Privacy Policy

1. Who we are

Welfi is operated by Tannous Hanna Al Kass Hanna, an individual developer (“Welfi”, “we”, “us”). We are the data controller for the personal data described in this policy. For any privacy question or request, email info@welfi-app.com.

2. Information we collect

• Account information: your name, email address and how you sign in (email and password, Google or Apple). With Sign in with Apple you can hide your email, in which case we receive an Apple private relay address. With Google we also receive your profile photo, if you have one. We never receive your password itself: your device turns it into encryption keys and sends us only a value we can use to check it.
• Profile and preferences: profile photo (if you add one), country, language, base and display currencies, notification settings, dashboard layout and similar app preferences. Your date of birth (asked at sign-up on the web to confirm you are 18 or over) and your income details are stored encrypted.
• Financial information you enter or import: accounts, balances, transactions, categories, budgets, recurring bills and income, savings goals, assets, debts, investments, gold and crypto holdings, scenarios, retirement and end-of-service plans, and receipts or files you attach to transactions.
• AI conversations: if you use the AI assistant, your saved chats are stored encrypted. If you report an AI reply, we store that reply (with numbers masked) and your reason so we can review it.
• Shared households (Circles):the households you create or join, their members and roles, and the household’s shared transactions, balances and settlements. When you invite someone, we store the email address you enter for them — that person may not have a Welfi account yet. Welfi does not email the invitation link; you share it yourself.
• Referrals and rewards: your referral code, the people who signed up with it, and your reward-points history.
• Support: messages you send us in the app or by email, their attachments, and our replies.
• Bank alerts (optional):if you set up automatic capture, the text of the alerts your automation sends us — see section 5.
• Purchases: your plan and subscription status. Payments are handled by Paddle (web) and Apple (App Store); we do not receive your full card details.
• Device and technical information: your IP address; device type, operating system and app version; push-notification tokens (with device name, language and time zone) if you allow notifications; error and crash reports; which screens of the app you open and how often you use its features (our own first-party usage analytics, described below); how you found us when you signed up (referring website, campaign tags and landing page); whether our emails were delivered and opened; and, on our public website, visit statistics that use a daily-changing hash of your IP address and browser instead of a cookie.
• Analytics cookies (website and web app, optional): only if you accept analytics cookies, PostHog records the pages you view. Session recording, heatmaps and automatic click capture are turned off.

Usage analytics in the apps (web, iPhone and Android):when you are signed in, Welfi records which screens you open (for example “/transactions”) and counts the actions you take (for example “added a transaction” or “asked the AI assistant”), together with the platform (web, iPhone or Android) and the time of a screen view. Actions are stored only as a count per action per day. These records are linked to your account but never contain amounts, balances, names, descriptions, merchants, notes or any other financial details — identifiers in a screen address are replaced before anything is stored. They stay on our own servers, are not shared with any third party, and are used only to see which features people use and to improve Welfi. You can turn this off at any time (section 12).

No session recording, heatmaps or click replay: Welfi does not use session recording, screen recording, heatmap or click-replay tools on the website or in the apps. We do not record your screen, your mouse movements, your taps or what you type.

3. How we use your information and our legal bases

We use your information only for the purposes below. If you are in the EU or the UK, the right-hand column shows the legal basis we rely on under the GDPR and UK GDPR.

We do not sell your personal information and we do not share it for cross-context behavioural advertising. Welfi shows no ads and contains no advertising or tracking SDKs. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

4. What is encrypted, and what we can see

Since July 2026, on-device encryption is mandatory for every account. If you sign in with Google or Apple, you unlock your encrypted data on your device (for example with a passkey or Face ID), with a Recovery Code as a backup.

Encrypted on your device — we cannot read it: amounts and balances; the names, descriptions, merchants and notes of your accounts, transactions, assets, debts, goals, budgets, recurring items, holdings and plans; your income details and date of birth; receipts attached to transactions; your saved AI chats; and notifications that contain amounts.

