Privacy Policy
In force since November 12, 2026
This is a translation for your convenience. If the two versions differ, the Spanish version is the one that applies.
Who we are
Where's My Money is a personal finance app, run under the trade name "Camba Labs". In this document, "Camba Labs", "the app" or "we" mean those who build and run the service, and "the user" means whoever uses it.
This policy explains what information is kept, for what purpose, who it is shared with and what options the user has about it. It is written to be understood in one reading.
What information is kept
Information given when creating the account
- The email, which is also used to sign in.
- The password, stored as a hash. The password itself is not kept and cannot be read.
- The name, if the user decides to enter it. It is optional, it is used to personalize the greeting and the people the user invites can see it.
- If the user signs in with Google, the identifier Google returns, the related email and the name of that account. That name is only kept if the account had none, and the user can change it. The Google password is not received.
Information given by the user
- The file of the bank statement or receipt is not kept. It is processed when uploaded and discarded when the reading ends. The only exception comes after two failed uploads in a row: the file of the second one is held for up to 10 minutes while the app asks the user whether to send an error report and, only if the user agrees, it is kept until the report is closed, for 7 days at most. The information that stays stored is listed below.
- The transactions extracted from that file, with their date, amount, currency, description, category and balance. When the statement includes them, also the city and country of the shop, the original amount and currency of a purchase in another currency, the channel it was made through and the operation number.
- The transactions and accounts the user adds by hand, for example a cash account, with their date, amount, currency, description, category and note. This is data the user provides, it is kept like the other transactions and it is deleted along with the account. If a statement uploaded later contains the same transaction, both are joined into one record.
- The account number and the bank shown on the statement.
- The full response of the artificial intelligence model that processed the document, which includes the text of the statement. It is kept to be able to audit why a transaction was recorded in a certain way. Without that record, a reading error could not be reviewed.
- The notes and category corrections the user enters.
Information generated automatically
- Dates of creation of the account, of upload of each document and of each correction.
- The status of the subscription, reported by the store where it was bought. The details of the payment card are never received.
How the full account number is handled
The full account number is kept, as printed on the statement. It is what lets the app recognize that two statements belong to the same account, and it is needed when there are several accounts at the same bank.
In the app it is shown hidden, for example ****1234, and the matching icon has to be pressed to see it in full. It travels encrypted and is not part of any analytics process. In the database it is kept like the rest of the information, without encryption of its own, and the backups are encrypted before they leave the server.
This point is spelled out because an account number stored without notice is exactly the kind of information nobody expects to find without a warning. Anyone who prefers this data not to be kept can choose not to use the app. Deleting the account also deletes it.
Purpose of the data processing
- Providing the service. Processing statements, sorting transactions, creating the spending panel and flagging unusual charges.
- Access to the account. Verifying the email, allowing password recovery and keeping the session active.
- Managing the Premium subscription. Identifying the plan bought and how long it lasts.
- Technical support. Reviewing a wrong reading when the user reports it.
- Analysis of how the product is used, through aggregated data that cannot identify anyone.
The user's information is not sold. The Free plan may include advertising. The Premium plan does not, and that is one of the things it covers. The advertising provider may receive device identifiers to choose which ad to show. The user's transactions, balances and statements are never given to it.
Processing statements with artificial intelligence
When a document is uploaded, its content is sent to Anthropic, the provider of the Claude model, to extract the transactions. It is the method used to process a statement not seen before.
- What is sent is the document, not the user's name or email. The model has no way to identify who the statement belongs to.
- Anthropic does not use this content to train its models, under the terms of its commercial API.
- Before sending, protections are applied so that text inside the document cannot give instructions to the model.
