1. Who we are and what this policy covers
BitByte Lab ("BitByte Lab", "we", "us") publishes the Walley mobile application (Android package com.bitbytelab.walley) and operates this website. For the purposes of data-protection law, BitByte Lab is the controller of the personal data described in this policy.
This policy covers the Walley app, this website and our support channels. It does not cover third-party services you choose to connect, such as Google, whose own privacy policies apply to what they do with your data.
Questions and requests: contact@walleyai.tech.
2. The information we process
Walley is local-first: most information never leaves your device. The table below lists every category of data the app handles, where it is stored and why.
| Category | Examples | Where it lives | Purpose |
|---|---|---|---|
| Financial records you enter | Transactions (amount, currency, date, category, payment method, note), budgets, savings goals, loans and repayments, subscriptions, categories, payment methods | Encrypted database on your device only | To run the app for you: balances, charts, budgets, reminders |
| Attachments | Receipt photos, invoices, PDFs you attach, and the searchable description generated for them | Your device; included in your own encrypted backup if you use Premium | Evidence for your records; receipt scanning |
| Profile you set up | Display name, optional photo, display currency, income baseline, reminder preferences | Your device | Personalise the app |
| Data the app derives | Totals, trends, streaks, XP, badges, health score, on-device search embeddings | Your device | Insights, motivation features, on-device search |
| Account data (optional) | Google account identifier (Firebase UID), email address, display name, profile photo URL | Firebase Authentication (Google), processed on our behalf | Sign-in for the AI coach and backups; per-account AI allowance |
| AI usage counters | Your account identifier, the date, and the number of AI requests that day | Cloud Firestore (Google), processed on our behalf; readable only by you | Enforce the free daily AI allowance fairly |
| AI requests (optional, consent required) | A numeric summary of your finances, your question with identifiers removed and names tokenised, receipt images you scan, voice clips you dictate | Sent to Firebase AI Logic (Google Gemini) for processing; not stored by us | Answer your question, read your receipt, transcribe your voice |
| Purchase data (Premium) | Anonymous app-user identifier, purchase tokens, product identifiers, entitlement status | RevenueCat and Google Play Billing | Deliver and restore Premium purchases |
| Backups (Premium) | An encrypted archive of all your Walley data and attachments | Your own Google Drive application folder | Let you restore on a new device. We cannot read it |
| Push notification token | A device token issued by Firebase Cloud Messaging | Firebase (Google) | Deliver reminders you enabled and service notices |
| Technical data | IP address, device type and app version, seen briefly by servers the app contacts (exchange-rate provider, IP-geolocation provider at first launch, Google services, App Check attestation) | Server logs of the relevant provider | Deliver the feature, keep the service secure, suggest your currency at setup |
| Support correspondence | Your email address and what you write to us | Our mailbox | Reply to you and improve the app |
Walley does not use third-party analytics, advertising or crash-reporting tracking kits. We do not collect precise location, contacts, or browsing history. We never ask for your bank credentials and cannot connect to bank accounts.
3. Device permissions
Walley asks for a permission only when you use the feature that needs it. You can decline, and you can revoke any permission later in your device settings; the related feature simply stops working.
| Permission | Used for | What leaves your device |
|---|---|---|
| Camera | Scanning receipts and taking a profile photo | The receipt image, only if you use AI receipt scanning |
| Photos and files | Attaching existing images and PDFs to transactions | Nothing, unless you scan the file with AI |
| Microphone | Dictating an expense or a question to the coach | The audio clip, only when you use voice with the AI coach |
| Notifications | Reminders, budget alerts, daily summaries | A push token so notifications can be delivered |
| SMS (Android, opt-in) | Detecting payment messages from banks and wallets to draft transactions | Nothing. Messages are parsed on your device and never uploaded |
| Exact alarms, run at boot, ignore battery optimisation | Delivering scheduled reminders reliably | Nothing |
| Biometrics | Unlocking Walley with fingerprint, face or PIN | Nothing. Verification happens in your device's secure hardware |
| Internet | Exchange rates, sign-in, AI coach, backups, purchases | Only the data listed in section 2 for the feature you use |
| Google Play Billing | Buying and restoring Premium | Purchase information handled by Google Play and RevenueCat |
4. How we use information and our legal bases
Where the GDPR, UK GDPR or a similar law applies, we rely on the following legal bases.
| Purpose | Legal basis |
|---|---|
| Provide the app's core features on your device | Performance of our contract with you (Terms of Service) |
| Operate optional sign-in, AI coach, backups and Premium | Performance of our contract; consent for AI processing of your data |
| Send reminders and alerts you configured | Consent (you enable notifications) |
| Fair-use limits, fraud and abuse prevention, App Check attestation | Legitimate interests in keeping the service secure and affordable |
| Respond to support requests | Legitimate interests; performance of contract |
| Comply with tax, consumer and other legal obligations | Legal obligation |
We do not use your data to build advertising profiles, we do not sell it, and we do not use your financial data or AI conversations to train machine-learning models.
5. AI features in detail
The AI coach, receipt scanning and voice transcription use Google's Gemini models through Firebase AI Logic. Walley holds no model API key; requests are authenticated with your Firebase sign-in and attested with Firebase App Check.
Consent first
AI features are off by default. Nothing is sent until you turn them on in the app, and you can turn them off at any time in Profile → AI & your data.
