Privacy Policy

1. Who is responsible for your data

The controller of your personal data is Benjamin Barocio, an individual who develops and distributes the Walo mobile application ("Walo", "the app", "we") under the trade name Tomin Labs.

Registered address: Av. Revolución 2703, Ladrillera, Distrito Tec, 64830 Monterrey, Nuevo León, Mexico.

You can reach us at any time at info@waloapp.io.

2. Quick summary

3. What information we handle

3.1 Financial information you record

Amounts, dates, descriptions, categories, tags, accounts (name, type and balance) and budget items. All of this is stored in a local database (SQLite) inside the app's private storage on your device. It is not transmitted to us and is not held on any server of ours.

Walo does not connect to financial institutions, does not import transactions automatically, does not make payments, and never asks for banking credentials.

3.2 Sign-in account data

Sign-in is handled by Firebase Authentication, a service from Google LLC. Depending on the method you choose, the following is processed:

• Email and password: your email address and an encrypted version of your password. We never see your password in plain text.
• Google: the email, name and profile picture of the Google account you select.
• Apple: your Apple identifier and your email. If you choose "Hide My Email", we only ever receive Apple's private relay address, never your real one.

Firebase also generates an internal user identifier and records the creation and last sign-in dates. This account exists solely to identify you, to keep different people's data separate on a shared device, and to associate your backups.

3.3 In-app profile

Nickname, avatar or photo, age range, preferred currency, language, theme and estimated income. These are stored locally. If you pick a photo from your gallery the app requests photo access; the selected image stays on your device and is not uploaded anywhere.

3.4 Backups you create

If you enable backup, a copy of your database is uploaded to your own cloud storage:

• Google Drive: the file is stored in the hidden application data folder (appDataFolder). Walo requests only the drive.appdata scope, which does not grant access to the rest of your Drive; it can only see files the app itself created.
• iCloud: the file is stored in Walo's private container inside your iCloud account.

The backup stays in your account, under your control, and is additionally governed by Google's or Apple's privacy policies. We have no access to it.

CSV export produces a file on your device that you choose where to send or save.

3.5 Subscriptions and purchases

Walo Pro subscriptions are processed entirely by the App Store or Google Play. Your card details and payment information never pass through Walo and are never received by us. The app only asks the store whether your subscription is active and until what date.

3.6 Notifications

Walo's reminders are local notifications: your own device schedules them. We do not use push notifications, there is no server sending you messages, and we do not register a notification token.

4. What we use the information for

• Run the app: show your balances, transactions, budgets and reports.
• Authenticate you: let you sign in and keep different accounts' data separate on a shared device.
• Back up and restore: when you request it.
• Reminders: alert you to an upcoming payment or the daily log, if you enable them.
• Manage your subscription: check with the store whether you have access to Pro features.
• Support you: answer your questions by email.

The legal basis is performance of the contract (providing the service you asked for) and, for cloud backup and the support assistant, your explicit consent when you enable them.

5. Who we share your information with

Only with the providers strictly necessary for the app to work, and only with the data listed:

We may also disclose information where legally required by a competent authority. In practice, most of your information never leaves your device, so it is not in our possession to hand over.

6. What we don't do

• We do not sell, rent or trade your personal information.
• We do not show advertising or share data with ad networks.
• We do not embed third-party analytics, measurement or tracking tools.
• We do not build commercial profiles of you or make automated decisions with legal effects on you.
• We do not track your activity across other apps or websites.
• We do not access your location, contacts, microphone or camera.

7. International transfers

The providers named above (Google and Apple) operate infrastructure outside Mexico, primarily in the United States. By using sign-in, cloud backup or the support assistant you accept that this data is processed abroad in accordance with those providers' privacy policies and safeguards.

8. How long we keep it

• Data on your device: for as long as the app is installed. Uninstalling it makes the operating system delete the local database.
• Sign-in account: for as long as your account exists. It is deleted when you ask us to.
• Backups: they remain in your Google Drive or iCloud until you, or we at your request, delete them.
• Support emails: up to 24 months, for follow-up and clarifications.

9. Security

Your database is stored in the app's private area, protected by the operating system from other applications. Google Drive access tokens are stored in the device's secure keystore (Keychain on iOS, Keystore on Android). All communication with Firebase, Google Drive and iCloud travels encrypted over HTTPS/TLS.

We recommend protecting your device with a passcode, fingerprint or face: anyone with physical, unlocked access to your phone has access to the app.

No system is infallible. If we detect a breach affecting your personal data, we will notify you by email without undue delay.

10. Data deletion

There are two paths, depending on what you want removed:

1. Delete the data on your device: uninstall Walo. That removes the local database with all your transactions, accounts and budgets. This is irreversible if you have no backup.
2. Delete your account and backups: email info@waloapp.io from the address you registered with, using the subject "Delete my account". We will verify your identity and delete your sign-in account and associated backups within 30 calendar days. We will confirm by email once it is done.

If you have an active subscription, cancel it first from the App Store or Google Play: deleting your account does not stop the recurring charge, because that charge is managed by the store and not by us.

11. Your rights

In Mexico, the Federal Law on Protection of Personal Data Held by Private Parties grants you ARCO rights: to access your data, rectify it if inaccurate, cancel it when you consider it unnecessary, and object to its use for specific purposes. You may also withdraw your consent at any time.

If you live in the European Union or the United Kingdom, you additionally have rights to portability, restriction of processing, and to lodge a complaint with your supervisory authority. If you live in California, you have the right to know what information is collected and to request its deletion; note that Walo does not sell personal information.

To exercise any of these rights, email info@waloapp.io. We will respond within 20 business days. In Mexico, if you are not satisfied with our response, you may contact INAI.

12. Children

Walo is not directed at children under 13 and we do not knowingly collect their data. If you are a parent or guardian and believe a child in your care created an account, email info@waloapp.io and we will delete it.

13. Changes to this policy

We may update this policy when the app's features or applicable regulations change. The current version is always published on this page with its last-updated date. If a change is material, we will notify you in the app or by email before it takes effect.

14. Contact

For any question about this policy, about how your data is handled, or for general technical support, email info@waloapp.io.

If your message is about privacy, put "Privacy" in the subject line so it reaches the right person faster.