Privacy Policy
Last updated November 11, 2026
AllWallet is a family wallet. This policy explains what data we receive, why, where we keep it and how you control it. We only take what the wallet can’t work without: no ads, no trackers, no selling data.
1.Who is responsible for your data
The data controller is Alexandr Antoniuc, an individual, str. Traian 23/1, ap. 395, MD-2060 Chișinău, Republic of Moldova (“we”).
For any question about your data, write to privacy@allwallet.app.
2.What data we receive
| What | Where from | Why |
|---|---|---|
| Email address | You enter it to sign in | Your account, sign-in code emails and, unless you opt out, a reminder email (see the section on legal bases) |
| Your entries: accounts, transactions (amounts, currencies, dates, categories, notes, tags), budgets, goals, recurring payments, questions on expenses | You add them in the app | Running the wallet and syncing between your devices and with your family |
| Family: its name, members (names and colors, including people you added without a phone), invite code | You and your family members | Shared family tracking |
| A member’s avatar — optional: a photo you chose yourself or a picture from the set | You choose it in the app | To recognise members in the family. The photo is cropped and shrunk on the phone, stored in the member record and visible to your family; you can remove it at any time |
| Sign-in log: time, IP address, event (sign-in, sign-out, session refresh) | The sign-in service on our server | Security and limiting sign-in attempts |
| Sign-in sessions: time, IP address and browser at sign-in | The sign-in service on our server | Keeping you signed in without a new code |
| Your conversation with support: your messages, our replies, the kind of message (question, idea, bug, thanks), the app version and language. If the notification with a reply doesn’t get through, the reply comes by email to your account address | You write in the “Support” section | Replying to you and improving AllWallet |
| Calendar and diary: events, their time, kind, notes; documents and deadlines: name, kind, expiry date, whose document, note; reminders for them | You enter them in the app | Reminders and syncing with your devices and family (for shared entries) |
| Your own modules: the name, fields and formulas you set up or the assistant built from your description, and the entries in them | You enter them in the app | Running the modules and syncing with your devices and family (for shared modules) |
| Shared entries marked “no amount” or “no details” | You enter them in the app | What you hide — the amount and account (“no amount”), the note, tags and receipt — is stored on the server only as your private record and reaches only your own devices. Family members receive the entry without it: category, date, who paid. A “no amount” entry isn’t part of the family totals |
| Auto-input from the phone — only if you turn it on: the text of a bank notification or the Apple Pay payment fields (amount, merchant, last card digits) sent by your iPhone or the Android helper using a device key | Your phone | So that a card payment appears in the wallet by itself; stored on the server until the app picks it up (usually seconds), no longer than 30 days; the server doesn’t parse the text — your phone does. The Android helper forwards notifications only from the apps you choose: one-time codes and passwords never leave the phone, and from SMS and messengers only messages with an amount are sent. On your phone the text becomes a draft in Inbox and syncs with your account as a personal record: once the transaction is saved the text is erased within a day, and the draft itself after 30 days. If notifications are on, the server sends a short “new entry” push so the app picks it up right away |
| A photo, screenshot or text you yourself send for parsing (“Forward or snap”) — only after your consent | You choose it in the Inbox or via “Share” | To sort an email, a schedule or a bank screenshot into events, to-dos and expenses. The picture is shrunk on the phone, sent to an AI provider and not stored by us — neither on the server nor in logs; the result is drafts on your phone |
| A scan of a passport, visa or ID card | Your phone’s camera | Recognized right on the phone; the photo is never uploaded or saved. Only the kind, country, expiry date and the last three digits of the number are written into the document |
| An entry’s change history: who created it, when and how (by hand, by phrase, auto-input), who changed what | Your phone on every edit | Transparency in a shared wallet. Stored in the entry itself and visible to those who see the entry; the values of hidden amounts and notes never get into the history your family receives |
| Chores for kids: chores, stars, rewards, pocket-money payouts; the “child” mark on a member | You and your family members | The “Chores” section and syncing with your family |
| Notification subscription: the address and keys your browser issues, the app language and which notifications you keep on — only if you turn notifications on | Your browser | Shopping reminders and other notifications on your phone. If a month passes with no entries, on the 1st we send a tip on how to start — no more than three times in a row; turn it off in Settings → Notifications |
| Member card: sizes, doctors, school or kindergarten, who to call, daily routine and health details (allergies, medicines, blood type, insurance) — only what you enter yourself | You enter it in the app | To keep what matters about a person at hand for you and your family (if the card is shared) and for whoever you send a link to. Health details are a special category of data: you enter them yourself and show them via a link only with separate consent |