Third parties that process the information
We work with providers that process data on behalf of the app, only for the purposes listed below.
| Provider | What for | What it sees |
|---|---|---|
| Anthropic | Processing statements | The content of the document |
| Server infrastructure provider | Running the app | All the information the app processes |
| Database provider | Storing the information | All the stored information |
| Signing in with a Google account, when it applies | The email and an identifier of the account | |
| Apple and Google | Processing the subscription charge and reporting its status | The payment details, which the app cannot see |
| Email provider | Sending verification codes | The email and the text of the message |
| Backup provider | Keeping backups of the database | An encrypted copy of all the information, which it cannot read |
| RevenueCat | Managing the status of the subscription | An identifier of the account and the Premium plan purchases |
| Google Firebase | Sending notifications to the device | A device identifier for notifications |
| Google AdMob | Showing advertising on the Free plan | The advertising identifier of the device, the IP address and the interaction with the ads |
Google AdMob is different from the other providers. It does not act only on behalf of the app. It also uses that data for its own advertising purposes, under Google's privacy policy. It never receives the user's transactions, statements or email. The Premium plan does not include advertising, and the advertising identifier can be deleted or reset from the Android settings.
Some of these providers process the information on servers located in different countries. Using the app means accepting that transfer.
Outside this list, the information is only given if a competent authority demands it through a valid order.
The anonymous copy and why it cannot be undone
To understand how the app is used and, in the future, to allow comparing one's own spending with that of other users, a copy of the transactions is kept in a separate database. That copy is designed so that it cannot identify who each record belongs to.
Information included in that copy
The date, the amount, the currency, whether it is income or an expense, the category assigned by the system, the bank, and the name of the shop only when it is one on a closed list of known businesses, such as Netflix or Spotify.
Information that is never included
The user identifier, the email, the name, the account number in any form, the description given by the bank, the notes, the balance, and the identifiers of the transaction, the account or the document. A custom category is not included either, since it is text entered by the user.
Why deleting the account does not reach this copy
When the account is deleted, that copy stays stored. This is not a lack of will but a technical impossibility. No column in those records shows that they were ever tied to an account, which is exactly the goal of the design.
The same applies to the monthly files exported for analysis. In them, each person gets a key that changes every month, so it is not possible to follow the same user from one month to the next.
This is spelled out in advance to avoid surprises later. Anyone who does not agree with this treatment can choose not to upload documents.
How long information is kept
| What | How long |
|---|---|
| Account, email, name and password | While the account stays active. When it is deleted, they are deleted immediately. |
| File of the statement | It is not kept. It is discarded when the reading ends. Exception: after two failed uploads in a row, up to 10 minutes while waiting for the answer of the user and, if the user agrees to send an error report, until it is closed, for 7 days at most. |
| Response of the model and notes | They are deleted when the account is deleted. |
| Transactions with no linked owner | 90 days |
| Anonymous copy | Indefinitely, since it cannot be tied to any person. |
Deleting the account
From the app, in My account, with the Delete my account button. There is no need to write or wait for an answer.
When that happens, the email, the name, the password, the open sessions, the subscription, the response of the model and the notes are deleted immediately. The transactions are left with no data tying them to the user, and they are deleted after 90 days.
If the user no longer has the app, they can ask for the deletion by writing to info@camba-labs.com from the email tied to the account, with the subject "Delete my account". The deletion is done within 7 days and confirmed by email. The same information is deleted as when done from the app.
Information already in the anonymous copy stays stored, as explained in the section "The anonymous copy and why it cannot be undone".
Rights of the user
At any time, the user can ask to:
- Know what information of theirs is stored.
- Correct wrong information.
- Delete the account, which can also be done directly from the app.
- Get a copy of the data in an accessible format.
Requests can be sent to info@camba-labs.com, and are answered within 15 business days. More information may be asked for to confirm ownership of the account, so as not to give data to a third party.
Security
- All information travels encrypted between the device and the servers of the app.
- Passwords are stored as a hash using Argon2, so they cannot be read.
- The session is kept in the secure storage of the device: Keychain on iOS and Keystore on Android.
- Each query for transactions is tied to the user in question, and there are automatic tests that check that no person can reach the data of another.
No system is infallible. If a leak affecting the user happens, the user will be told.
Minors
The app is meant for people over 18 years old. It is not offered to minors and information from minors is not collected on purpose. If an account is found to belong to a minor, it will be deleted.
Changes to this policy
Before substantial changes take effect, notice will be given inside the app, and the date at the top of the document will be updated. Continuing to use the app after that notice means accepting the updated version.
How to contact us
By email to info@camba-labs.com.