Privacy Policy

1. Who this policy covers

This policy covers the FinWise mobile app and finwise.delolabs.app. FinWise is operated by Delo Labs. Contact our privacy and support team at support@finwise.delolabs.app.

2. Information we process

3. Why we process it

• Provide sign-in, local-first records, cloud sync, budgets, goals, recurring payments, and exports.
• Turn user-selected receipts, documents, and shared content into reviewable transaction drafts.
• Provide requested reminders and, where enabled, Firebase Cloud Messaging notifications.
• Operate, secure, troubleshoot, improve, and support FinWise; prevent abuse of trials and service quotas.
• Meet applicable legal, security, fraud-prevention, and recordkeeping obligations.

4. Receipt OCR and AI processing

Receipt scanning is optional and starts only after you select a receipt or document. The app may temporarily upload the selected receipt to the private Supabase Storage receipts bucket, then calls an authenticated Supabase Edge Function. That function sends the receipt content to Z.ai/GLM to extract visible transaction evidence and returns a structured draft for your review.

The app attempts to remove the temporary storage object after processing, including failures. Do not use receipt scan for documents containing passwords, card security codes, or other information you do not want processed by these services. FinWise does not expose provider keys in the app or website.

5. Providers and disclosures

We use service providers to operate the product:

• Supabase: authentication, database, private receipt storage, and server-side functions.
• Google / Firebase: Google sign-in where selected, Analytics, Crashlytics, Remote Config if enabled, and Firebase Cloud Messaging.
• Z.ai/GLM: receipt image or document extraction only when you use receipt scanning.
• Google Play: Android subscription billing and purchase administration. FinWise does not receive your full payment-card details.
• Cloudflare: website hosting, delivery, and security logging.

We do not sell personal data or disclose it for advertising. Providers may process data from the country where their services operate; their own terms and privacy practices also apply.

6. Retention and deletion

We keep account and financial data while your account is active, subject to your controls and the product's storage behavior. A transaction moved to Recently Deleted is excluded from normal reporting and shown for up to 30 days for restoration; deleting a transaction is different from deleting the entire account.

Authenticated in-app account deletion is available at Settings > Privacy & Data > Delete Account. It removes the Supabase Auth account, profile, financial records, device tokens, entitlement and quota records, feedback/operational records, and owned receipt or avatar storage objects. The workflow detaches a one-way purchase-token hash for free-trial abuse prevention and retains a one-way deletion-audit hash. Backup and provider retention follow the operator's and provider's configured schedules; we do not promise a duration that has not been configured.

To request deletion without the app, use Delete Account. Deleting a FinWise account does not cancel a Google Play subscription; manage that separately in Google Play.

7. Security

We use access controls, authenticated server-side operations, row-level database protections, private receipt storage, and encrypted network transport where supported by our providers. No system can promise absolute security; keep your device and account credentials secure and contact us promptly about suspected misuse.

8. Your choices and requests

You can update data in the app and request access, correction, deletion, consent-related help, or raise a grievance through Privacy Request or support@finwise.delolabs.app. We may verify account ownership before acting on a request. Never send us a password, OTP, card number, UPI PIN, or bank credential.

9. India privacy notice

FinWise is intended for users aged 18 and over as a product policy; this is not a statement that Indian law requires all FinWise users to be 18. The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 have staggered commencement. As of this policy date, the provisions that govern routine personal-data processing and the corresponding Rules are scheduled to commence eighteen months after the 13 November 2025 Gazette notification. We have written this notice in clear, itemized language and will update it as applicable requirements commence or change.

10. Changes and contact

We may update this policy when the product, providers, or legal requirements change. The version, effective date, and last-updated date above identify the current notice. For privacy questions or grievances: support@finwise.delolabs.app.