Privacy policy

Who runs it

Empty Wallet is a private, invitation-only budgeting app run by its owner for one household. It is not a commercial service and has no public sign-up. The owner who invited you is the controller of your data and the person to contact about it.

What is stored

• Your account: name, a salted hash of your PIN (never the PIN itself), and optionally an email address for sign-in codes and digests.
• Your ledger: the expenses, income, budgets, plans, subscriptions, goals and balances you enter or import.
• Bank data, if you connect a bank: account names, IBANs, balances and booked transactions (date, amount, description, transaction id), read through Enable Banking.
• Technical data: a session cookie, a trusted-device cookie if you choose “remember this device”, push-notification endpoints if you turn push on, and an audit trail of changes to your ledger.

Bank access

Bank connections are read-only (PSD2 account information). Empty Wallet cannot make payments or move money. You authorise access at your own bank; consent lasts up to 180 days and you can disconnect at any time in Bank sync, which also stops all further reads. Bank connection details are not included in backups or exports.

What it is used for

Only to show you your own finances: categorising spending, budgets, forecasts, reminders and reports. Your data is never sold, used for advertising, or shared with anyone outside the household members you add.

Where it lives and who processes it

• Hosting and backups: Hetzner data centres in the EU; database backups are kept in Hetzner object storage in Helsinki, Finland.
• Enable Banking (Finland): the licensed provider that relays read-only bank data, only if you connect a bank.
• Anthropic: only when you use receipt scanning or “Ask your money”, the photo or question and the ledger figures needed to answer it are sent to the Claude API. Photos are not stored by Empty Wallet and chats are not saved.
• Email delivery: sign-in codes and digests go through the configured mail provider, only if you add an email address.

How long it is kept

Your data stays while your account exists. Deleted rows are kept in the database as soft-deleted so changes can be undone; backups roll over after 7 days. When the owner removes your account, you can ask for your ledger to be erased as well.

Your rights

You can export your ledger as CSV or JSON from Settings at any time, correct anything in the app, disconnect banks, and ask the owner to erase your data. Under the GDPR you may also complain to your data-protection authority (in Estonia, the Andmekaitse Inspektsioon).

Cookies

Only the strictly necessary ones: the sign-in session, the optional trusted-device cookie, and the selected household. No analytics or tracking.