Privacy Policy

1. Introduction

Welcome to Wealth Tracker ("we," "our," or "us"). Wealth Tracker is a self-hosted application. You run the backend on your own server, which means your personal and financial data is stored entirely under your control. The developer does not operate any servers that store your data.

This Privacy Policy explains what limited data we collect through the app itself, how we use it, and your rights regarding that data.

2. Self-Hosted Architecture

Wealth Tracker is designed so that you host the backend server yourself. This means:

• Your data stays on your server: All personal information (username, email), financial data (account names, balances, broker credentials), and usage history are stored exclusively on your self-hosted server.
• We have no access: The developer does not have access to your server, your accounts, or your financial data.
• You are in control: You decide where your data is stored, how it is backed up, and when it is deleted.

3. Information We Collect

The only data collected by the developer is crash diagnostics, sent via Firebase Crashlytics when the app encounters an error. This includes:

• Crash stack traces and exception information
• Device model, OS version, and orientation
• Available RAM and disk space at time of crash
• A Crashlytics Installation UUID to identify unique app installations
• App version and build number

Crashlytics does not collect personally identifiable information such as names, email addresses, or financial data.

4. Data Stored on Your Server

The following data is processed and stored on your self-hosted server (not collected by the developer):

• Account Information: Username, email address, and password (hashed).
• Financial Data: Account names, balance snapshots, and portfolio information.
• Broker Credentials: Encrypted credentials for connected financial institutions, protected with per-user encryption keys derived from your password.

Security measures on your server include:

• Per-user encryption: Each user has their own encryption key, derived from their password using Argon2id. The server never stores your password or encryption key in plain text.
• Ephemeral tokens: Login credentials are used only to derive encryption keys during authentication and are not persisted on the server.
• TLS encryption: All communication between the app and your server is encrypted.
• Biometric protection: The app supports Face ID, Touch ID, and fingerprint authentication for convenient, secure access.

5. Data Sharing and Disclosure

We do not sell, trade, or rent any information. The only data shared with a third party is crash diagnostic data sent to Firebase Crashlytics (operated by Google) to help improve app stability. For more information, see the Firebase Privacy Policy.

6. Financial Integrations

The app can connect to third-party financial services to sync your account balances:

• German banks via FinTS/HBCI protocols
• Interactive Brokers, TrueWealth, VIAC, Morgan Stanley at Work

These connections are made directly from your self-hosted server. The developer has no involvement in or access to these connections.

7. Data Retention and Deletion

Since all personal and financial data is stored on your own server, you have full control over data retention and deletion. You can delete your data at any time by managing your server directly.

Crash diagnostic data collected by Firebase Crashlytics is retained according to Google's data retention policies.

8. Your Rights

Because Wealth Tracker is self-hosted, you already have full control over your data. You can access, modify, export, or delete all your data directly on your server at any time.

For questions about crash data collected via Firebase Crashlytics, please contact us using the information below.

9. Children's Privacy

Our app is not intended for use by children under the age of 16. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new Privacy Policy within the app or at this URL. Your continued use of the app after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

• Email: privacy@miniapps.ch
• Developer: Lukas Schulze