This Privacy Policy explains how Kyle Zhu ("we", "us", "our") handles your information when you use the WorldTab mobile app ("App"). By using the App you agree to this Policy.
1. Information We Collect
- Account information (if you register): email address, and optionally a nickname and avatar emoji.
- Your financial records: income and expense entries, categories, currencies, ledger names, and notes you enter.
- Receipt photos (optional Premium feature): photos you choose to attach to a transaction, stored in Supabase cloud storage.
- Feedback content: text you submit via "Feedback", and your email address (if signed in) so we can reply to you.
- Avatar: only an emoji character you choose — we do not access your camera roll or camera (except for the receipt photo feature, and only when you actively choose to use it).
- Device and diagnostic data: app version, device model, OS version, and crash logs used to fix bugs.
- Install attribution data: a device identifier (the Google Advertising ID on Android; the vendor identifier (IDFV) on iOS — we do not request the IDFA and show no tracking permission prompt), the install source, app version, and coarse region, used to tell which advertising channel an install came from.
- We do not collect precise location, contacts, or browsing history.
2. How We Use Your Information
- To provide App features (bookkeeping, statistics, currency conversion).
- To create and secure your account.
- To sync your data across devices when you enable cloud sync (Premium).
- To process subscriptions via Apple App Store or Google Play, and to verify subscription status.
- To respond to your feedback and support requests, and fix bugs.
- To use an AI service to parse CSV files you upload into structured bookkeeping entries (Smart Import feature, only triggered when you actively use it).
- To measure advertising performance: to know which channel an install came from, so we can judge where to keep advertising.
We do not use your bookkeeping content for advertising and do not sell it to third parties. The attribution data above is used only to measure advertising performance and contains none of your records.
3. Data Storage and Retention
- All entries are stored locally on your device by default.
- If you enable cloud sync (Premium), data is additionally stored on servers operated by Supabase, Inc. (supabase.com), located in the United States.
- Account data is retained while your account is active. Upon account deletion, data is permanently removed within 30 days, unless retention is required by law.
4. Sharing Your Information
We do not sell your personal information. We share it only:
- With Supabase, Inc. for cloud storage, authentication, and receipt photo storage (under a data processing agreement).
- With Apple Inc. / Google LLC to process subscription payments and verify subscription status.
- With Resend (resend.com) to deliver the feedback content you submit to our inbox.
- With Anthropic PBC (Claude API) to parse CSV file content you actively upload for Smart Import; this content is not used to train models.
- With AppsFlyer Ltd. (appsflyer.com) for the install attribution data described above, to measure advertising performance.
- With Functional Software, Inc. (Sentry, sentry.io) for crash and error diagnostics, to locate and fix bugs.
- When required by applicable law or to protect our legal rights.
5. Security
We use industry-standard measures including encryption in transit (TLS) and access controls. No method of internet transmission is 100% secure; we cannot guarantee absolute security.
6. Your Rights
You may at any time:
- Access and export your data (Settings → Data & Backup → Export CSV).
- Correct your profile (Settings → Profile).
- Delete your account and all associated data (Settings → Account → Delete Account).
- Contact us for other requests: [email protected].
7. European Union Users (GDPR)
If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):
- Right of access, rectification, and erasure ("right to be forgotten").
- Right to data portability (export CSV).
- Right to restrict or object to processing.
- Right to withdraw consent at any time (where processing is based on consent).
- Right to lodge a complaint with your local supervisory authority.
The legal bases for processing are: contract performance (operating the App), legitimate interests (security, bug fixes), and consent (optional account creation). We do not transfer data outside the EEA without appropriate safeguards (Supabase's Standard Contractual Clauses apply).
8. Canada (PIPEDA)
We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). You may request access to or correction of your personal information by contacting [email protected].
9. Children
The App is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have done so inadvertently, please contact us and we will delete it promptly.
10. International Data Transfers
Your data may be processed in the United States (where Supabase servers are located). We ensure appropriate protections are in place consistent with this Policy and applicable law.
11. Changes to This Policy
We will post updates with a revised "Last updated" date. We will notify you of material changes through the App. Continued use after changes means you accept the updated Policy.
12. Contact