Where Went
en
Sign in

Legal

Privacy Policy

This policy explains how Where Went handles personal data. In short: we collect only what is needed to run the service, we don't use advertising or tracking, and we never sell your data.

1. Who is responsible

The controller of your personal data is Miroslav Petrov, a private individual in Bulgaria. Contact: ilyovskim@gmail.com.

2. What data we process

We process these categories of data:

  • From your Google account, when you sign in: your name, email address, profile picture, whether your email is verified, and your Google account ID. We never see your Google password.
  • What you enter in the app: your accounts (names, types, currencies, opening balances), categories, and transactions (amounts, dates, notes).
  • Sign-in sessions: the IP address and browser information (user agent) of each session, and when it was created and last used.
  • Technical logs kept by our hosting provider for a short time (for example request times and errors), used to keep the service secure and working.

3. Why we process it (legal bases)

To provide the service you signed up for: your account, your data and the calculations based on it (Art. 6(1)(b) GDPR, performance of a contract).

To keep the service secure and reliable, prevent abuse, and understand overall usage through counts such as the number of users and transactions (Art. 6(1)(f) GDPR, our legitimate interest in running a safe service).

To comply with legal obligations, if any apply (Art. 6(1)(c) GDPR).

We do not use your data for advertising, profiling or automated decisions, we don't use analytics or tracking tools, and we never sell your data.

4. What the operator can see

The service has an admin page for running it. It shows each user's name, email address, profile picture, sign-up date, last activity, the browser and operating system of their latest session, and how many accounts, categories and transactions they have. It does not show amounts, balances or the contents of transactions.

We access your financial entries only when it is necessary to fix a technical problem, when you ask us to (for example for support or a copy of your data), or when the law requires it.

5. Service providers

We use these providers to run the service. They process data on our behalf under data processing agreements:

  • Vercel Inc. (USA): hosting. The app's servers run in Frankfurt, Germany; pages are delivered through Vercel's global network.
  • Neon Inc. (USA): database. Your data is stored on servers in Frankfurt, Germany (Amazon Web Services).
  • Google: sign-in with your Google account. Google processes your sign-in under its own privacy policy.

6. Transfers outside the EU

Your data is stored in the EU. Our hosting and database providers are US companies, so limited access from outside the EU (for example for technical support) can't be ruled out. Such transfers are based on the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

7. How long we keep data

Your account and everything you entered: until you delete your account, or until we delete it after a shutdown of the service. Deleting your account removes it from our database immediately; copies in the database provider's backups are overwritten within 30 days at the latest.

Sign-in sessions expire after 7 days of inactivity. Hosting logs are kept only for a short time by the provider.

8. Cookies and local storage

We use only what the service needs to work, so no consent banner is required:

  • a sign-in cookie that keeps you logged in (and short-lived cookies during Google sign-in);
  • a language cookie (NEXT_LOCALE) that remembers your language for one year;
  • your light or dark theme choice, stored in your browser's local storage.

9. Your rights

Under the GDPR you have the right to access your data, have it corrected or deleted, restrict or object to its processing, and receive it in a portable format. You can delete your account and all its data yourself in the app at any time. For anything else, write to us; we answer within one month.

You also have the right to complain to a data protection authority. In Bulgaria this is the Commission for Personal Data Protection (cpdp.bg); you can also contact the authority in the EU country where you live.

10. Security

All connections use HTTPS. We don't store passwords, because sign-in goes through Google. Every request to your data is checked against your account on the server, and the database is accessible only to the service.

11. Children

The service is not meant for anyone under 16. If you believe a child has created an account, contact us and we will delete it.

12. Changes to this policy

If we change how we process data, we will update this page and its date. For significant changes, we will also tell you in the app or on the website before they take effect.