In short
- Your financial data is stored on your phone. Without signing in, no server keeps your records. If you choose to sign in with Google or Apple for backup and sync, a copy is stored on our server (see below).
- No ads, no tracking, no data sold or shared for marketing.
- Only AI features you use yourself send data off the phone, and only to process that request.
Data stored on the phone
Transactions, accounts, categories, budgets, savings goals, receipt photos, settings and the "Notifications read" log are stored in the app's storage on your phone. Uninstalling the app deletes them. Backup files are only made when you ask, and you choose where they go. A backup file can be locked with a password (optional); the password is not stored anywhere, and without it nobody can read the file, us included.
AI features (optional)
When you record with a sentence, voice, a receipt photo, or ask for an AI summary, the following is sent to our server on Cloudflare Workers to be read by an AI model (Cloudflare Workers AI):
- the sentence you typed, or your speech after it became text;
- the receipt or payment photo you chose;
- for AI summaries: a period's summary figures (totals per category, top merchants), not your list of transactions.
This data is used only to answer that request and is not stored by us. Technical error logs may contain a short excerpt of the model's reply and are kept by Cloudflare for a few days for troubleshooting. To monitor the service, we record metadata about each AI request for 90 days: time, kind (sentence, photo or summary), success or failure, processing time, model and token counts. These records contain no sentence, photo, merchant, amount, IP address or device id.
Daily AI allowance. So everyone gets a fair daily AI allowance, the app creates a random id once when it is first used (not a device id, not linked to who you are) and sends it with AI requests, together with your phone's time zone (for example Asia/Jakarta) so the allowance refills at your midnight. If you are signed in, a plan proof from your account is used instead. The server keeps the daily usage count for a few days only, plus the time zone last used. The metadata records above include your plan (Free or Pro) and a one-way hash of that id, so we can count how many people use AI without knowing who they are.
Google or Apple account and sync (optional)
Signing in is optional; the app works fully without it. If you sign in with Google or Apple (Settings → Account & sync):
- a copy of your financial records (transactions and their details, accounts, categories, tags, budgets, periods, recurring transactions, savings goals, and recorded attachment/receipt data) is stored on our server on Cloudflare so it can sync between your phones and serve as a backup;
- with Google: your Google account's email, name and profile photo are stored to identify you;
- with Apple: the account ID Apple gives us and the email Apple shares (possibly an Apple "Hide My Email" relay address) are stored to identify you, as is your name if you share it the first time you sign in. We also keep a token from Apple, used only to revoke Sign in with Apple for this app when your account is deleted;
- if you sign in with Google and with Apple using the same email, both are one account with the same data;
- for each phone that signs in, we keep that phone's random ID, its model name, and the sign-in session (as a hash only);
- your display preferences (light/dark mode, accent colour and app language) are stored with your account, so another phone you sign in on looks the same right away;
- other app settings, the offline queue and the "Notifications read" log are not sent;
- this data is used only for sync and is not shared with anyone. Sign-in itself is handled by Google or Apple under their own privacy policies.
All data on the server is deleted when you choose Delete account in the app (Settings → Account & sync). Data on your phone stays. Signing out stops syncing without deleting the server copy.
Household book (optional)
If you create or join a household (Settings → Household):
- the household book's contents (transactions, accounts, categories, budgets, and who recorded each transaction) can be seen and changed by all its members;
- members see each other's account name, email and photo (if any);
- your personal book is never visible to other members;
- invite codes are stored on the server only as an HMAC, work for 7 days and once;
- if you leave or are removed, the book leaves your phone (a copy is kept there as a backup file) but stays for the other members. If the owner deletes the household, it is deleted from the server for everyone. If the owner deletes their account, the longest-standing member becomes owner.
Buying Wangku Pro (optional)
Wangku Pro is bought through Google Play (on Android). Payment is handled entirely by Google Play; we never see or store your card, account or payment details. To check purchases the app uses RevenueCat (an in-app purchase service provider): RevenueCat receives your Wangku account id (a random id from our server, not your email) and the purchase record from Google Play (product, time, store, transaction id), and our server asks RevenueCat whether your account bought Pro. Our server keeps that purchase record (no payment details) while your account exists; Delete account removes it. RevenueCat keeps its data under the RevenueCat privacy policy.
Voice
Speech recognition uses the phone's built-in speech service: Google on Android, Apple on iPhone. It may process your voice on the phone or on their servers under Google's or Apple's privacy policy. The app does not store voice recordings.
Reading bank and e-wallet notifications (optional, Android only)
This feature is off until you turn it on and grant notification access in Android. Then:
- the app reads notifications only from the bank/e-wallet apps you pick; notifications from other apps are ignored and never stored;
- notification text is read on the phone to create draft transactions and is never sent to any server;
- notification text is kept on the phone for at most 30 days so you can review it in "Notifications read", then deleted;
- everything lands in "To review" as a draft and does not count until you confirm it.
Other permissions
- Camera and photos: only when you take or pick a receipt.
- Microphone: only when you record by voice.
- Biometrics: for the app lock, checked by Android or iOS (Face ID/Touch ID); the app never receives fingerprint or face data.
App updates
The app checks for updates with Expo's service (EAS Update). These requests carry technical information such as the app version and platform, never your financial data.
Children
The app is meant for users aged 18 and over and does not knowingly collect children's data.
Deleting data
You can delete everything on the phone with Settings → Security & data → Erase data on this phone, or by uninstalling the app. If you ever signed in with Google or Apple, also delete the server copy with Delete account in Settings → Account & sync, or ask by email below.
Contact
Privacy questions: yogy.prakoso.yogy@gmail.com
This policy may change; the effective date above always shows the latest version.