Clams Budget privacy policy

1. Who is responsible

Waffle Whale is the controller of the personal data described here. Questions, requests and complaints: hello@wafflewhale.com.

2. What we collect and why

We only collect what the app needs to work. We do not sell personal data and we do not use it for advertising.

• Your Waffle Whale ID account. Sign-in uses Waffle Whale ID (id.brandcode10.com), the central account service shared by all Waffle Whale apps, which holds your email address and password. When you sign in, Clams Budget keeps a copy of your account identifier, name, username, email address, avatar link, time zone and language, plus your chosen currency. In the Android app your password passes through our server to Waffle Whale ID during sign-in and is never stored by Clams Budget. Purpose: running your account.
• Your ledger. Everything you enter: folios (name, type, colour, starting balance, whether it is tracked), categories, and transactions (type, amount, currency, date, folio, category, note and optional line items). Balances and reports are calculated from these. Deleted transactions are kept in a recoverable state until you delete your account. Purpose: the budget tracker itself.
• Shared budgets and trips (optional). If you create or join a shared group, its other members see your name, username and avatar, and the shared expenses, payments and categories anyone in the group records (amounts, dates, notes, who paid and who owes). When you invite someone we store the email address or username you typed so the invite can find them when they sign in; the other members see it while the invite is open. A shared expense is copied into your own ledger only if you choose "Also add to my ledger", and never into anyone else's. Purpose: the shared group feature.
• Receipt and reference photos. A photo you attach to a transaction (taken with the camera or picked from your gallery) is stored privately on our server with a small thumbnail, and is only served to you. Removing the photo or the transaction deletes the file.
• Receipt scanning (optional). When you tap "Scan receipt", the photo is uploaded and we keep a scan record: the photo, which AI service read it, and the draft it returned (merchant, date, totals and line items). The draft is never saved as a transaction until you review and save it. A scan photo you do not save into a transaction is deleted after 24 hours. We count how many scans you use each month for fair-use limits.
• Your own AI key (optional). If you add your own AI provider key under Settings → AI, we store it encrypted and use it only for your scans. It is never shown again, and you can remove it at any time.
• Technical data. Our web server records IP address, browser/app user agent and request time in its logs for security and troubleshooting. Signed-in web sessions are stored with the IP address and user agent. If server error reporting (Sentry) is enabled, technical error details from our server are sent to it without personal data by default. The Android app contains no crash-reporting, analytics or advertising SDK.

3. Data that stays on your device

• The Android app keeps a copy of your ledger in a private database on your phone so it works offline, and syncs it with your account when you are online. Photos waiting to upload are kept until they are sent.
• Sign-in tokens are stored in the device's secure storage (Android Keystore). App preferences are stored in the app's private storage.
• CSV exports are created in your browser; PDF reports are created on our server for download and are not kept. The website stores only your light/dark theme choice in your browser.

4. Third parties

• Waffle Whale ID (id.brandcode10.com), operated by Waffle Whale: sign-in, registration and password reset.
• AI receipt reading. A receipt you choose to scan is sent, together with your default currency, today's date and your category names, to one AI service: (a) if you added your own key, the provider you chose (Google Gemini, OpenAI, Anthropic, or an OpenAI-compatible service at an address you entered), under your own agreement with that provider; otherwise (b) Google Gemini using Waffle Whale's key, when we have enabled it. Under Google's terms, content sent through unpaid Gemini API tiers may be used by Google to improve its services (Gemini API terms, Google privacy policy); please do not scan receipts you are not comfortable sharing. If no AI service is available, the photo is only stored and you type the amounts yourself. Nothing is sent to an AI service unless you tap "Scan receipt".
• Fonts. The website loads its fonts from Bunny Fonts (fonts.bunny.net), which receives your IP address and browser user agent when a page loads.
• Hosting: our servers are run by a hosting provider in Singapore, which processes data on our behalf. Error reports (if enabled) are processed by Sentry.
• Google Play distributes the Android app under Google's own terms.
• We share data with authorities only when the law requires it. We do not sell or rent personal data.

5. How long we keep it

• Account copy, ledger, photos, scan records, AI settings and usage counts: for as long as you keep your Clams Budget account. You can delete them at any time (section 7).
• Receipt-scan photos that were never saved into a transaction: 24 hours.
• Server logs: a limited period for security and troubleshooting. Database backups: up to about five weeks (7 daily and 4 weekly copies), after which deleted data is gone from backups too. Receipt photos are not included in database backups.
• Your Waffle Whale ID account is kept by Waffle Whale ID until you ask for it to be deleted.

6. Security

All traffic between the app, the website and our servers is encrypted in transit (HTTPS/TLS). Sign-in uses short-lived signed tokens; passwords are held only by Waffle Whale ID, hashed. Receipt photos are stored outside the public web folder and only served after an ownership check. Your own AI key is encrypted at rest. Access to the servers is restricted.

7. Deleting your account and data

In the Android app: Settings → Delete my account and data. On the web, without the app: budget.brandcode10.com/account/delete (also linked from Settings). This permanently deletes your Clams Budget account copy and all its data: transactions (including deleted ones) and their line items, folios, categories, receipt photos, receipt scans, AI settings and key, usage counts, and sign-in sessions and tokens. The app also clears its local copy on that phone. You leave every shared group: groups nobody else is in are deleted, and in the others the expenses and payments you recorded stay for the remaining members (their balances depend on them) under the name "Former member".

Deleting your Clams Budget data does not delete your Waffle Whale ID, which other Waffle Whale apps may use. To delete your Waffle Whale ID as well, email hello@wafflewhale.com from the address on the account.

8. Your rights

Depending on where you live (for example under the GDPR or Thailand's PDPA) you can ask to access, correct, export or delete your data, object to or restrict processing, and complain to your data protection authority. Name, username and email are corrected in your Waffle Whale ID; your ledger can be exported as CSV or PDF from Reports; for anything else email hello@wafflewhale.com. We process data to provide the service you asked for (contract), to keep it secure (legitimate interests), and to meet legal obligations.

9. Children

Clams Budget is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has created an account, email hello@wafflewhale.com and we will delete it.

10. Changes

If this policy changes we will update the effective date on this page, and tell you in the app for significant changes.