What is sent
- A numeric snapshot of your finances: totals, averages, ratios, budget utilisation, savings rate, a local projection. Numbers only, no names.
- Your message or question, and for chat, a small number of matching history lines if you allow retrieved history.
- The receipt image or voice clip you chose to scan or dictate.
Two layers of protection, applied on your device
- Always on: email addresses, URLs, card-shaped digit runs, phone numbers and long reference numbers are removed and replaced with placeholders before any request is built. This cannot be switched off.
- Pseudonymisation: merchant names, transaction notes, goal names and category names are replaced with stable tokens unless you choose to share them. The mapping stays in memory on your device and is never written to disk or sent anywhere.
You can audit it
Every outbound payload is written, word for word, to a disclosure log kept only on your device (Profile → AI & your data → View what was sent). Free accounts have a daily allowance counted against your account identifier; Premium raises it.
AI output can be wrong. It is educational information, not financial, tax, legal or investment advice.
6. Backups and encryption
On your device, Walley stores your data in an encrypted database and keeps keys in your device's secure storage. You can additionally lock the app with biometrics or a PIN.
Walley Premium can back up all your data and attachments to the application folder of your own Google Drive. The archive is encrypted end to end before it leaves your phone. The encryption key is stored in your own Google account and shown to you once as a recovery code. If you lose both, the backup cannot be opened by anyone, including us. We never receive the backup or the key.
Backups follow Google's Drive terms and privacy policy. Deleting the backup from Drive, or revoking Walley's access in your Google account, removes it.
8. International transfers
BitByte Lab is based in Bangladesh. Our processors, chiefly Google and RevenueCat, operate servers in the United States, the European Union and elsewhere. Where data leaves the European Economic Area, the United Kingdom or Switzerland, transfers rely on the providers' Standard Contractual Clauses and equivalent safeguards. Your financial records themselves stay on your device and are not transferred by us.
9. How long we keep information
| Data | Retention |
|---|---|
| Everything stored on your device | Until you delete it in the app, clear the app's data or uninstall |
| Account data in Firebase Authentication | Until you delete your account in the app or ask us to; then removed within 30 days |
| AI usage counters | Deleted within 13 months of the day they relate to, or when your account is deleted |
| AI request content | Processed transiently; not retained by us. Google's Firebase AI Logic data-handling terms apply to its processing |
| Push notification tokens | Until the app is uninstalled or notifications are disabled; stale tokens expire automatically |
| Purchase records | For the life of your Premium entitlement and as long as tax and consumer law require |
| Backups in your Google Drive | Under your control; delete them any time from Drive or the app |
| Support emails | Up to 24 months after the conversation ends |
10. Security
- Encryption at rest on your device (encrypted database and secure key storage) and in transit (TLS) for every network request.
- End-to-end encryption for backups; keys are never sent to us.
- No API keys or secrets inside the app binary. Requests to Google services are attested with Firebase App Check.
- Firestore security rules that let each user read and update only their own usage counter, and never decrease it.
- On-device redaction and pseudonymisation before any AI request.
- Optional biometric or PIN lock, and a screen-lock reminder in onboarding.
No method of storage or transmission is completely secure. Please keep your device locked, keep your recovery code safe, and tell us promptly at contact@walleyai.tech if you believe something is wrong.
11. Your rights and choices
Everyone
- View, edit and delete any record inside Walley at any time.
- Export your data from the app for your own use.
- Turn AI features, notifications and SMS parsing on or off in the app.
- Revoke any device permission in your system settings.
- Delete your account (Profile → Account) to remove sign-in data and AI counters, or email us to do it for you.
- Delete all local data by clearing the app's storage or uninstalling.
European Economic Area, United Kingdom and Switzerland
You have the right to access, rectify, erase, restrict or object to our processing of your personal data, to receive it in a portable format, and to withdraw consent at any time without affecting earlier processing. You may lodge a complaint with your local supervisory authority. Because your records live on your device, most of these rights can be exercised directly in the app; for account data, email us.
California and other US states
You have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and to not be discriminated against for exercising these rights. We do not sell or share personal information as defined by the CCPA/CPRA, and we do not use or disclose sensitive personal information other than to provide the service you requested. We honour Global Privacy Control signals on this website.
Brazil, India, Bangladesh and elsewhere
Where local law (for example the LGPD or the Digital Personal Data Protection Act) grants you rights to access, correct, delete or port your data, or to withdraw consent, you can exercise them by the same means. Where mandatory local law gives you greater protection than this policy, that law prevails.
How to make a request
Email contact@walleyai.tech. We will confirm your identity using the email address linked to your account, respond within 30 days (or the shorter period local law requires), and never charge a fee for a reasonable request.
12. Children
Walley is not directed to children under 13, and to under-16s in countries where the age of digital consent is higher, unless a parent or guardian has consented. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact contact@walleyai.tech and we will delete it.
13. This website and cookies
This website sets a single functional cookie, NEXT_LOCALE, to remember your language choice for one year. It contains no identifier and is not used for tracking. We do not use analytics, advertising or social-media cookies on this site. Our hosting provider keeps standard server logs for security and reliability.
14. Changes to this policy
We will update this policy when the app or the law changes. We will post the new version here with a new date and, for material changes, notify you in the app or by email before they take effect. Continued use after the effective date means the updated policy applies.
15. Contact
BitByte Lab, publisher of Walley. Privacy: contact@walleyai.tech. Support: contact@walleyai.tech.