Privacy Policy
Last updated: October 21, 2026
This policy explains what personal data Balance collects, why, who it is shared with, how long it is kept and what your rights are. It covers the Balance apps for iPhone, iPad, Mac and Android, the web app at web.balancebudgetapp.com (together, the "app") and the website at balancebudgetapp.com (the "website").
In short: you sign in with Google, Apple or email; the budget data you enter is stored on servers in the European Union and shared only with the people you invite into your household; we do not sell your data, we do not show ads in the app, and you can delete your account at any time from the app's settings.
1. Who is responsible for your data
The data controller is:
Wellcode S.r.l.s.
Via Reggio 5/A, 42015 Correggio (RE), Italy
VAT no. IT02956860353
Email: info@wellcode.it
Write to that address for any question about this policy or to exercise your rights (section 12).
2. The data we collect
Account data
When you create an account we receive your email address, your name and, if you sign in with Google, the URL of your Google profile photo. With Apple we receive your name and email address, or the private relay address Apple creates if you choose to hide yours. With email and password we receive the address and the name you type; the password is handled by Firebase Authentication and we never see it. We also assign you a user ID.
Profile
The name shown to your household, an optional profile photo you upload (re-encoded on your device, which strips its metadata), your language, your notification preference, and whether onboarding is complete.
Household and budget data
Everything you enter to keep your budget: the household's name, currency and time zone; expenses and income with their amount, date, category, description and payment method; who paid and how a cost is split; recurring entries; categories and budgets; payment methods (only the name, icon and colour you choose — never card or account numbers); emoji reactions; and receipt photos you attach. Receipt photos are resized and stripped of their metadata, including location, before they leave your device.
Balance does not connect to your bank and never receives bank credentials, card numbers or account statements. Every figure in the app is one that you or a member of your household typed in.
Invitations
Each household has an invitation code, which is part of the link you share with your partner. We keep a record of used codes for 12 months to prevent their reuse.
Subscription data
If you subscribe to Balance Premium, the store (Apple App Store or Google Play) or, on the web, our reseller Paddle processes the payment. We never receive your card details. We do receive, through RevenueCat, the information needed to unlock Premium: the product, the store, the price and currency, the dates of purchase, renewal and expiry, trial status and the country of the store account.
Device and technical data
- Push notification token, the platform and the app version, so that we can send notifications to your device.
- Crash and error reports: device model, operating system, app version, the technical details of the error, and your user ID so that we can investigate a problem you report.
- Usage events: which screens are opened and a few key actions (such as signing up, completing onboarding, adding the first expense, accepting an invitation or exporting data), together with your user ID and coarse device information. We do not collect your device's advertising identifier.
- Install source: on Android, whether the app was installed from one of our Google Ads campaigns and which one (we do not store the click identifier); on the web, the campaign parameters of the link that brought you to us.
- Server logs: IP address, user ID and time of each request to our servers, kept for security and troubleshooting.
When you contact us or use the feedback board
If you email us we receive your address and whatever you write. If you open our feedback board, roadmap or changelog from the app, you are signed in to it automatically with your user ID, email address, first name and language, so that your posts and votes are tied to your account. The board is a separate profile, hosted by Featurebase, and deleting your Balance account does not remove it. To have it removed, write to us at info@wellcode.it from the address linked to your account and we will remove it within 30 days; your posts, comments and votes stay, shown as coming from a deleted user, because other people may have voted or commented on them.
Newsletter
If you subscribe — from the website footer or when signing up in the app — we receive your email address and language.
Website visitors
The website has no account. It collects usage data through Google Analytics only as described in section 10, and the email address of whoever subscribes to the newsletter.
3. Google user data
If you choose Sign in with Google, Balance asks Google only for your basic profile: the standard
openid, email and profile permissions. It does not request access to your
Gmail, Google Drive, Google Calendar, contacts or any other Google service.
- What we access: your Google account ID, email address, name and profile photo URL.
- How we use it: to create your Balance account and sign you in; to show your name and profile photo to the members of your household; to identify your account when you contact support, when you subscribe to Premium and when you use the feedback board; and to send you the service messages described in this policy.
- How we store it: in Firebase Authentication (Google) and in our database hosted by Supabase in the European Union, protected by encryption in transit and by access controls.
- Who we share it with: the members of your household see your name, email address and profile photo. Your email address and user ID are passed to RevenueCat, which manages subscriptions for us, and — only when you open it — to Featurebase, which hosts our feedback board. If you opt in to the newsletter, your email address goes to SendFox. These providers process it on our behalf and only for those purposes.
- What we never do: we do not sell Google user data, we do not use it for advertising or to build advertising profiles, we do not use it to train artificial intelligence or machine learning models, and we do not transfer it to anyone except as described above or where required by law.
