The full text below is what applies. The "In plain words" boxes explain each part in everyday language and do not change it.
The short version
- Welfry free and Welfry Local keep your month on your phones. We never receive it and cannot read it.
- Welfry Cloud keeps your household's month on our servers in the EU, so every phone in the household shows the same month. We use it only to run your household's Welfry.
- Receipt photos never reach us. Your phone reads a receipt, and Welfry keeps what you checked, not the picture.
- There are no ads, we sell no data, and there are no third-party trackers. Not in the app and not on this website.
- Welfry never asks for your bank login. There is no bank connection of any kind.
- On every plan you can export your household's records at any time, and with Cloud you can delete your account in the app. Neither ever costs anything.
In plain words
Free and Local keep everything on your phones. Cloud keeps your household's month on our servers in the EU so every phone shows the same thing. We show no ads, sell no data, never see your receipt photos and never ask for your bank login.
Who we are
Welfry is published and run by WoopsyLoopsy, obrt za dizajn, proizvodnju, trgovinu i usluge, vl. Anamarija Kukulj, a sole-trader business (obrt) registered in Croatia, with its seat at Ulica Gustava Krkleca 20, 10000 Zagreb, Croatia. Registered in the Obrtni registar under MBO 99281490. Not in the VAT system.
For anything about your data, write to hello@welfry.com or call +44 7350 333901. WoopsyLoopsy, vl. Anamarija Kukulj, is the controller of the personal data described in this policy, and "we" in this policy means WoopsyLoopsy, vl. Anamarija Kukulj.
We have not appointed a data protection officer. The law requires one only for large-scale monitoring of people or large-scale processing of sensitive data, and Welfry does neither.
In plain words
Welfry is published by WoopsyLoopsy, vl. Anamarija Kukulj, a small business in Zagreb, and it is responsible for your data. Questions about it go to hello@welfry.com.
Welfry free and Welfry Local
With Free and with Local there is no Welfry account, and nothing about your household reaches our servers.
- Free stays on one phone. Free is for one person, and the month is kept only on that phone.
- Your month stays on your phones. Envelopes, entries, commitments, goals and scanned receipts are stored on the phone that made them.
- With Local, the household's phones share a month through iCloud. Each member's phone encrypts the household's data before it goes into that member's own iCloud, and the other phones read it from there. Apple stores the encrypted data under each member's own agreement with Apple. Neither Apple nor we can read it.
- We cannot recover it. Because we never hold your data or its key, we cannot restore it if you lose your phones. Export a copy from time to time (Profile, Privacy and data, Export).
- Deleting it. Delete the app on each phone. With Local, each member then removes Welfry's data from their iCloud (Settings, your name, iCloud, Manage Storage, Welfry). There is nothing left on our side to delete.
The only thing that can reach us from a Free or Local household is what you choose to send us, such as an email. When you buy Local, Apple tells us that a purchase was made, without telling us who you are.
In plain words
Free keeps everything on your one phone. With Local, your household's data lives on your phones and in each member's iCloud, encrypted so that only your household's phones can read it. We never get it, so we cannot recover it for you either. Export a copy now and then.
Welfry Cloud: what we keep and why
With Cloud your household's month is kept on our servers so that every member's phone shows the same month. Everything below is used only to run Welfry for your household.
