Simple and honest documentation outlining how Wally handles your data and the terms of using the app.

The short version: Wally stores your financial data locally on your device using SQLite. No account is required. Your transaction data never leaves your device except when you use voice input or AI categorisation, which is processed through a secure proxy and not stored. We do not sell your data.

Who We Are

This Privacy Policy describes how Wally ("App", "we", "us") collects, uses, and protects the information of users ("you") who use the Wally iOS application. By using Wally, you agree to the practices described in this policy.

Data Storage — Local First

Wally is built on a local-first architecture. All financial data — transactions, categories, budgets, lists, and settings — is stored exclusively on your device using SQLite and MMKV (a fast local key-value store). This data is:

• Never transmitted to any Wally server
• Never accessible to us or any third party
• Retained until you delete the app or manually clear your data
• Your sole responsibility is to back up

No account creation or login is required to use Wally. We have no access to your financial information at any time.

Voice Input Processing

When you use the voice logging feature, your spoken words are first transcribed locally using iOS's native speech recognition framework. The resulting text transcript — not the audio — is then sent to our secure backend proxy, which forwards it to the AI for transaction parsing and categorisation.

Regarding this processing:

• Only the text transcript is transmitted — never the original audio recording
• Our proxy server does not store your transcript at any point
• AI processes the transcript to extract transaction details (amount, category, date) and does not retain the data for longer than 30 days for abuse monitoring purposes
• AI does not use your data to train its models.

AI Text Categorisation

When you type a transaction description, and Wally's AI assigns a category, the text you enter may be sent through the same secure proxy to the AI. The same conditions apply: no storage on our proxy, and no retention beyond 30 days.