- How to delete it: deleting your Balance account (section 9) removes your Google profile data from our systems, apart from your feedback board profile if you ever opened the board, which we remove when you ask (section 2). You can also revoke Balance's access at any time from your Google Account, under Third-party apps & services; this stops future sign-ins with Google but does not by itself delete your Balance account.
Balance's use of information received from Google APIs adheres to the Google API Services User Data Policy.
4. Why we use your data and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating your account, signing you in, storing and syncing your budget across devices and with your household | Account, profile, household and budget data, push token | Performance of our contract with you (art. 6(1)(b)) |
| Notifications about your household's activity (a new expense, a reaction) and home-screen widgets | Name, amounts, categories, descriptions, push token | Performance of the contract (art. 6(1)(b)) |
| Selling and unlocking Premium, handling renewals and refunds | Subscription data, user ID, email address | Performance of the contract (art. 6(1)(b)); legal obligations for accounting and tax (art. 6(1)(c)) |
| Keeping the service secure and working, fixing crashes and errors | Crash reports, server logs, user ID | Legitimate interest in a secure, reliable service (art. 6(1)(f)) |
| Understanding how the app is used and measuring which campaigns bring new users | Usage events, install source, user ID | Legitimate interest in improving the app (art. 6(1)(f)); on the web app and on the website in the EEA, the UK and Switzerland, your consent (art. 6(1)(a)) |
| Occasional reminders and offers inside the app, such as a reminder to invite your partner or a Premium offer | Push token, language, sign-up and subscription dates | Legitimate interest (art. 6(1)(f)); you can turn notifications off at any time |
| Newsletter | Email address, language | Your consent (art. 6(1)(a)), which you can withdraw at any time |
| Answering support requests and running the feedback board | Email address, name, what you write | Performance of the contract (art. 6(1)(b)); legitimate interest (art. 6(1)(f)) |
| Complying with the law and defending our rights | Any data needed in the specific case | Legal obligation (art. 6(1)(c)); legitimate interest (art. 6(1)(f)) |
We do not use your data for automated decision-making that has legal or similarly significant effects on you, and we do not show advertising inside the app.
5. What your household can see
Balance is designed to be shared. Once someone joins your household, every member can see and edit the household's data: all transactions, descriptions and receipt photos, recurring entries, categories, budgets, payment methods and reactions. Members can also see each other's name, email address and profile photo. Notifications and home-screen widgets on your partner's devices show your first name and the amounts and categories you add.
When you accept an invitation to join a household, the household you had on your own — and the data in it — is deleted; the app warns you before this happens.
If you delete your account while other members remain, the transactions and photos you added stay in the household, because they are part of a shared budget, but they are no longer linked to your account. Your profile is deleted.
6. Who we share data with
We do not sell or rent personal data. We share it only with the providers that help us run Balance. They act as our processors, under contracts that bind them to use the data only on our instructions, except where the table says otherwise.
| Provider | What it does for us | Where |
|---|---|---|
| Supabase Inc. | Database and file storage for household data and receipt photos; server functions | European Union (Ireland) |
| Google Ireland Ltd / Google LLC (Firebase) | Sign-in (Firebase Authentication) and its emails, profile photo storage, push notifications (Firebase Cloud Messaging), crash reports (Crashlytics), usage analytics (Google Analytics for Firebase), legacy database (Cloud Firestore), website hosting | United States (profile photos, legacy database) and EU |
| Google Ireland Ltd / Google LLC (Google Ads) | Measuring the results of our advertising campaigns, using the analytics data described above | EU and United States |
| Apple Inc. / Apple Distribution International | Sign in with Apple; push notification delivery on Apple devices; App Store purchases (as seller) | EU and United States |
| Google Play (Google) | Purchases on Android (as seller) | EU and United States |
| Paddle.com Market Ltd | Purchases in the web app; Paddle is the seller and acts as an independent controller | United Kingdom |
| RevenueCat Inc. | Managing subscriptions across stores and unlocking Premium for your household | United States |
| Functional Software Inc. (Sentry) | Error reports from the web app | European Union (Germany) |
| CORDNET OÜ (Featurebase) | Hosting our feedback board, roadmap and changelog | European Economic Area |
| Sumo Group Inc. (SendFox) | Sending the newsletter, only to those who subscribed | United States |
We may also disclose data when the law requires it, for example to a court or a public authority, and to a buyer if Wellcode or Balance is ever sold, in which case this policy will continue to protect your data.
7. Transfers outside the European Union
Your household and budget data are stored in the European Union. Profile photos you upload and the legacy database used by older versions of the app are stored by Google in the United States, and some other providers listed above are based in the United States or may process data there. In those cases the transfer is covered by the EU-U.S. Data Privacy Framework, where the provider is certified under it, or by the Standard Contractual Clauses approved by the European Commission. Transfers to the United Kingdom rely on the Commission's adequacy decision. You can ask us for a copy of the safeguards that apply.
