, never collected in the background.

Information collected automatically

• Usage data— which screens and features you use, for the purposes described below. Free-tier: only if you opt in (a one-time consent prompt, reversible anytime in Settings). Premium: mandatory, since some Premium features depend on knowing what's being used to keep them working correctly.
• Crash and diagnostic data — same opt-in/mandatory split as usage data above.

How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Keep your data available across your own devices, if you've enabled Premium cloud sync
• Process your Premium subscription and payment
• Send you notifications you've asked for (reminders, referral program updates)
• Understand and improve how the Service is used
• Diagnose and fix crashes and errors
• Provide customer support
• Operate the Referral Program (see its own section below)
• Operate Promo Offers (see its own section below)
• Find and prevent fraud or abuse
• Comply with legal obligations

Premium Cloud Sync

Turning on Premium cloud sync uploads your financial data to our database, hosted on Supabase, so it stays available and current across every device you're signed into. This is entirely optional — the app is fully functional without it, for anyone who prefers their data to never leave their device. You can turn cloud sync off, and delete your cloud account and data, at any time from Settings.

Referral Program

If you choose to enroll in the Referral Program (during onboarding, or later from Settings), we collect and store, on our servers:

• Your name, date of birth, gender, and profile photo, as set in your app profile at the moment you enroll
• Your Financial Profile details, as described above, as set at the moment you enroll
• A shareable referral code we generate for you, and — if you redeem one — the referral code you entered
• Which account (if any) referred you, and which accounts (if any) you've referred

This is a one-time snapshot taken at enrollment, not a continuous copy of your data (unless you're also a Premium subscriber with cloud sync on, in which case your Financial Profile is kept current the same way the rest of your Premium data is — see "Premium Cloud Sync" above). Your everyday financial transactions — expenses, income, investments, debts — are never collected for the Referral Program, regardless of whether you're a Premium subscriber.

A person you refer can see that you referred them and the date you joined — nothing else about your enrollment (not your financial profile, not any other personal detail) is ever shown to anyone else, including someone you've referred or who referred you.

What happens if you delete your account:your Referral Program enrollment record — your referral code and referral history (who referred you, who you've referred) — is retained even after you delete your account, so that signing back in with the same Google account automatically reconnects you to it instead of losing your code and starting over. Every other part of your account (financial data, attachments, settings) is permanently deleted. See "Data Retention" below.

Promo Offers

Where Is My Money? may, at our sole discretion, grant free Premium access to specific accounts through a Promo Offer — for example, to collaborators, partners, or other accounts we select. This is a separate, invitation-based program, distinct from the self-service Referral Program described above.

• What we collect.Which offer (if any) your account has applied, and when. We do not collect any additional financial or personal information as part of applying a Promo Offer beyond what's already described elsewhere in this policy (your account identity, from signing in).
• How eligibility is decided.Each offer is either visible to every signed-in account, or restricted to specific accounts we select in advance. We do not use any automated criteria (your financial data, activity, or profile) to decide eligibility — it's set manually. To restrict an offer to specific people, we may look up an account by the email address associated with it, so that account can be granted visibility into that offer; we do not use this lookup for any other purpose.
• Administrative access.A small number of authorized administrators (currently, the app's developer) can view Promo Offer eligibility and redemption records — including the email address associated with an account — to create, manage, and troubleshoot offers, and to look into a specific account's redemption at that account holder's request (for example, to correct a mistaken redemption). This access is limited to what's needed for that purpose and does not extend to your financial data, which remains encrypted and inaccessible to us unless you've separately enabled Premium cloud sync for it.
• Data retention. Unlike the Referral Program above, your Promo Offer redemption record is deleted along with the rest of your account when you delete it, and is not retained afterward. If you sign up again with the same Google account, your eligibility for any offer (and whether you can apply one) is re-evaluated as if you were a new account — nothing about a prior redemption carries over.

Third-Party Services

We use the following third-party services to operate the app:

• Supabase — our database and file storage provider, for Premium cloud sync, attachments, the Referral Program, and Promo Offers.
• Google Sign-In — for account authentication. We encourage Google Sign-In as the primary way to sign in; an email/OTP-based alternative is also available.
• RevenueCat — manages Premium subscriptions purchased through the Apple App Store or Google Play Store.
• Razorpay— processes Premium subscription payments on platforms/regions where App Store/Play billing isn't available (currently Windows and Linux, India only).
• Amplitude — analytics, for the usage data described above.
• Sentry — crash and error reporting.
• OneSignal — push notification delivery.
• Google Maps / Places— only used if you use the Trip Journal's place search feature.

Each of these processes the specific data described in this policy on our behalf; none of them are permitted to use it for their own independent purposes.

Data Retention

We retain your data as follows:

• Financial data (Premium cloud sync)— retained until you turn off cloud sync or delete your account, at which point it's permanently deleted from our servers (your local, on-device copy is unaffected).
• Referral Program enrollment— retained even after account deletion, specifically so the same Google account can be automatically reconnected to it later — see "Referral Program" above for exactly what this includes.
• Promo Offer redemption— deleted along with the rest of your account when you delete it; not retained afterward — see "Promo Offers" above.
• Usage/crash data — retained for as long as necessary to improve the Service, or until you withdraw consent (free tier) or delete your account (Premium).
• Payment records — retained as required by applicable tax and financial recordkeeping law, independent of whether you delete your account.

Data Security

We use encryption both on your device (your local financial data is stored encrypted) and in transit to our servers. No method of transmission over the internet or electronic storage is 100% secure, and while we use commercially reasonable measures to protect your information, we cannot guarantee its absolute security.

Your Rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing. You can exercise most of these directly in the app (Settings → Data Management, and Settings → Delete Account); for anything else, contact us using the details below.

Grievance Officer (India)

In accordance with the Digital Personal Data Protection Act, 2023 and applicable Indian law, the following Grievance Officer can be contacted regarding any complaints or concerns about how your personal data is handled:

• Name: Debapriyo Paul
• Email: debapriyopaul.dp@gmail.com
• Address: 20, Bindhyabasinitala Road, Ariadaha, Kolkata - 700057

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. Material changes — anything that meaningfully changes what we collect or how we use it — will also be shown to you directly in the app.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, please contact us:

• By email: support@paulkreations.com
• By visiting: paulkreations.com/wimm