| What | Why | Legal basis | How long |
|---|---|---|---|
| Your email address and your name, and, if you sign in with Apple, the identifier Apple gives us and a token that lets us revoke Welfry's access | To run your account and sign you in | Contract | Until you delete your account, and then until Apple confirms the revocation, at most 30 days |
| The household's month: the household's name, home currency and the day its month starts; the people in it and who is an admin; accounts, categories, envelopes, income sources, goals and debts; commitments, and which of their payments are marked paid or skipped; and entries (amount, currency and its value in the home currency, date, shop, note, envelope, account, who paid, and the goal, commitment or debt an entry belongs to) | It is the service: the same month on every phone in the household | Contract | As long as the household exists |
| Who logged each entry | So the household can see who added what, which members expect | Contract | As long as the household exists, see account deletion |
| A scanned receipt: the photo file's size, type and fingerprint (a hash), never the photo; who scanned it and when; and which reader on the phone read it and how sure it was. The entry made from it is part of the household's month | To record the purchase, and to notice the same receipt scanned twice | Contract | Until you delete the receipt or the household |
| Sign-in codes and links, and the email we send them in | To sign you in and confirm deletions | Contract | Codes expire within a day and are removed seven days later |
| An invitation code you create | So the person you give it to can join your household | Contract | An unused code stops working after 14 days and is removed seven days after that; a used one is kept with the household as the record of how someone joined |
| Signed-in devices: the device's name and kind, how you signed in, the app and system version your phone reports, and when the session was first and last used | To show you where you are signed in and to detect stolen sessions | Legitimate interest: keeping accounts secure | Removed 30 days after a session expires. A session expires 30 days after the device last used it, signed out or not, so it is gone at most 60 days after its last use |
| The household's month after its Cloud subscription ends | So you can export it or come back to Cloud without losing anything. Your phones keep their own copy, but they no longer sync with each other | Contract | At least 30 days after the last paid day, and at least 7 days after we email the household's admins that it is going, then deleted from our servers. After that we keep only which accounts were its members, for one year, so that only they can keep their copy. If you sign in to bring the household back and do not take Cloud, the empty household made for it on our servers is deleted 30 days later; your phones keep their copy. |
| Subscription status and the events Apple sends us about it | To know whether the household has Cloud, and to answer billing questions | Contract | While the household exists, then five years, the general limitation period under Croatian law |
| Whether scanning read each field of a receipt correctly (right or wrong for each field, never the value read or the value you kept) | To make scanning better | Legitimate interest: improving the feature you use | 400 days |
| Emails you send us, including complaints | To answer you | Contract, and the legal duty to keep complaint records | One year after the matter is closed |
You share the code yourself, by message, QR code or however you like. We never learn who you send it to.
Where we rely on a legitimate interest, you can object at any time by writing to us, and we will stop unless the interest clearly outweighs yours.
You need an email address to use Cloud, because that is how you sign in. You can always use Free or Local instead, which need no account.
We do not make automated decisions about you and do not build profiles.
In plain words
With Cloud we keep what your household logs so every phone shows the same month, plus what we need to sign you in and keep accounts safe. Each item has its own time limit. You can object to anything we keep because of our own legitimate interest, and we never build a profile of you.
Crash reports and usage statistics
Welfry collects neither, in the app or on this website, apart from the scan results in the Cloud table above: whether scanning read each field of a receipt right, kept for 400 days. If we ever add crash reports or usage statistics, they will be two switches in Profile, Privacy and data, both off until you turn them on, and this policy will say so before the app that has them is released.
In plain words
Welfry collects no crash reports and no usage statistics. The one exception is, with Cloud, whether each scan read a receipt right. If that ever changes, you will have to switch them on yourself.
Sensitive information
Your entries can reveal more than money. A pharmacy purchase can say something about health, a donation about beliefs. We use your entries only to run your household's Welfry. We never analyse them, never use them to target anything, and never share them. The full text of a receipt, which can list every item, is never kept on our servers: your phone reads it, and only what you check is saved.
In plain words
What you buy can say a lot about you. We use your entries only to run your household's Welfry, and the full text of a receipt is never kept on our servers.
Who else is involved
- Hetzner Online GmbH, Germany, runs our servers and databases, this website and our email (hello@welfry.com).
- Scaleway SAS, France, sends our sign-in and service emails.
Both act only on our instructions, under data processing agreements, and keep the data in the EU.
- Apple sells Welfry in the App Store, takes payment and handles refunds, and runs Sign in with Apple if you use it. Apple does this as an independent company under its own privacy policy. We never see your card details. When Welfry comes to Android, Google will do the same through Google Play and Sign in with Google.
Our servers and email are in the EU, and we do not send your personal data outside the EU ourselves. Sign in with Apple, including revoking it when you delete your account, and the checks of your purchases reach Apple's servers, which can be outside the EU. Apple handles that under its own terms.
Reminders about payments are made by your phone itself. We do not send push notifications.
In plain words
Two companies help us, both in the EU: Hetzner runs our servers, this website and our mailbox, and Scaleway sends our emails. Apple handles payments and its sign-in under its own rules, and its servers can be outside the EU.
How long we keep it
The table above gives each period. In short: your account until you delete it, your household's month as long as the household exists, security and housekeeping records for days or weeks, and billing and complaint records for as long as the law asks.
Backups of our databases roll off within 30 days, so anything deleted is gone from backups by then.
In plain words
We keep each thing only as long as the table says. Backups clear themselves within 30 days.