8. How long we keep your data
- Account, profile, household and budget data: for as long as your account exists. A household's data is deleted when its last member deletes their account.
- Receipt photos: until you remove them or the transaction they belong to; photos that were never attached to a saved transaction are deleted within 24 hours.
- Used invitation codes: 12 months.
- Usage events in Google Analytics: 2 months at event level; afterwards only aggregate reports.
- Crash and error reports: up to 90 days, as set by Crashlytics and Sentry.
- Subscription data: for as long as your account exists. When you delete it, we remove from RevenueCat your email address and the other details that identify you, within 90 days; the record of the purchases themselves — product, store, price, dates — stays, under an identifier that no longer leads to you, for our accounts and revenue reports. The seller — Apple, Google or Paddle — keeps its own record of the purchase under its own policy.
- Newsletter: until you unsubscribe, with the link at the bottom of every email.
- Support emails: for as long as needed to answer you and to handle any follow-up on the same issue.
9. Deleting your account
You can delete your account at any time from the app: Settings → Account → Delete account. If you cannot access the app, write to info@wellcode.it from the address linked to your account and we will do it for you.
Deleting the account immediately removes:
- your sign-in account (including the Google or Apple link), your profile and your profile photo;
- your push notification tokens and your reactions;
- if you are the only member of your household, the whole household with all its transactions, categories, budgets and receipt photos.
If other members remain, the shared budget stays with them as described in section 5. Copies held in backups, in logs and by our providers are deleted within 90 days. Two things stay: the record of your purchases, without anything that identifies you (section 8), and your feedback board profile, which we remove when you ask (section 2). If your account dates from an older version of Balance, a copy of your data may also remain in our legacy database until we retire it; write to us if you want it deleted sooner.
Deleting your account does not unsubscribe you from the newsletter, which is a separate subscription: use the link at the bottom of any newsletter email.
Deleting your account does not cancel a subscription bought through the App Store, Google Play or Paddle: cancel it with the seller to stop future renewals. Apple, Google and Paddle can still handle refunds for it, since they keep their own record of the purchase.
10. Cookies and similar technologies
Website and web app
Both use Google Analytics. Visitors from the European Economic Area, the United Kingdom and Switzerland are asked
for consent first: until they accept, Google Analytics does not set cookies and only receives cookieless signals
as part of Google Consent Mode. Elsewhere, analytics is on by default and can be turned off from the same banner.
Your choice is stored in a cookie called balance_consent for 180 days and is shared between the
website and the web app, so you are asked only once.
| Name | Purpose | Duration |
|---|---|---|
balance_consent | Remembers your cookie choice | 180 days |
_ga, _ga_* | Google Analytics: distinguishes visitors and sessions (only with consent where required) | Up to 2 years |
The web app also stores your sign-in session in your browser's local storage; this is strictly necessary for you to stay signed in. The website loads fonts from Google Fonts, the newsletter form is protected by Google reCAPTCHA, and the pricing page asks Paddle for prices in your local currency: in doing so these services receive your IP address.
Mobile and Mac apps
The apps do not use cookies. They use the analytics and crash reporting tools described above, and they do not access your device's advertising identifier or track you across other companies' apps and websites.
11. Security
Data travels encrypted (HTTPS/TLS) and is stored by providers that encrypt it at rest. Access to a household's data is restricted, at database level, to the members of that household. Within Wellcode, only the people who need it to run the service can access personal data. No system is perfectly secure: if a breach affecting your data occurs, we will notify you and the authorities as the law requires.
12. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy of it;
- rectify data that is inaccurate or incomplete;
- erase your data (see section 9);
- restrict processing in certain cases;
- data portability: receive the data you gave us in a structured, machine-readable format;
- object at any time to processing based on our legitimate interest, including analytics and in-app offers;
- withdraw your consent at any time, without affecting processing that took place before.
To exercise them, write to info@wellcode.it. We reply within one month, free of charge. We may ask you to confirm that the request comes from the owner of the account.
You also have the right to lodge a complaint with a data protection authority — in Italy, the Garante per la protezione dei dati personali — or with the authority of the country where you live or work.
13. Children
Balance is not intended for children. You must be at least 18 years old to create an account, and we do not knowingly collect data from anyone younger. If you believe a child has given us personal data, write to us and we will delete it.
14. Changes to this policy
We will update this policy when Balance changes the way it handles personal data, and publish the new version on this page with its date. If the changes are significant — in particular, if we want to use your data for a new purpose — we will tell you in the app or by email before they take effect, and ask for your consent where it is required.