Privacy Policy

Last updated: 17 October 2026

The Bulgarian version of this document is the controlling one. If the versions differ, the Bulgarian text prevails. Read the Bulgarian version

Who is responsible for your data

The controller of your personal data is Plamen Georgiev, Bulgaria, Varna, an individual who runs WalletHistory as a personal project (there is no company).

Contact: wallethistory@yahoo.com

What data we collect

The website

The website (wallethistory.com) has no accounts and no forms. It does not use advertising trackers. It uses Vercel Web Analytics and Vercel Speed Insights to measure page views and loading performance in aggregate; these tools do not use cookies or store identifiers on your device and do not build profiles of individual visitors. The same tools are used in the web application (my.wallethistory.com). Our hosting provider processes technical request data (such as the IP address and the browser type) to deliver and protect the site.

Your account

To create an account you give us your name, your email address and a password. We store only a one-way hash of the password, never the password itself.

The financial data you enter

Accounts, transactions, transfers, categories, tags, budgets, goals, recurring rules and the notes you add to them. You decide what to enter. WalletHistory does not connect to your bank and never asks for bank or card credentials.

Settings and household

Your display currency, time zone, language and theme. If you invite someone to a household or accept an invitation, we store the household membership. Members of a household can see each other's data, and each person can change only their own entries.

Technical data

When you sign in we store your session (IP address, browser information, time last seen) and a login log entry (the email address entered, IP address, browser information and whether the attempt succeeded). We use this to keep you signed in, to protect accounts (for example by limiting repeated failed sign-ins) and to investigate abuse.

Login log entries are deleted after 90 days. A session ends after at most 30 days and is renewed while you keep using the application.

What we do not collect

We do not collect payment data, location, contacts or special categories of personal data, and we do not use your data for advertising or profiling.

Why we use your data and on what basis

• To provide the service you asked for: creating your account, storing and showing your data and building your reports (contract, Article 6(1)(b) GDPR).
• To send service emails: email verification, a welcome message, password reset and household invitations. We do not send marketing email (contract, Article 6(1)(b) GDPR).
• To keep the service secure and prevent abuse: sessions, the login log and rate limits (legitimate interest, Article 6(1)(f) GDPR).
• To meet legal obligations when the law requires it (Article 6(1)(c) GDPR).

Only when necessary to fix a problem you report, or to comply with the law, the operator may access limited parts of your data. Administrator access is recorded.

Who we share data with

We do not sell your data. We use providers (processors) that help us run the service and may process data only on our instructions:

• Vercel: web hosting, cookieless web analytics and performance measurement
• Supabase: managed database hosting
• Redis: temporary cache of calculated figures (such as dashboard and report totals), kept for a few minutes
• Google (Gmail): sending the service emails

These providers may process data outside the European Economic Area. Where they do, they rely on safeguards such as the EU Standard Contractual Clauses. We may also disclose data to public authorities when the law requires it.

How long we keep your data

We keep your data for as long as your account exists.

You can delete your account at any time in the application: Profile → Settings → Delete account (your password is required). This permanently deletes your account and everything you entered, immediately and irreversibly. Copies kept in our database provider's backups disappear when those backups expire. You can also ask us by email.

Login log entries are kept for 90 days and sessions for at most 30 days, as described above. If the service is discontinued, all stored personal data will be permanently deleted.

How we protect your data

• All traffic between your device and our servers is encrypted with HTTPS.
• Your data is encrypted in transit with TLS and at rest with AES-256 in our database provider's storage (Supabase).
• Passwords are stored only as bcrypt hashes. Sign-in sessions use random tokens, and we store only a hash of each token.
• Each account's data is isolated: every request is checked against the signed-in user.
• Administrator access is limited and recorded.

No system is perfectly secure. If a breach affects your data, we will inform you and the Commission for Personal Data Protection as the law requires.

Your rights

• Access: get confirmation of whether we process your data and a copy of it.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: have your data deleted.
• Restriction: ask us to limit how we process your data.
• Objection: object to processing based on our legitimate interest.
• Portability: receive the data you provided in a structured, commonly used, machine-readable format.

You can do much of this yourself: edit your data in the application, download your reports as CSV files (Reports) and delete your account. For anything else, write to wallethistory@yahoo.com. We reply within one month.

If you believe your rights have been violated, you may complain to the Commission for Personal Data Protection (CPDP) of Bulgaria, www.cpdp.bg, or to the supervisory authority of your country.

Children

WalletHistory is not intended for children under 14. If you believe a child has created an account, write to us and we will delete it.

Cookies

See our Cookies Policy.

Changes to this policy

If we make material changes, we will notify you by email at the address of your account and update the date above. If you disagree, you can stop using the service and delete your account.