When you delete your account
You can delete your Cloud account in the app (Profile, Privacy and data, Delete account). If you are the only admin of a household you share, first make someone else an admin there. Once you confirm, the deletion takes effect at once.
- Your account, your sign-in details and your devices are deleted.
- A household where you were the only member is deleted with everything in it.
- In a household you share, the money facts you logged stay, because they are part of the other members' month too: amount, date, envelope and account. Your name is removed from them and they show as logged by a former member. Notes you wrote on entries are deleted.
- If you sign in with Apple, we also revoke Welfry's access to your Apple Account.
- An active subscription is billed by Apple until you cancel it there. The app shows you the link before you confirm.
In plain words
Deleting your account removes you at once, once another member is an admin of any household you share. In a household you share, the amounts you logged stay for the others without your name, and your notes are deleted. A subscription you pay through Apple has to be cancelled with Apple.
Your rights
You can ask us at any time, free of charge, to:
- see what we hold about you, and get a copy (Profile, Privacy and data, Export gives you your household's records; write to us for anything else we hold);
- correct it (most of it you can edit in the app yourself);
- delete it (Delete account in the app, or write to us);
- restrict how we use it while a question is settled;
- take it with you in a common format (the export is a JSON file of your household's records);
- object to anything we do on the basis of a legitimate interest;
- withdraw consent where we rely on it, such as the Android list below, as easily as you gave it.
Write to hello@welfry.com. We answer within one month. If a request is complex we may need two more months, and we will tell you within the first month. We may ask you to confirm it is you.
In plain words
You can see, correct, download or delete what we hold about you, and object to how we use it. Write to us and we answer within a month.
Children
Welfry is not made for children. You need to be at least 18 to have a Welfry account. Children do not get their own account; a parent plans for them, an allowance for example, inside the parent's own household.
In plain words
You must be 18 or older to have an account. Parents plan for their children inside their own household.
Security
What we do: sign-in without passwords (Sign in with Apple, or an emailed code or link; Sign in with Google comes with the Android app); our own sign-in tokens stored only as one-way hashes, and the token Apple gives us when you sign in with Apple kept encrypted, only so we can revoke Welfry's access when you delete your account; households kept apart in the database itself, so one household's data cannot be read through another's; stolen sessions detected and ended; receipt photos refused by our servers; everything sent over encrypted connections.
What we have not done yet: a paid, independent security test. We are a small business and will commission one as Welfry grows. If you find a security problem, write to hello@welfry.com and we will answer quickly.
In plain words
We protect accounts without passwords, keep households apart and encrypt everything on its way. No outside firm has tested our security yet.
This website
welfry.com sets no cookies, loads nothing from other companies and has no analytics. Our web server keeps a short log of requests (the address of the page, the time, the answer it gave, and your IP address with its last part removed), to keep the site running and safe. It does not log your browser or the page you came from. Those logs are deleted after seven days, and no backup copy of them is kept longer than 14 days. Legal basis: legitimate interest in running a secure website.
In plain words
This website uses no cookies and no tracking. Our server keeps a basic log of visits, without your full IP address, for at most 14 days.
Hearing when Welfry is on Android
If you leave your email address on this website to hear when Welfry is on Android, we keep that address, when you left it, when you confirmed it and when we last wrote to you, and a scrambled copy of the code in your confirmation link. Nothing else. We first send one email asking you to confirm it, so nobody can sign you up but you. Once you confirm, we send one more email, on the day Welfry for Android launches, and then delete the address.
- Legal basis: your consent, which you give by confirming the address. Every email has a link to remove yourself, and that deletes the address at once.
- An address that is never confirmed is deleted after seven days.
- It is stored on our servers in the EU and used for nothing else.
In plain words
Leave your email and we send one email to confirm it, then one more on the day Android launches, and then we delete it. You can remove yourself at any time, and an address nobody confirms goes after seven days.
Complaints
Tell us first at hello@welfry.com, and we will try to put it right.
You can also complain to the Croatian data protection authority, Agencija za zaštitu osobnih podataka (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, azop@azop.hr, +385 1 4609 000, azop.hr. Or to the data protection authority in the country where you live or work.
In plain words
Tell us first. You can also complain to the Croatian data protection authority, or to the one where you live or work.
Changes to this policy
If we change this policy, we change the date at the top. If a change affects what we do with your data, we tell you in the app and, with Cloud, by email before it takes effect.
In plain words
If we change this policy, the date at the top changes. If a change affects what we do with your data, we tell you before it applies.