Privacy Policy

finwe is an app for tracking your income and expenses, planning a budget, sharing that budget with your partner, family or roommates, and running the shopping at home together. You can use finwe through the iOS and Android app or in your browser through the web app (web.finwe.app). This policy explains what data is processed when you use finwe, why, and what rights you have.

In short: finwe shows no ads, uses no third-party tracking tools, and sells your data to no one. Neither the app nor the web app contains any analytics or advertising component.

1. Controller and contact

The person responsible for your data is Hakan Yoldaş (Türkiye). finwe is developed and offered by an individual.

For anything related to privacy (to access, correct or delete your data, or to object to processing), write to privacy@finwe.app. Requests are answered within 30 days at the latest.

2. Data we process

Account details: your email address, first and last name, and password. The password is stored hashed; it is never kept or visible in readable form.

Sign in with Apple or Google: if you sign in this way, Apple or Google shares your email address and name with us; Google also shares the address of your profile photo, and the app shows that photo from Google’s servers. If you choose to hide your email with Apple, we receive the relay address Apple creates. We keep no password for these accounts and never see your Apple or Google password.

Profile: your display name, profile photo if you set one, app language, currency, and the way you use finwe, which you choose during setup (on your own, with your partner, with family or with roommates). Your profile photo is resized on your device or in your browser before it is uploaded, and extra information inside it such as location (EXIF) is removed.

Your financial records: the income and expenses you enter and their dates, expense categories, accounts (name, starting balance, whether it is a credit card, instalments), savings goals and trip budgets. These are entered by you; finwe does NOT connect to your bank, your card, or any financial institution.

Shopping list: the items you add, quantities, checked-off marks and, in shared lists, who added or bought an entry.

Shared budget: the shared budget’s name and type, its members and their roles (founder or member), invitation codes, the money setup and split rule, who paid each shared expense and how it was split, settle-up records and allowances. If you split by income, the monthly net income you enter for that purpose is processed too; section 6 explains who can see what.

Notifications: if you allow notifications, your device’s push identifier, an app-specific device identifier, platform, language, time zone, app and operating system version, whether the finwe Apple Watch app is installed, and your notification permission status. Even if you do not allow notifications, the app sends the app-specific device identifier, the platform and your notification permission status so that a notification record left on this device by another account can be deleted; if you allowed notifications on this device before, the permission status in your record is updated too. Without permission no new record is created and no other details are sent.

Technical records: our infrastructure provider keeps connection logs for security and error tracking; these may include IP address and timestamps. When you use the web app, the hosting provider that serves its pages also keeps connection logs that include your IP address and browser details.

finwe does NOT read your location, contacts, photo library (other than the image you choose as a profile photo), advertising identifier, or other apps on your device. The time zone above is taken only if you allow notifications, and only from your device’s clock setting.

3. Purposes and legal bases

Your data is collected electronically, from the information you enter in the app and the web app and from the technical details your device or browser sends automatically to provide the service.

Creating your account and providing the app’s functions (budget, calendar, shopping list, goals, trips, shared budget, splitting, settling up and allowances, including adapting texts and screens to the way you use finwe): entering into and performing our contract (GDPR Art. 6(1)(b)).

Sending notifications: based on the permission you grant on your device (GDPR Art. 6(1)(a)). Notifications are about the service: income and expenses added to the shared budget, members joining and leaving, settling up and allowances, changes to shared shopping lists and shared trips, an item you buy regularly that may be running out, and payments that are nearly due. Payment reminders are set up on your device itself. You can switch off most notifications by type (shopping list, shared budget, shared trip, payment reminders), and all of them with the main switch in the app’s notification settings; you can withdraw the permission at any time in your device settings.

Keeping the service secure (such as deleting a notification record left on this device by another account), preventing abuse and fixing errors: legitimate interests (GDPR Art. 6(1)(f)).

4. The “we” assistant

The in-app assistant “we” writes short notes from the numbers you see in Reports and from records you can see, such as goals, trip budgets and loans: how the month is going, upcoming payments, how much is left for a goal.

