Privacy policy

Version of 4 November 2026

Wambito belongs to Slinqer S.A.S., a Colombian company. Slinqer S.A.S. is the controller of your data under Colombia's Ley 1581 de 2012 (its data protection law). This policy covers wambito.com, app.wambito.com and the Android app when it uses our server. For any question about your data, write to privacy@wambito.com.

Your email. Your passkeys, only their public part: the private key stays on your device. What you log or import: transactions, categories, budgets and recurring items. Your time zone and language. If you connect an AI assistant, the permission you gave it. And, for security, the IP address and the kind of browser or app of each session, plus a minimal log of visits: when, from which IP, which page and how it answered. That log keeps neither what comes after the “?” in addresses nor the headers.

Your email, so you can sign in with a code or a link, and so we can answer if you write to us. Passkeys, so you can sign in without a password. Your transactions, categories, budgets and recurring items, to show you your budget: that is what the app is for. The time zone, to know when your day and your month start. The language, to speak yours, in the app and in emails. The IP and sessions, to keep your account safe and stop abuse, such as asking for codes nonstop. Sign-in emails go out through an email delivery service, which only gets your address and the message.

On a server in the European Union. Your data travels encrypted between your device and the server. Every day we make a backup on the server and keep another copy, encrypted with age, in Cloudflare R2. No backup lasts more than 14 days: after that it deletes itself. So if you delete your account, it also leaves the backups within 14 days at most.

No trackers, no analytics, no ads. We don't sell your data or share it. It only passes through the services we need to run (the server, the backups and email delivery), and only for that.

In the Android app you can dictate an expense. Your voice is processed on your phone, with Vosk, and the audio never leaves it. The voice models are downloaded once, when you ask for them, from the project's releases on GitHub. Only the transaction you save reaches our server, as if you had typed it.

You can connect an AI assistant to your account. It only gets in if you allow it, on a permission screen (OAuth) that tells you what it will be able to do: read your data, log things for you, or both. You can take its access away whenever you like, in Settings. What the assistant reads is handled by the company that offers it, under its own policy.

In the Android app you can start without an email. Your data is stored on the server, in a guest account. If you add your email later, you keep it. A guest account left unused for 60 days is deleted with all its data, even if you signed out.

Wambito's code is open source and anyone can run their own server. If your app uses a server that isn't ours, whoever runs it is the controller of your data there, not Slinqer S.A.S. This policy only covers the servers we run.

Under Ley 1581 de 2012, you can know what data we hold about you, update it, correct it, ask us to delete it and withdraw your consent. To do so, write to privacy@wambito.com from your account's email. Many things you can do without writing to us: download your data in Settings or delete your account. If you are not satisfied with our answer, you can turn to Colombia's Superintendencia de Industria y Comercio.

If we change this policy, we publish the new version here with its date. The date at the top is that of the version in force.