Privacy Policy

1. Who We Are

Wealth Ninja is a personal finance tracking and planning tool operated by Cyberdyne Investments cc, a close corporation registered in Namibia. We are the data controller for personal data processed through the Wealth Ninja web app (wealthninja.app) and mobile applications on iOS and Android.

Wealth Ninja is for educational and informational purposes only. We do not provide financial, investment, tax or legal advice.

2. Data We Collect

2.1 Account & Identity Data

• Email address (required for account creation and login)
• First name and last name (optional, used for display and statements)
• Profile picture (optional, uploaded by you)
• Date of birth (optional, used for retirement planning calculations)
• Country / location (optional, used to suggest default currency)
• Password (stored as a one-way bcrypt hash — we cannot read your password)
• Google account ID and profile photo URL (only if you sign in with Google)

2.2 Financial Data

All financial data you enter is encrypted at rest with AES-256-GCM and is never shared or sold. This includes:

• Income sources and amounts
• Expense categories and amounts
• Assets (savings, investments, property, vehicles, retirement funds)
• Liabilities (loans, credit cards, mortgages)
• Financial goals and target amounts
• Monthly budget figures and snapshots

2.3 Subscription & Billing Data

• Subscription plan (Free or Pro) and status
• For mobile subscriptions: transaction receipt data processed by RevenueCat and the respective app store (Apple App Store / Google Play). We do not receive or store full card numbers.
• For web billing: last 4 digits, card brand, and expiry date (stored for display only; full card data is handled by the payment processor)
• Billing address (optional)

2.4 Security & Authentication Data

• JWT access and refresh tokens (stored client-side, used to authenticate API calls)
• Two-factor authentication (2FA) TOTP secret and encrypted backup codes
• Email verification tokens and password reset tokens (short-lived, hashed)
• Active session identifiers (IP address, user agent, last active timestamp)

2.5 Usage & Technical Data

• Page views, feature usage patterns, and navigation flows
• Error and crash reports (via Sentry — see §5)
• Request logs (IP address, timestamp, endpoint) — retained for 30 days
• Device type, operating system, and browser version (from HTTP headers)
• Privacy-preserving analytics via Vercel Analytics (no cross-site tracking)

3. How We Use Your Data

We do not sell your data, use it for advertising, or share your financial data with any third party for their own purposes.

4. Security Measures

• AES-256-GCM encryption for all financial data at rest
• TLS 1.2+ for all data in transit
• Passwords stored as bcrypt hashes (one-way, never recoverable)
• 2FA support (TOTP authenticator apps)
• Short-lived JWT access tokens (1 hour) and longer-lived refresh tokens
• Session management — view and revoke active sessions from Settings
• Financial data decrypted only in memory, never written to logs
• Rate limiting on all API endpoints

No method of transmission over the internet is 100% secure. While we take extensive precautions, we cannot guarantee absolute security.

5. Third-Party Data Processors

We engage the following sub-processors. Each is bound by a data processing agreement or equivalent terms that meet GDPR Article 28 requirements.

We do not use any advertising networks or data brokers.

6. Data Retention & Deletion

You can delete your account at any time from Settings → Security → Delete Account, or by submitting a request on our Data Deletion page. Deletion removes all personal and financial data except records we are legally required to retain (e.g., billing records for tax purposes).

7. Your Rights

Depending on your location, you have the following rights regarding your personal data:

To exercise any of these rights, email privacy@wealthninja.app or use our Data Deletion page. We will respond within 30 days (extendable to 90 days for complex requests). We may need to verify your identity before processing the request.

8. Children's Privacy

Wealth Ninja is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, please contact us at privacy@wealthninja.app and we will delete the account promptly.

9. International Data Transfers

Your data may be transferred to and processed in countries other than South Africa, including the United States, where our sub-processors operate. Where required by GDPR, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to legitimise such transfers. For EU/EEA users, our data processing agreements with sub-processors incorporate the applicable SCCs.

10. POPIA — South Africa

For users in South Africa, we comply with the Protection of Personal Information Act, 2013 (POPIA). Our Information Officer is responsible for ensuring compliance and can be contacted at privacy@wealthninja.app. Under POPIA, you have the right to:

• Be notified when we collect your personal information
• Access the personal information we hold about you
• Request correction or deletion of your information
• Object to the processing of your personal information
• Lodge a complaint with the Information Regulator of South Africa

Information Regulator contact: inforegulator.org.za · inforeg@justice.gov.za

11. Cookies

We use only essential cookies for authentication and session management. We do not use advertising or cross-site tracking cookies. See our full Cookie Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or via an in-app notice at least 14 days before the change takes effect. The "Effective date" at the top of this page always shows when the current version came into force. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact Us