Stored in readable form, because the service needs it: your email address, name and profile photo; your country, language and currency preferences; account and asset types; category names; transaction dates and types (such as income, expense or transfer); recurrence settings (such as how often a bill repeats); the links between records (such as which account a transaction belongs to); your plan and subscription status; device push tokens; support messages and their attachments; AI replies you report; the web domains of banks and merchants whose logos we look up; and the technical and usage data described in section 2.

Older accounts: accounts created before on-device encryption launched were migrated to it. For some of these accounts, older records may still be held in readable form on our servers until a clean-up completes. If you would like us to check your account, email info@welfi-app.com.

5. Information we process without storing it

• Statement and app imports: when you import a bank statement or an export from another money app in the iPhone or Android app, the file is uploaded to our servers, read in memory to extract the transactions, and the result is returned to your device, which encrypts it before saving. The file and any PDF password are not stored. On the web, these files are read in your browser. We keep a record of each statement import (bank name, file type, number of transactions and whether it succeeded) and, when a file yields no transactions, a technical description of the failure that contains no transaction details.
• Bank alerts:if you set up an automation on your device that sends bank or card alerts to Welfi — for example a text message, email or app notification from your bank, or a tap-to-pay notification (on iPhone this is done with the Shortcuts app) — the text of each alert is sent to our servers so we can read the amount, merchant, date and type. Welfi cannot read your messages or notifications on its own: nothing is sent unless you create the automation. The alert text is not stored; at most we keep a short one-way fingerprint of it so the same payment is not recorded twice. If you have given AI consent, the alert is read by your AI provider; otherwise a non-AI parser on our servers reads it.
• Asset valuation:to estimate an asset’s value, the details you enter (such as type, model, year or location) are sent to our servers and priced with built-in tables and market, metal and crypto price feeds. Those price providers receive only ticker symbols, coin identifiers, metal symbols and currency codes. If our tables cannot price an item and you have given AI consent, its details are sent to OpenAI for an estimate (section 6).
• Logos:to show bank and merchant logos, our logo service looks up the institution’s web domain (for example examplebank.com) with logo.dev, Google’s favicon service, icon.horse or the institution’s own website, and caches the image. When you search for a brand, the search text is sent to logo.dev. In some places the web app and the Android app load a logo directly from Google, icon.horse or the institution’s website, which then also sees your IP address. None of these services receives your identity or your financial data.

6. AI features

AI features work only after you give AI data-sharing consent in the app. You can withdraw it at any time in the app’s AI settings (Settings → AI) or by emailing us; the choice applies to your whole account on every device. When consent is on, the following is sent to the AI provider:

• AI assistant: your question, the recent conversation, and a summary of the figures relevant to it, prepared on your device.
• Chat titles: the first question and answer of a chat, to suggest a title.
• Statement-format learning (web): an excerpt of up to about 6,000 characters of a statement’s text, which can include transactions and other details printed on it. We keep only the layout rules learned, the bank name and the card type.
• Asset-readiness insights: the item you are planning to buy and its price, and a summary of your income, spending, savings and top spending categories.
• AI asset valuation: the asset’s type and details and your country, for items our tables cannot price. This always goes to OpenAI.
• Bank-alert reading: the text of the alert.

Our default provider is Anthropic. If you choose OpenAI or Google Gemini in the AI settings, requests go to that provider, using Welfi’s API key or your own. If you configure a custom endpoint, that service receives what is sent to it, under its own terms. If you enter your own API key, we store it on our servers so we can make requests for you.

Our default provider, Anthropic, does not use API data to train its models. If you choose another provider, that provider’s terms apply. Without consent, no AI feature runs, and bank alerts are read by a non-AI parser on our servers.

7. Shared households (Circles)

When you join a household, its members can see the household’s transactions, balances and settlements. Household data is encrypted with a separate household key that is shared only with its members. Your personal accounts are not shared unless you move one into the household. If you leave, or delete your account, what you contributed to the household stays visible to its remaining members.