These notes are calculated ENTIRELY ON YOUR DEVICE using fixed rules. “we” collects no new data and sends nothing anywhere; it only reads records that are already stored in your account and that you can already see. Nothing goes to any third party.

“we” is on by default. If you do not want it, tap the we card on the home screen and switch it off; while it is off, no notes are calculated.

Notes from “we” are produced automatically from the data entered; a missing or wrong entry can lead to a wrong note. They are not financial advice.

5. Who we share data with

We do not sell or rent your data, and we share it with no one for advertising. We use only the service providers needed to run the app:

• Supabase: database, authentication, file storage, server functions, and passing changes in a shared budget to the other members’ apps instantly.
• Vercel: delivers the web app’s pages to your browser (hosting). To do this it processes your IP address and browser details. Your financial records do not pass through Vercel; your browser fetches them directly from Supabase.
• Expo, Apple and Google: delivering notifications to your device. Notifications pass through Expo’s push service; Apple’s push service delivers them to Apple devices, and Google’s Firebase Cloud Messaging delivers them to Android devices. Notification texts sent this way carry no financial amounts; to say who did what, they may include the person’s name, the record’s name (such as an item or expense name) and the name of the shared budget, list or trip.
• Apple: app distribution and in-app purchases through the App Store, and Sign in with Apple. If you make a purchase on the App Store, Apple processes the payment; finwe never sees or stores your card number or payment details.
• Google: app distribution and in-app purchases through Google Play, and Sign in with Google. If you make a purchase on Google Play, Google processes the payment; finwe never sees or stores your card number or payment details.
• Adapty: subscription infrastructure. It matches the purchases you make in the store to your account. To do this it processes your account ID, subscription status, device information and IP address; it never sees your card number or payment details.

We may also have to share data with authorities where a legal obligation applies (for example a court order).

6. Shared budget: who sees what

finwe has two spaces: your personal space (“Me”) and the shared budget you belong to (called “Our home” by default). Only you can see the records in your personal space; the people in your shared budget cannot.

One person sets up the shared budget (the founder); only the founder can create invitation codes, and a code expires after 7 days. A person can be in only one shared budget at a time. A shared budget set up with your partner or family has two people; one set up with roommates has up to 6.

Everyone in a shared budget can see: all income, expense, account, goal, trip and shopping records added to the shared budget, and who added each one; each other’s name, profile photo if set, and role; and each other’s subscription status (for example subscribed, included in a subscription, or in the trial with the days left). Every member can edit shared income, expenses, accounts, categories, goals and trips; the person who added them and the founder can delete them. Goal contributions and trip expenses can be changed or deleted only by the person who added them; any member can delete allowance records. The founder can remove a member from the shared budget.

If you split expenses, who paid each shared expense and everyone’s share, who owes whom how much, and settle-up records are visible to the members.

When splitting by income, everyone enters their own monthly net income. Only you can see the income amount you enter; the other members see only the whole-number percentage calculated from it (for example 60%). A member who knows their own income can roughly work out yours from that percentage. When you leave the shared budget, the income you entered is deleted.

Allowance: when an allowance is sent from the shared budget to someone, the shared budget shows only the amount, who sent it, who it went to and the day. The allowance arrives in the “Allowance” account in that person’s personal space; only they can see how it is spent.

Goals and trips: members see the contributions to a goal in the shared budget (who added how much and when) and a trip’s expenses, who paid what and the balance between you. If you made a contribution from a personal account, its entry in your personal budget stays only with you.

Shopping lists: everyone sees the shared budget’s lists. You can share a personal list with people in your shared budget; they see its items, who added them and who bought them, can add and edit items, and can leave the list themselves. Your shopping entries stay with you and the people you share with: the product names you type are not suggested to other users and are not added to any public catalogue.

Leaving: you can leave the shared budget at any time. When you leave, or when the founder removes you, you can no longer see the shared budget. The records you added stay in the shared budget and the other members keep seeing your name next to them; their access to your profile photo ends. Your contributions to shared goals stay in the goal, and their link to your personal budget is removed. Sharing of personal shopping lists between you and them ends in both directions, and recurring allowances involving you end that month. If the founder leaves, another member becomes the founder. If you are the only person left, you can delete the shared budget; everything in it is permanently deleted, and your personal space is not touched.