| Links for people without the app — a babysitter card, a request (“I’ll do it” / “I can’t”), a gift for a child: the content, expiry, number of opens and replies (the name, amount and a few words the recipient typed) | You create the link; the recipient replies | So someone without the app can open a card, answer a request or mark a gift. The content and replies are encrypted on the phone with a key from the link itself, and the link service stores only ciphertext. So that you can open the link again, the key is also kept in your record in the app, which syncs with the server; only the kind of reply is stored in the clear, to notify you. A link stops opening after it expires or is revoked and is deleted 7 days later |
| Connecting your own AI (Claude, ChatGPT and others) — only if you create a connection: a fingerprint of the key, the device name, when and how often it was used | You create the connection link in Settings | So your AI assistant can read your wallet when you ask it to: read-only and only what you can see yourself, without others’ hidden amounts, the diary, health cards or document numbers. Whatever the assistant requests is received by the AI provider you chose, on its own terms — it is not our processor. You can disconnect at any time |
| Place for the weather — only if you turned on the weather in the calendar: the city you chose or, if you tapped “Where I am now” and allowed it, the phone’s location. Coordinates are rounded to ~10 km | You choose a city or allow the phone | To show the weather in the calendar. The place is kept in the settings on your phone; the server passes the city coordinates to Visual Crossing and keeps the answer for up to six hours, not linked to your account. A city you search for by name is looked up on our server and is not passed on |
| Look and layout settings: theme and tab colours, their order, which blocks are on the home screen and which sections are in the bottom menu, record fields, start of the month, rounding, calendar view, Easy’s voice; your consent to the AI assistant and when you gave it | Your phone, when you change them | So that everything looks the way you set it after you sign in on another phone or sign out and back in. Only you can see them; they are deleted with your account |
| Clients in “Rentals & business” — names, amounts, debts, appointments (day, time, service, price); a phone number only if you typed it in | You: by hand or from photos of your own records | Tracking income and debts by client and reminding a client. Kept with the property (your family sees it for a shared property). You send the reminder yourself from your own WhatsApp, Telegram, Viber or SMS — we send nothing and pass the numbers to no one |
| The tag of the link you came from (for example “instagram” or “flyer”) — only if you opened AllWallet through our link or QR code | The link you opened the app with | To understand which channels work. Stored with your account and deleted with it; reports show only totals per tag |
| Website visit log: the page address, where you came from (the referring link), browser and device type, browser language, a shortened IP address (last part removed). No cookies, no email address and no link to your account | The website server, when you open a page | To count how many people came to the site and from where (Instagram, Telegram, search). Kept for 14 days, then only daily totals remain |
We do not receive bank passwords, bank card numbers, location, contacts or advertising identifiers. Store loyalty card numbers you add are stored as your own entries. The app and the site have no counters, ads or third-party scripts. One exception: if sign-in is under attack (a flood of code requests), the sign-in screen asks for a Cloudflare Turnstile check for a while — only then is its script loaded.
We count overall figures ourselves from the data on our own server — how many people signed up and came back, how many families there are, which sections are used, how many questions were asked to Easy. These are totals only: we do not follow what you do in the app.
Once the subscription goes on sale, card details go to our reseller (see section 4), not to us. We only learn the buyer’s email, the plan and the subscription status.
3.Legal bases and purposes
- Performance of a contract (Art. 6(1)(b) GDPR): running the wallet, sync, family features, sign-in code emails, service messages, payment records.
- Legitimate interests (Art. 6(1)(f) GDPR): protection against break-ins and abuse — the sign-in log and attempt limits; overall service figures and the website visit log — to understand what works and where people come from; a reminder email to registered users about our own service. It comes on the 1st of the month, only if there have been no entries in the wallet for a month and no phone notification got through, and no more than three times in a row. We tell you about it on the sign-in screen; you can opt out there, in “Settings → Notifications” and through the link in every email.
- Legal obligations: keeping payment records once the subscription is on sale.
- Explicit consent (Art. 9(2)(a) GDPR): health details in a member card and showing them via a link. You can withdraw consent by deleting the details from the card and revoking the link.
We don’t send any other newsletters or ads. Your entries are not used for profiling, advertising or training AI models.
4.Who else sees your data
Personal entries are visible only to you. Shared entries are visible to the members of your family. The database on our server enforces this rule, not just the app.
