Skip to content
Upwardo
See the price — it’s on the door
Privacy

Upwardo Privacy Policy

Last updated: 2026-10-24

You need no account, and readable ledger data stays on your devices with end-to-end encrypted sync. RevenueCat verifies purchases and PostHog handles app, server and website analytics; you can request deletion.

1. What never happens

  • We never connect to banks or collect account emails or passwords. Synced amounts, merchants, envelopes and notes reach us only as ciphertext.
  • Receipt images and recordings stay on-device. We exclude extracted text, amounts, merchants, notes and transcripts from analytics. Monthly reviews run on-device.
  • We sell no data, show no ads and collect no IDFA or GAID advertising identifiers.
  • Native crash capture, app session replay and screen recording are off.
  • We use no website session replay or screen recording.
  • Website click capture masks text, attributes and link queries.

2. Information we handle

2.1 On your device

We store envelopes, entries, budgets, exchange rates and settings. We use them to run the app and keep them on-device until you delete everything or uninstall. Free export offers a restorable or spreadsheet CSV without deleting the ledger. Delete everything clears local and server records.

2.2 Purchases

We use receipts, transaction IDs and a random customer identifier to unlock and restore Plus and cache offline access under our purchase contract. Stores take payment, and RevenueCat verifies your entitlement. We never see card numbers. Stores and RevenueCat keep purchase records under their terms. We keep no separate payment copy. Restore purchase recovers access. Our server checks RevenueCat using the sync group identifier and stores entitlement level, expiry and grace end until you delete the server group. This is not a separate payment record.

2.3 Encrypted sync

We use encrypted records and snapshots, a sync group identifier, device public keys and entitlement status to authenticate devices and sync them under our contract. Our hosting providers in the United States store ciphertext and control metadata, not readable ledger contents. Every paired device can read and change the ledger. We keep the group until Delete everything removes it. Pairing invitations expire within 10 minutes. Deletion markers and pending events remain until delivery or 5 failed attempts. We retain the two newest encrypted snapshots plus later operations.

2.4 App analytics, diagnostics and surveys

We collect which screens and controls you use and for how long, what actions succeed or fail, errors and performance. This includes app, device, operating-system and language details, install context from Apple Ads and Google Play, and optional survey answers, including typed text. We rely on our legitimate interest in understanding app use, fixing faults, reviewing feedback and measuring campaigns. PostHog receives this data, retains IP addresses and derives approximate country, region and city. App events use a random identifier and opaque record references, not ledger contents. RevenueCat instead uses the sync group identifier and receives technical app and device context and your IP address. Raw Play referrers and Apple attribution tokens are never sent to PostHog.

PostHog keeps analytics under its terms. We keep no separate copy. There is no consent prompt or analytics switch. Internal QA only changes event classification. Desktop builds send no telemetry.

2.5 Server events

We report entitlement activations and group deletions to check service operations under our legitimate interest, not to prove payment. PostHog receives a separate random identifier and administrator-set real, internal or review classification, not a ledger identifier. It sees the server IP, with location lookup off. Pending events expire after delivery or five failed attempts. PostHog keeps delivered events under its terms. We keep no separate copy. You can request deletion of sent records.

2.6 Website analytics

We collect visits, clicks, visit duration, public page addresses and queries, referrers, campaigns, browser and device details, errors and performance. Optional survey answers you type carry a random browser identifier. We rely on our legitimate interest in comparing visit sources and fixing broken or slow pages. PostHog receives this data, retains IP addresses and derives approximate country, region and city.

PostHog keeps analytics under its terms. We keep no separate copy. Cookies and browser storage remember identifiers until you clear site data. Hosting providers keep no separate website access log. You can request deletion of analytics records. Clearing local data leaves sent records intact. Please omit personal and contact details from surveys.

2.7 Advertising attribution

We collect Google, Microsoft, Meta or TikTok click identifiers on ad landings, based on our legitimate interest in measuring campaign results. Our conversion relay receives them. We can report ad-attributed purchases to the originating ad platform. We delete raw relay identifiers after 90 days. Your browser stores identifiers and a reference until you close the session. You can request deletion of sent records. PostHog retains public URLs containing these identifiers under its terms.

2.8 Update checks

We use your IP address to check for required updates, based on our legitimate interest in keeping the app working. Our hosting providers receive it. The update request contains no ledger data.

2.9 Support email

We use your email and message to answer requests, under our legitimate interest. We keep them for 12 months after the thread closes.

3. Providers and locations

We use these providers:

  • Apple App Store — payment and receipts (US).
  • Google Play — payment and receipts (US).
  • RevenueCat — store receipt validation and subscription status (US).
  • PostHog — mobile usage, diagnostics, performance and survey responses, server operational events and website analytics (US).
  • Hosting and security providers — hosting and storage (US).

4. Your rights

Where data-protection law applies, including the EU and UK, you can ask to see, correct, delete, restrict or export your data. You can object to our use of it. You can complain to your local supervisory authority.

Email support@upwardo.app to exercise these rights. We answer within 1 month. Export and Delete everything control your ledger. Contact us to identify sent analytics or purchase records.

5. Children

Upwardo is not directed at children. We do not knowingly collect children's personal data.

6. Changes

We announce data-processing changes in app update notes and website changes on-site before new processing begins.

7. Contact

Email support@upwardo.app or write to WaveApp LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA.