Privacy Policy

NoteWallet helps you log expenses by voice through Telegram. This policy explains what we collect, why, and the control you have over your data.

Information we collect

• Telegram account details you authorize at sign-in: your Telegram ID, name, username, and profile photo.
• The entries you create: amounts, currencies, categories, descriptions, and timestamps for the transactions you log.
• Session data needed to keep you signed in, stored in a signed, http-only cookie.
• Voice notes you send. When you log by voice, we receive the audio of that message to convert it into text and a structured expense entry.

How we use it

We use your data only to run the product: to store and display your transactions, parse your voice notes into structured entries, and show your spending summaries. We do not sell your data or share it for advertising.

Service providers we share data with

To run NoteWallet, we share limited data with the providers below. They process data only on our instructions, only to provide their service to us, and we never sell your data or share it for advertising.

• Telegram — sign-in (OpenID Connect), the bot you message (including voice notes), and Telegram Stars payments when you choose to pay that way. Subject to Telegram's own privacy policy.
• Groq, Inc. (United States). When you send a voice note, the audio is sent to Groq to transcribe speech to text, and the resulting text is processed by a language model to extract the amount, currency, and category.
• Supabase: our managed PostgreSQL database, where your account and entries live.
• Vercel (United States). Hosts and delivers the app.
• Lemon Squeezy (United States) — our payment provider and merchant of record. When you subscribe, they receive your billing details and the data needed to process and renew your payment. Subject to Lemon Squeezy's own privacy policy.

Analytics

We use Google Analytics (Google Ireland Ltd. and Google LLC) to understand how the app is used, in aggregate. Google Analytics sets first-party cookies and processes a truncated IP address (anonymized by default), browser type, device category, and the pages you visit. This data is used to produce aggregated usage statistics only — never to identify you personally — and we do not enable Google's advertising features. Your choice to allow or decline is captured by the consent banner that appears on your first visit, and is stored in your browser. You can change your choice at any time by clearing your browser's site data. Subject to Google's privacy policy.

Voice notes and audio

When you send a voice note, the audio is used only to produce a text transcription and a structured expense entry, then discarded. Neither we nor our transcription provider retain the original audio after the entry is created.

Where it lives

Your data is stored in our managed Postgres database (Supabase) and transmitted over HTTPS. See our Security page for more.

Where your data is processed

Some providers (Groq, Vercel, Lemon Squeezy) process data in the United States, and others may process data elsewhere. By using NoteWallet, you understand your data may be processed outside your country. Where we transfer data outside your country, we rely on safeguards such as Standard Contractual Clauses or the provider's Data Privacy Framework certification.

How long we keep your data

We keep your account and entries while your account is active. When you delete your account, we remove your entries and personal data from our live database within 30 days. After that, residual copies may remain in our encrypted backups for up to 7 additional days before they are overwritten. Limited records may also be kept to comply with law (for example, payment or tax records held by our payment provider).

Your rights

Export: download all your transactions to CSV from the dashboard at any time. Correction: edit or delete any entry directly in Telegram or the dashboard. Deletion: delete your account and all associated data at any time from the dashboard (Settings → Danger zone). We permanently purge your data within 30 days. You can also reach us via the Contact page. If you are in the EU/UK: our legal basis for processing is performance of our contract with you. You also have the right to object to or restrict processing, to data portability, and to lodge a complaint with your local data protection authority.

California residents

The California Consumer Privacy Act (CCPA/CPRA) gives you the right to know, delete, correct, and opt out of the sale or sharing of your personal information. We do not sell or share your personal information for cross-context behavioral advertising. Your transaction data constitutes sensitive personal information under California law — you may request that we limit its use to providing the NoteWallet service. To exercise any of these rights, email privacy@notewallet.app or use the tools described above. Complaints can also be filed with the California Privacy Protection Agency at cppa.ca.gov.

Children

NoteWallet is not directed to anyone under 16. Please do not use it if you are under this age.

Changes to this policy

We may update this policy. We will update the date at the top, and for material changes we will notify you in the app or through the bot.

Questions

Email us at privacy@notewallet.app.