7. The web app

You can also use finwe in your browser at web.finwe.app. On the web you can only sign in; accounts are created in the phone app. No purchases are made on the web; only your subscription status is shown.

Your browser’s storage (localStorage) holds your session, a copy of your data so that the app opens quickly, records you added while offline that have not been sent yet, and a short record of your subscription status. If you untick “Remember me” when signing in, all of these are kept only in storage that belongs to that tab (sessionStorage) and are deleted when you close the tab or the browser, including records that have not been sent yet. Signing out deletes all of these. On a shared computer, we recommend unticking “Remember me” and signing out when you are done.

The web app uses no cookies and loads no analytics, advertising or tracking scripts. Fonts and the app’s own images come from the web app’s address; profile photos and your data come directly from Supabase. Nothing is loaded from any other site.

8. Where data is stored

Data is held on Supabase infrastructure, on servers in Germany (Frankfurt). The web app’s pages come from Vercel’s servers; your data still stays with Supabase.

Transfers outside Türkiye and the European Union take place under the contractual safeguards of our service providers.

9. Retention

Your data is kept for as long as your account exists.

When you delete your account, your personal data is permanently deleted. Deletion is done in the phone app: Profile → Edit My Account → Delete My Account. It cannot be undone.

Everything in your personal space (your income and expenses, accounts, allowance account, goals, trips and personal shopping lists) is deleted with you.

If you are in a shared budget, this is what happens:

• The records you added to the shared budget (income and expenses, accounts, goals and contributions, trips and their expenses, shopping lists and items, settle-up and allowance records) stay for the other members and ownership passes to the founder. Your name is removed from these records; your trip expenses and goal contributions are shown under the founder’s name from then on.
• If you are the founder, the member who joined the shared budget earliest becomes the founder.
• If you are the only person in the shared budget, the shared budget is deleted too, with everything in it.
• In the other members’ notification list in the app, “Deleted user” is shown instead of your name; notifications already delivered to their devices do not change.

What stays is kept so that other people’s data is not destroyed along with yours.

Your profile with our subscription infrastructure provider Adapty is not yet deleted automatically with your account. If you want it deleted, write to privacy@finwe.app.

Our infrastructure provider Supabase keeps the connection logs in its log service (the technical records in section 2) and database backups for at most 7 days. Sign-in records, which may include your IP address and email address, are kept for at most 30 days. These records may remain until their period ends, even after you delete your account.

10. Your rights

You have the right to access your data; to have it corrected, erased or its processing restricted; to object to processing; and to receive your data in a portable format (GDPR Art. 15-22).

You can change your name, email and profile photo in the app at any time. You can change or delete the income you entered for splitting, and leave the shared budget. You can also delete your account in the phone app.

For other requests, write to privacy@finwe.app.

If you believe your request has not been handled properly, you may lodge a complaint with the data protection authority of your country in the European Union, or with the Personal Data Protection Authority (KVKK) in Türkiye.

11. Security

Data is encrypted in transit. Row level security (RLS) is enforced in the database: each user can reach only their own data and the data of the shared budget they belong to.

Your profile photo is not public. Only you and the people in your shared budget can see it, and it is always shown through a time-limited link. When you leave the shared budget, that access ends automatically.

When something changes in a shared budget, the instant signal sent to the other members’ apps carries none of the record’s content; the app only learns that something changed and reads the data again with its own permissions.

If you enable the app lock on your device, fingerprint or face verification happens on the device itself. Your biometric data never reaches us and is not stored.

No system can offer absolute security; if a security incident occurs, the required notifications will be made.

12. Children

finwe is not directed at children. If you are under 16 (under 18 in Türkiye), do not use the app without your parent’s permission. If we learn that such an account was created, we will delete the data.

13. Changes

This policy may be updated from time to time. You will be informed in the app when something material changes. The “last updated” date above tells you which version you are reading.