Processors help us run the service. They act on our instructions and only for the purposes listed:
| Processor | What it does | Which data |
|---|---|---|
| Hetzner Online GmbH, Germany | Servers in the EU (Germany or Finland), backups | All service data |
| Cloudflare, Inc., R2 storage in the EU | A second copy of the database in case the server is lost | A backup encrypted on our server; Cloudflare does not have the key |
| Cloudflare, Inc., Turnstile check | Protecting sign-in from bots — only while sign-in is under attack | IP address and browser details at the moment of the check; Cloudflare doesn’t receive your email or wallet data |
| Visual Crossing Corporation, USA — only if you turned on the weather in the calendar | Weather forecast | City coordinates rounded to ~10 km; the request comes from our server, without your account or address |
| Sendinblue SAS (Brevo), France | Sending sign-in code emails, reminder emails and support replies | Email address and the email text |
| Lemon Squeezy (reseller and Merchant of Record for the subscription), once sales start | Payments, taxes, receipts, refunds | Buyer and payment details |
| Browser push services (Google, Apple, Mozilla) — only if you turn notifications on | Delivering notifications to your phone | The encrypted notification text, readable only by your device; the subscription address |
| Telegram Messenger Inc. — only for messages you send to support yourself | Delivering your message to us and our work on it | The message text and our reply, the kind of message, the app version and language, a conversation code. Your account email and name are not passed on |
| Groq, Inc., USA — only if you turn on voice input in a browser without built-in speech recognition | Speech recognition (Whisper) | The audio of the spoken phrase — a few seconds; the provider doesn’t store it or use it for training |
| Anthropic, PBC (Claude), USA; if it doesn’t answer — Groq, Inc. and Cerebras Systems, Inc., USA — only if you turn on the AI assistant | The assistant’s answers to your questions — about anything: groceries, medicines, car parts, money — and understanding commands (“move the barbecue to Saturday”, “remove milk from shopping”) | Your question and the feature guide of the app. With a command — your tab names, upcoming events and tasks, the shopping list and your recent transactions: titles, dates and amounts, to know which entry you mean. If the question is about your money — also a wallet summary without names, email or other people’s hidden amounts: monthly totals, categories, budgets, pockets, agreements, goals, recent transactions, your modules’ totals. The providers don’t use requests for training. Anthropic deletes them within 30 days (longer only for what its safety systems flag as a usage-policy violation); Groq and Cerebras don’t store them |
| Anthropic, PBC (Claude), USA; if it fails — Groq, Inc., USA, then OpenAI, L.L.C., USA — only for what you yourself send for parsing | Parsing photos, screenshots and text into events, to-dos and expenses; photos of business records — into income, expenses and clients by day | The shrunk picture or the text and today’s date, plus the property’s currency for business records. Photos of records may show your clients’ names — send such photos only if you are entitled to. Under their API terms the providers don’t use what is sent for training |
The AI assistant is off until you turn it on yourself. The summary is built on your phone and goes to the provider only with your question; the limit is 30 questions a day. The AI only understands commands: moving, deleting or adding is done by the app itself on your phone, and it can be undone. You can stop at any time by clearing the conversation and not asking; we keep none of it on the server.
Easy’s voice. So that Easy answers in Russian in a male voice, the text of his answer is voiced by our own server (Hetzner, EU): the text is not passed to third-party services, and we keep neither the text nor the audio. If you choose the phone’s voice (“Settings → Easy → Voice”), the device itself speaks.
Your phone fetches exchange rates directly from open.er-api.com (ExchangeRate-API). That service sees your device’s IP address but never receives your entries.
We don’t sell data or share it with advertisers. We may disclose data only when lawfully required by a public authority, and only to the extent required.
5.Where and how long we keep data
- On your device (in browser storage) — until you sign out or erase the data in settings.
- On our server — for as long as you have an account.
- Database backups are made every night and kept for 14 days, then deleted. An encrypted copy is also kept separately from the server, in Cloudflare R2 in the EU, for the same time.
- Sign-in log — 90 days. Sessions unused for 90 days are closed and deleted; you can sign in again with a code.
- Website visit log — 14 days, then deleted; only daily totals remain.
- Server technical logs are size-limited and overwritten automatically.
6.Your rights
Under the GDPR and the law of your country you have rights over your data. Most of them work right in the app:
- Access and portability: “Settings → Data → Save a backup” (JSON) and “Export to a spreadsheet” (CSV).
- Rectification: you can edit any entry and your name in the app.
- Erasure: “Settings → Account → Delete account”. Your account, all your entries (personal and shared), your family membership and your sign-in log are deleted from the server right away. The family’s name, shared accounts and categories stay with the remaining members, because their entries depend on them. They disappear from backups within 14 days.
- Restriction, objection, any questions — write to privacy@allwallet.app. We reply within 30 days.
- Complaint to the data protection authority of your country.
7.Security
- HTTPS only.
- Sign-in with a one-time code by email, valid for 10 minutes. There are no passwords, so there’s nothing to steal.
- Access rules in the database itself: personal entries never reach your family, even around the app.
- Limits on sign-in and invite code attempts, nightly backups.
If a breach affects your data, we will notify you and the supervisory authority within the time limits set by law.
8.Browser storage instead of cookies
To work offline, the app keeps your entries and your sign-in in your browser’s storage (IndexedDB and localStorage) on your device. The site only stores a note that you closed the language tip. We don’t use advertising or analytics cookies.
9.Children
You need to be 16 or older to create an account. Parents can add a child to the family as a member without a phone — that’s just a name and a color. The adult who adds them is responsible for it.
10.Transfers outside the EU
Data is stored on servers in the European Union. We are based in Moldova and administer the servers remotely. If a processor is located outside the EU, transfers rely on the safeguards provided by the GDPR, such as standard contractual clauses.
11.Changes to this policy
We will let you know about material changes in advance, in the app or by email. The date of the current version is shown at the top of this page.