8. Service providers

We use the providers below to run Welfi, and share with each only what it needs. Paddle (the seller for web purchases) and Apple (for App Store purchases) process payment data as independent controllers under their own privacy policies.

We may also disclose information if the law requires it, or where necessary to protect the rights, property or safety of our users or others. If Welfi is transferred to a company in the future (for example when it is incorporated), your information would transfer with it and remain protected by this policy, and we would tell you.

9. International transfers

Our providers are mainly in the United States and the European Union, so your information may be processed outside your country. These transfers rely on standard contractual clauses or equivalent safeguards offered by those providers.

10. Cookies and local storage

• Necessary: a sign-in cookie that keeps you logged in, and a cookie that remembers your language (for up to one year).
• Your choice: your cookie choice is saved in your browser’s local storage. Clearing this site’s data in your browser brings the banner back.
• Sign-up attribution: the website you came from and any campaign tags are kept in local storage (not a cookie) and saved with your account when you sign up.
• Analytics: PostHog loads only if you accept analytics cookies, and stores its identifier in local storage.
• Website statistics: our own visit counter on the public website sets no cookie and stores nothing on your device. It keeps the page, the referring website, your country, your device type and a hash of your IP address and browser that changes every day, so it cannot follow you from one day to the next.
• Usage analytics: if you turn off “Share usage analytics”, the web app remembers your choice in local storage as well as on your account.

11. How long we keep your information

12. Your rights

Depending on where you live, you have the right to access, correct and delete your personal data, to receive it in a portable format, to restrict or object to its processing, and to withdraw consent at any time without affecting earlier processing.

• Delete your account: Settings → Account → Delete account, in the web app and in the iPhone and Android apps. Deleting also revokes Welfi’s access to your Apple or Google sign-in, and we send you a confirmation email.
• Export your data: Settings → Data → Export data saves your transactions as CSV, Excel or PDF. The file is built on your device. For a copy of other information we hold, email us.
• Correct your data: edit it directly in the app, or email us.
• Withdraw AI consent: turn off AI data sharing in Settings → AI.
• Object to usage analytics: turn off “Share usage analytics” in Settings → Security → Privacy in the web app, or in Settings → Privacy & Security in the iPhone and Android apps. It applies to your whole account on every device; from then on we stop recording your screens and actions. To also delete what was already recorded, email us.
• Withdraw analytics-cookie consent: clear this site’s data in your browser to bring the cookie banner back, then choose “Reject non-essential”.

California residents (CCPA/CPRA): you have the right to know what personal information we collect and how we use it, and to delete and correct it. We do not sell or share personal information, and we do not use sensitive personal information except to provide the service. We will not discriminate against you for exercising your rights. You may use an authorised agent.

To exercise any right, use the app or email info@welfi-app.com. We may need to confirm your identity first. We respond within 30 days (one month under the GDPR). If you are in the EU or the UK, you also have the right to lodge a complaint with your local data-protection authority (in the UK, the Information Commissioner’s Office).

13. Security

We protect your information with encryption in transit (TLS) and on-device encryption of your financial details. On iPhone and Android, the keys are kept in the device’s secure storage (Keychain or Keystore) and stay on that device. You can add passkeys to sign in and unlock. Staff access to our systems is restricted and protected by two-factor authentication. No system is perfectly secure, so we cannot guarantee absolute security; if a breach affects your personal data, we will notify you and the authorities as the law requires. See How we protect your money data for details, including what this protection does and does not cover.

14. Children

Welfi is for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it. If you believe this has happened, contact info@welfi-app.com.

15. Changes to this policy

We will update the “last updated” date above whenever we change this policy. For material changes, we will notify you by email or in the app before they take effect.

16. Contact

For any question about this policy or your data, email info@welfi-app.com.