Privacy

What we store

• Your email and a hash of your password (never the password).
• Your report JSON: merchant names, amounts, dates, and card last-4s only.
• Payment records (plan, amount, Stripe session id).

What we never store

• Your uploaded files — they are processed in memory and discarded.
• Full card or account numbers.
• Bank credentials — we never ask for them.

Google Sign-In & Google user data

If you choose “Continue with Google,” we use Google Sign-In (OAuth) only to verify your identity and create or log you into your WatchWallet account. We request the minimum scopes required for sign-in and do not request access to Gmail, Google Drive, Google Calendar, or any other Google service.

The Google user data we access is limited to:

• Your name
• Your email address
• Your profile picture
• Your Google account ID

We use this data solely to authenticate you and maintain your account. We store it through our authentication provider (Supabase) as your account identity. We do not use Google user data for advertising, profiling, or training AI models, and we never sell it or share it with third parties except the infrastructure providers needed to operate the service (such as our hosting and auth provider). You can revoke WatchWallet's access at any time from your Google Account permissions, and deleting your WatchWallet account removes this data as described below.

WatchWallet's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Retention

We keep your reports until you delete them. Deleting a report or your account is a hard delete — the rows are gone, not flagged.

No selling, no trackers

We don't sell or share your data. There are no ad trackers or third-party analytics scripts on app pages. The business model is $9.99 at a time.

Deletion requests

Use the delete buttons in the app (they work immediately), or email support@watchwallet.app and we'll do it for you.