How Wealvo handles data, in plain words. The short version: your ledger stays on your phone.
Wealvo is published by Gabix (info@gabix.si). Gabix is the controller within the meaning of the GDPR. Wealvo is a personal finance overview on your device. We are not a bank or a payment institution, and we do not hold accounts for you.
Your entries, accounts, goals, documents, settings and lock PIN are stored on the phone. The data is stored locally and encrypted at rest. There is no Wealvo cloud account for your ledger and we do not run a central database of your finances.
When you scan a receipt or a bill, a downsized photo is sent to our server (Supabase) and on to Google’s Gemini model, which reads the amount, merchant, date and fuel. For category suggestions, only a short entry text (for example the merchant name) is sent.
If you sign in with Google, an encrypted copy of your wallet is stored in the app’s hidden folder in your own Google Drive. The copy is encrypted on your phone with your passphrase, so we cannot read it, and we cannot recover it if you lose the passphrase.
If you create or join a shared wallet, changes travel through our server (Supabase), encrypted with the key from the invite. The server only sees encrypted packets and an anonymous device ID, never the content.
Subscriptions and the lifetime purchase are handled by Google Play and RevenueCat. We only receive the subscription status and an anonymous ID, never your card or payment details.
A PIN and, if you like, biometrics (fingerprint or Face ID) protect opening the app on this device. Biometric templates stay in the phone’s operating system; Gabix never receives them.
Where we process data, we rely on the following bases under the GDPR:
Google (Gemini, Google Drive, Google Play) and RevenueCat may transfer data to the United States. Where there is no adequacy decision, the transfer relies on the European Commission’s standard contractual clauses (Art. 46 GDPR).
Your financial data lives only on your device (and, if you use it, encrypted in your Google Drive) until you delete it or reset the app. We do not store receipt photos or AI texts. Shared-wallet data and the usage counter are kept only as long as needed for their purpose.
Under the GDPR you have the right to:
Because you hold the data yourself, you can edit, export or delete it at any time, or erase it by resetting the app. For any request, write to info@gabix.si.
You have the right to lodge a complaint with a data-protection supervisory authority, in particular in the EU member state of your habitual residence or workplace, or where the alleged infringement took place. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec).
If this policy changes in a meaningful way, we update the date at the top of this page. The current version is always the one published here.