Your money is yours to see

Wealthit is a personal finance app. This privacy policy says what it keeps, why, where, who else handles it, and what you can do about it.

Last updated 17 October 2026.

No tracking, no advertising and no analytics.
Nothing about you is sold, rented or shared with anyone for their own use.
Nobody reads your records. They are used to keep your phones in step and to work out the figures the app shows you.
Receipt photos and your profile picture stay on your phone.

Who is responsible

Wealthit is made by Faisal Mukhtar, who is responsible for the data described here. This policy covers the Wealthit app and this website. Write to support@wealthit.app about anything on this page.

What Wealthit keeps

Your email address, to sign you in and to send you sign-in links and codes.
Your account’s id, so your records are yours and nobody else’s.
What you record: your wallets, transactions, categories, labels, budgets, scheduled payments, goals, the people you share costs with, your settings, and the name you give yourself in the app. It is kept so a lost phone loses nothing and every phone you sign in on shows the same money.
If you sign in with Google or Apple, they tell Wealthit your email address and an id for that account. Wealthit never sees your Google or Apple password. If you choose Apple’s “Hide My Email”, Wealthit only ever sees the address Apple gives it.
A password, only if you set one, stored only as an Argon2 hash, never the password itself. Sign-in codes are stored only as a keyed hash, and expire after ten minutes.
When you joined and when you last used Wealthit, and a sign-in session for each phone you are signed in on, so you stay signed in. Logging out ends that phone’s session.

What the app asks your phone for

The camera, only when you take a photo of a receipt.
Your photos, only the one you pick, for a receipt or your profile picture.
Face or fingerprint unlock, only if you turn on the app lock. The phone checks it and tells the app yes or no.
Notifications, only for the reminders you set up, which the phone schedules itself.

Wealthit never asks for your location, your contacts or your bank login. You can say no to any of these and still use the app.

What stays on your phone

Receipt photos. Read on the phone and kept with that record on the phone. They are not uploaded.
Your profile picture. Copied into the app and kept on the phone.
Your app lock PIN. Held in the phone’s own secure storage. Face ID, a fingerprint or face unlock is checked by the phone; the app is only told yes or no.
Sample data. If you explore with sample data, it never leaves the phone and is never added to your account.
Tap to Record. If you set it up with Apple Pay, the amount, the shop and the card’s name (as your wallet shows it, never its number) are handed to the app on the phone. The payment becomes a record like any other, and the card’s name is kept with your settings so the next payment finds its wallet.
Widgets and reminders. Drawn and scheduled on the phone, by the phone. There are no push notifications.

Where it is kept

On your phone, and on Wealthit’s server: an application server run by Render and a database run by Neon, both in Frankfurt, in the EU. Every connection is encrypted. Each account’s records are kept apart by the database itself.

Who else handles it

A few services run parts of Wealthit. Each one handles your data only to do that job for Wealthit, never for its own use:

Render runs the application server and Neon runs the database, both in Frankfurt.
Resend sends the sign-in emails. It receives your address and the message, and nothing else.
Zoho Mail receives the emails you send to support@wealthit.app. A message is kept only as long as it takes to help you.
Vercel runs, in Frankfurt, the design service the app asks for its look, and Wealthit’s own admin page. The admin page lets the person who runs Wealthit see that an account exists, when it joined, when it was last used and how many records it keeps, never what those records say. It can find an account by its email address to sign it out or delete it when you ask, it needs a password, and every change made with it is written to a log nobody can edit.
Apple and Google, only if you choose to sign in with them, as described above.

Wealthit only uses services whose terms commit them to protect your data at least as well as this policy does. Nothing about you is sold, rented or shared with anyone else, unless the law requires it.

Keeping it safe

Every connection between the app, the server and these services is encrypted.
Passwords and sign-in codes are only ever stored as hashes.
The database itself keeps each account’s records apart, so one person’s session can never read another’s.
Your IP address is used for a few minutes to stop too many sign-in tries in a row. It is held in memory only and never stored.
The server’s logs say what went wrong, never who it happened to: no email addresses, no codes, no records.

Why Wealthit can use it

To give you the service you signed up for: your account, your records, and the same money on every phone you sign in on.
To keep it secure: stopping repeated sign-in tries, and signing out or deleting an account when you ask.
Because you turned it on: daily exchange rates, Tap to Record and reminders. Turn them off and they stop.

Other requests the app makes

Exchange rates. To convert between currencies, the app asks open.er-api.com for the day’s published rates. The request carries your main currency and nothing else. You can turn it off in Currency & format → Download daily rates.
The app’s look. The app asks Wealthit’s own design service for its current colours and text sizes. The request carries nothing about you or your records.

Like any request on the internet, these come from your phone’s IP address. Nothing is kept that links them to you.

Your choices

Export your records at any time, as a backup file or a spreadsheet, from Advanced settings → Your data.
Log out from the side menu. Your records stay in your account.
Turn things off. Stop the daily exchange rates in Currency & format, and remove Tap to Record by deleting its automation. Wealthit stops using them at once.
Ask for a copy of what Wealthit holds about you, or for a correction, by writing to support@wealthit.app from the address you sign in with.
Delete your account, as described below.

You can also complain to the data protection authority where you live. We would rather hear from you first: a person reads every message.

Deleting your account

In the app: open your profile (your picture at the top of Home or of the side menu), then Delete account.
Without the app: write to support@wealthit.app from the address you sign in with and ask for your account to be deleted. It is deleted straight away, and you get a reply when it is done.

What is deleted: your account, your email address, your account’s id and everything you recorded, with your settings. From the app, you are signed out on every phone and that phone is cleared, and 60 days later all of it is deleted from the server for good. Changed your mind? Sign in before then and everything comes back. If you signed in with Apple, Wealthit hands that sign-in back to Apple straight away. Receipt photos and your profile picture were only ever on your phone; they go when you delete the app.

How long it is kept

For as long as you have an account. When you delete it, it is removed for good 60 days later, unless you sign in again before then. The database keeps a recovery history of the last six hours of changes, so once something is deleted for good, it is gone from that history within six hours as well. Emails you send to support@wealthit.app are kept only as long as it takes to help you.

Children

Wealthit is a personal finance app for adults. It is not directed at children, and it does not knowingly keep anything about a child.

This website

The page you are reading is a static file, hosted by GitHub Pages. It sets no cookies, runs no analytics and embeds nothing from anywhere else. GitHub can see the ordinary request logs any web server keeps (an IP address, a page, a time), and that is the only record of your visit. If you switch the site between dark and light, that choice is saved in your own browser and never sent anywhere.

Changes

If the app starts doing something this page does not describe, this page changes first, and the date at the top changes with it.