Waycash privacy policy

Last updated: 13 August 2026.

The essentials

Waycash works without an account. In that case your trips and expenses stay on your iPhone and are sent nowhere.
An account only exists to back up your trips and share them with other travelers.
No advertising, no ad trackers, no data resale. The app never asks permission to track you across other apps.
You can delete your account from inside the app, without writing to anyone.

Who is responsible

Waycash is published by Teddy Verneuil, sole trader, 14 bis rue Magellan, 56860 Séné, France. Company number 792 687 576 00043. Contact: [email protected]. He is the data controller under the General Data Protection Regulation (GDPR).

What stays on your iPhone

As long as you don't create an account, everything is local: your trips, expenses, the traveler names you type, your budgets, your categories, the saved exchange rates. This lives in a database on your device and is included in your iPhone backup if you use one. I have no access to it.

Deleting the app deletes this data.

What goes to a server, and only with an account

Signing in uses Sign in with Apple. Apple gives me a unique identifier and an email address, which may be a private relay address if you choose to hide yours. I never receive your password or your Apple credentials.

Once signed in, the following is synchronised:

your trips: name, destination, dates, currencies, locked exchange rates;
your expenses: amount, currency, category, date, optional note, who paid and for whom;
the travelers on the trip: the first name or nickname someone typed;
your personal budget for each trip, which other travelers never see;
settlements marked as paid back;
a technical log of changes (which device, when, which operation), used to make several phones converge without losing anything;
if you allow notifications, your device token, provided by Apple.

The share link, to be spread thoughtfully

Each trip can have a unique link. Anyone holding that link, with no account and no install, can see the trip name, its dates, the list of traveler first names and how many expenses have been logged. They can also add an expense.

The link never exposes the amounts already logged, the budgets, or the group balance. Treat it as the key to your trip: share it with the people concerned, not publicly.

Usage measurement

Waycash measures a few usage events to know which screens actually help: creating a trip, logging an expense, opening the home screen, seeing the paid offer. This goes through TelemetryDeck GmbH (Germany), a service built not to identify people.

What is sent: the event name, non-identifying parameters (destination country code, entry duration in milliseconds, which surface was used) and an identifier drawn at random on first launch, then hashed. It is never the advertising identifier nor your device identifier. No amount, no name, no named destination ever leaves the app through this channel.

Other services called

Exchange rates: the app queries the public open.er-api.com service for the day's rate. Only currency codes are sent, never an amount or anything about you.
Notifications: they travel through Apple's service (APNs), which receives your device token and the notification text.
Purchases: handled by Apple. No payment method passes through Waycash, and I never see your card number or billing address.

Why, and on what legal basis

Performance of the service: syncing, sharing and settling up cannot work without processing this data.
Legitimate interest: anonymous usage measurement, to improve the app without ever targeting anyone in particular.
Consent: notifications, which you accept or refuse in iOS and can withdraw at any time in Settings.

This data serves nothing else. It is never sold, rented or passed to advertisers, and there is no advertising profiling.

How long

Account data is kept for as long as the account exists.
Deleting your account from the app erases your account and your personal data within seconds.
One deliberate exception: on a shared trip, the expenses you logged stay visible to the other travelers, detached from your account. Without them the group's balance would be wrong for people who asked for nothing. The displayed first name remains, your account identifier is gone.
Data left on your iPhone disappears with the app.

Where it is hosted

Supabase Inc. for the database and authentication, on infrastructure located in the European Union (Frankfurt, Germany).
Hostinger International Ltd for the web invitation page.
TelemetryDeck GmbH (Germany) for usage measurement.
Apple Inc. for authentication, notifications and purchases.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data.

Erasure: Profile, then "Delete my account", inside the app.
Portability: the CSV export of a trip, from the Profile screen.
Anything else: write to [email protected], I answer within thirty days.

You may also lodge a complaint with the French data protection authority, the CNIL, at cnil.fr, or with your own national authority.

Security

Everything in transit is encrypted (HTTPS). On the server, each trip is protected by access rules that only allow its members to read it. Your session token is stored in the iOS Keychain, never in an ordinary file.

No security is absolute. Should a breach create a risk to your rights, you would be informed within the time limits set by the GDPR.

Children

Waycash is not intended for children under 15 and does not knowingly collect their data. Any such data reported to me would be erased.

Changes

This policy may change along with the app. The update date at the top of this page prevails, and any significant change will be announced in the app.