Privacy Policy

Warren is run by Martin Flischman, in South Africa (“we”, “us”). We decide how your information is used, so we are responsible for it under South Africa's Protection of Personal Information Act (POPIA) and, for people in Europe and the UK, the GDPR. Questions about your data go to hello@warrenapp.app.

• Your account: your email address and the name you give us. If you sign in with Google, Google also shares your name and profile picture.
• What you enter: expenses (amount, date, category and note), budgets, repeating expenses, your category rules and your settings (country, currency, budget alerts).
• Bank statement imports: only the expenses you choose to save, plus the column layout of the file so the next import is quicker. The statement itself is opened on your phone or computer and is never uploaded. A password for a locked PDF is never stored.
• On your device: your sign-in session, and small choices like light or dark mode and the tab you had open. These stay in your browser.
• Payments: the plan you bought (1-Year Pass or Lifetime Deal), its status, and what Creem tells us about the purchase (your email, country and the amount). Your card details go straight to Creem; we never see them.

We don't ask for your bank login, and we don't connect to your bank. Notes hold whatever you type, so please don't put other people's private details, passwords or full card numbers in them.

We don't use cookies for ads or tracking. Your sign-in session and your choices are kept in your browser's own storage, and Vercel's visit statistics use no cookies, so there is no cookie banner.

Only to run Warren for you: sign you in, save and show your spending, work out your budgets and warn you before you overspend, and answer you when you write to us. We use visit statistics (below) to see which pages are used, so we can improve the site. We use your information because you asked us to provide the service, and the statistics because we have a fair reason to keep the site working well.

Your expenses are for your eyes. Nobody at Warren reads, browses or analyses them. We don't build a profile of you, use your data for marketing, or use it to train AI. The app works out your totals and budgets automatically; no person goes through your records.

In the app, every expense is locked to your login, so no other user can ever see it. Behind the scenes, as with any online service, the person who runs Warren has administrator access to the database, so it can be kept running. That access is protected by two-factor sign-in, and it is used only when you ask us for help with your account, to fix a fault that can't be fixed any other way (and then only the part needed), or when the law requires it. Never to look at your spending.

We don't sell your information, show ads, or pass it to data brokers. The only companies that handle it are the ones that help us run Warren:

• Supabase stores your account and everything you enter, and sends the sign-in emails. Your data is kept in its Zurich, Switzerland region (it runs on Amazon Web Services).
• Vercel hosts the website and app, and counts visits with Vercel Web Analytics. It uses no cookies and doesn't follow you to other sites; it sees which page was opened, the referring site, and the country, device and browser.
• Google, only if you choose “Continue with Google”, to confirm who you are.
• Creem (creem.io) takes your payment as the seller of record: it handles the checkout, your card details, receipts and sales tax. Its own privacy policy applies to the payment.

We may also share information if the law requires it, for example a court order. If we add or change a company that handles your data, we'll update this list, and tell you first if the change matters.

Our website links to a few other sites (for example Creem's checkout). They have their own privacy policies, and we aren't responsible for what they do.

Your saved data is stored in Switzerland. Vercel, Google and Creem may handle some information in other countries, including the United States. When information leaves South Africa or Europe, it is protected by these companies' own data protection terms.

For as long as you have an account, including after a 1-Year Pass ends, so you can come back or export your data. When you delete your account (Settings, Delete account), your account and everything in it are deleted straight away. Copies may stay in our hosting company's backups for a short time until they are replaced.

Every connection is encrypted, your data is encrypted where it is stored, and every expense is locked to your login: the database itself refuses anyone else. The accounts that run Warren are protected by two-factor sign-in. You sign in with Google or a one-time code sent to your email, so there is no password to steal. No system is perfect, though; if something goes wrong that affects your information, we'll tell you and the regulator as the law requires.

• See and take your data: export all your expenses as a CSV file in Settings, or ask us for everything we hold.
• Correct it: edit anything in the app, or ask us.
• Delete it: delete your account in Settings, or ask us.
• Choose what you give: you can decide not to give us some information, but Warren may then not be able to do everything for you (it needs an email address to sign you in).
• Object or complain: write to hello@warrenapp.app. You can also complain to South Africa's Information Regulator (inforegulator.org.za) or your own country's data protection authority.

Warren is for people aged 18 and over. We don't knowingly keep information about children; if you think we do, tell us and we'll delete it.

If we change this policy, we'll update the date at the top. If the change matters, for example a new company handling your data, we'll tell you by email or in the app first.

Martin Flischman, South Africa. Email hello@warrenapp.app.