Privacy policy

This policy describes what data Wherepare handles, where it is kept and why. It covers the website at www.wherepare.com and the application at app.wherepare.com. It is written from how the software is built rather than from a template, so it is specific and, in places, blunt.

Who is responsible

The service is operated by the operator of Wherepare.

The short version

• Accounts are anonymous. We do not ask for an email address, a name, a phone number or a payment method.
• Your password never reaches our server. The app derives a key from it on your device and the server stores only a hash of that key.
• The financial records you enter are stored in a database on our server under your anonymous username. They are not end-to-end encrypted.
• We do not sell, share, rent or license any data. There is no advertising, no analytics and no tracking on the website or in the app.
• You can export everything as one file at any time and delete the account, with everything in it, yourself.

This website

The website is a set of static pages. It sets no cookies, loads no analytics and makes no requests to third parties: fonts and images are served from our own domain. Your theme choice (light or dark) is kept in your browser's local storage if you change it, and nowhere else.

Like any web server, the server that hosts the website and the application may keep standard access logs (IP address, requested address, time, browser identification) for operating and securing the service. We do not use them to track anyone.

Your account

When you create an account, the server stores:

• A username. The server generates a random one (for example quiet-falcon-4821); it is the only identifier of your account. Accounts of the Standard type may replace it with a username of their own choosing.
• The parameters and salt of the key derivation your device performs, and hashes of the key derived from your password and of the key derived from your recovery phrase. Neither the password nor the recovery phrase is ever sent to the server, and neither can be recovered from what is stored.
• The currency you chose and your display settings (light or dark theme, the app's style, number and date format, language, whether amounts are hidden).
• The account type, the date the account was created, the time of the last login, and a version number that goes up whenever your data changes (used to tell your other devices that they should refresh).

Because there is no email address, there is no password reset by email. If you lose both your password and your recovery phrase, the account cannot be recovered by anyone, including us.

Your financial data

Everything you enter in the application is stored on our server, linked to your anonymous username: transactions and their accounts, categories and tags; planned and repeating transactions; locked months; stocks and cryptocurrencies with their purchases and sales and latest prices; assets and asset types; loans; backup imports.

When you import a bank statement, the file is sent to our server, read in memory to show you the rows it contains, and discarded. It is not stored; only the rows you choose to import are saved, as ordinary transactions.

These records are stored in a database in readable form. They are not end-to-end encrypted, because the server performs work on them for you: converting every amount when you switch currency, fetching market prices for your holdings and validating backup files. Application-level access to the database is limited to the operator; the hosting provider operates the infrastructure it runs on. The data is transmitted only over HTTPS.

Nobody at Wherepare looks at individual accounts in the normal course of operating the service. We do not analyse, profile or model the data, and no automated decision is made about you.

Households

A household is a separate set of financial data that its members manage together. It has a name and no credentials of its own, and its records are stored the same way as an account's. For each member the server stores which household they belong to, their role (owner or member) and when they joined. Members see each other's usernames, roles and joining dates, and the household's data, but never each other's personal data.

An invite code is shown once to the owner who creates it; the server stores only a hash of it, with its expiry time and the time it was used. A code works once and expires after a week. When a member leaves or is removed, the household's data stays with the remaining members. When the owner deletes the household, all of its data is deleted for everyone.

Logged-in devices and sessions

Every login creates a separate session. For each session the server stores a short description of the device, derived from the browser's identification string (for example "Windows · Chrome"), the nickname you may give it, the time it logged in and the tokens that keep it logged in. Sessions expire after 90 days without use and can be ended from any logged-in device at any time; expired sessions are removed automatically.

Data kept on your device

The application stores the following in your browser so it opens quickly and stays logged in:

• The session tokens.
• A cached copy of your data, encrypted with a key that is tied to that device's session and held only in memory. Once the device is logged out, including remotely from another device, the cache can no longer be read.
• The data version of that cache, the profile (personal or household) you last opened, a copy of your theme, style and language so they apply before the app has loaded, and a few per-device display options, such as the last page, chart and loan you looked at.
• The values of your last loan calculation, so the calculator opens where you left it. These are not encrypted.

Logging out or clearing the cache from the settings removes the cached data. Clearing the browser's site data removes everything.

Third parties

Three outside parties are involved in running the service, and no others:

Price and rate requests carry no account information and are cached and shared between all users, so a single request to these services cannot be attributed to a particular account.

Security measures

• All traffic uses HTTPS; the server enforces it and sends HTTP Strict Transport Security headers.
• Passwords are processed on your device with Argon2id; the server stores hashes of derived keys, never the password.
• Login attempts are throttled per username and per network address, new accounts are limited per network, and requests are rate-limited per account.
• Network addresses used for throttling are kept in memory only and are neither stored nor logged.
• When something goes wrong, the server logs the error and the requested address so it can be fixed. Request bodies, which carry your data, are not logged.

How long data is kept

Your account and its data are kept until you delete the account. Deleting it removes the account, every record, every session and every household membership from the database immediately; nothing is flagged for later removal. A household you own has to be handed over to another member or deleted first. A household's data is kept until its owner deletes it. Individual records, sessions and the local cache can be deleted at any time from within the application.

Your rights

Wherever you are, the application lets you exercise the rights that data protection law usually grants, without asking us:

• Access and portability: export everything in your account as a single file from the settings.
• Correction: every record can be edited.
• Erasure: delete the account from the account settings, with your password and username.

If you are in the European Economic Area, the United Kingdom or Switzerland, the General Data Protection Regulation (or its local equivalent) applies. We process account and financial data to provide the service you asked for (performance of a contract) and security-related data such as throttling and error logs in our legitimate interest in keeping the service working and safe. You have the right to lodge a complaint with your local supervisory authority.

Children

The service is not directed at children. Since no identity information is collected, we cannot know a user's age; if you believe a child has created an account, the account can be deleted from within the application.

Changes

When the way the software handles data changes, this page changes with it and the date at the top is updated.