Privacy Policy

By downloading or using Wallflake, you agree to the collection and use of information as described in this policy. If you do not agree with this policy, please do not use the app.

We collect information in the following categories:

We use the information we collect to:

• Provide the service — display personalised stock data, portfolio tracking, dividend reminders, and market screener results.
• Authenticate you — verify your identity when you log in via email/password, Google Sign-In, or phone OTP.
• Send notifications — push notifications for price alerts, dividend announcements, and market updates (only if you grant permission).
• Send transactional emails — OTP codes, password reset links, and important account notices.
• Improve the app — analyse usage patterns and crash reports to fix bugs and prioritise new features.
• Show relevant ads — display in-app advertisements from local Ghanaian businesses. Ad data is used to measure ad performance.
• Process payments — manage your premium subscription through Stripe.
• Comply with legal obligations — respond to lawful requests from authorities and protect our legal rights.

We do not sell your personal data to third parties.

Wallflake integrates the following third-party services. Each has its own privacy policy that governs how they handle your data:

We encourage you to review the privacy policies of these services. We are not responsible for the privacy practices of third-party providers.

We share your information only in the following limited circumstances:

• Service providers — We share data with third-party partners listed in Section 4 only as necessary to provide the service.
• Legal requirements — We may disclose your information if required by law, court order, or government authority, or to protect the rights and safety of our users.
• Business transfers — In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you via email or in-app notice.
• Your consent — We may share information with your explicit consent for purposes not covered here.

We retain your personal data for as long as your account is active or as needed to provide you with our services. Specifically:

• Account data — retained while your account exists. Deleted within 30 days of account deletion request.
• Portfolio and watchlist data — deleted with your account.
• Analytics data — aggregated and anonymised after 12 months; individual session data deleted after 90 days.
• OTP and authentication tokens — automatically expired and deleted within 24 hours.
• Advertising logs — retained for up to 90 days for fraud detection and billing reconciliation.
• Legal obligations — some data may be retained longer where required by applicable law.

To delete your account and all associated data, visit the account deletion page or contact us directly.

Depending on your location, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you.
• Correction — Request correction of inaccurate or incomplete data. You can update most profile information directly in the app settings.
• Deletion — Request deletion of your account and personal data. Use our account deletion page for self-service deletion.
• Portability — Request a machine-readable copy of your data to transfer to another service.
• Opt-out of marketing — You can unsubscribe from promotional emails at any time using the link in any email we send.
• Withdraw consent — Disable push notifications in your device settings at any time.
• Ad personalisation — You can opt out of personalised ads through your device settings (iOS: Settings → Privacy → Tracking; Android: Settings → Google → Ads).

To exercise any of these rights, please contact us using the details in Section 10.

We take the security of your data seriously and implement appropriate technical and organisational measures, including:

• HTTPS encryption for all data transmission between the app and our servers.
• Passwords are hashed using industry-standard bcrypt — we never store plain-text passwords.
• Authentication tokens (JWT) with short expiry periods and secure refresh mechanisms.
• Rate limiting on authentication endpoints to prevent brute-force attacks.
• Payment processing is handled entirely by Paystack and Stripe; we do not store card numbers on our servers.

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your data to the best of our ability.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at the address in Section 10. We will promptly delete such information from our records.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Send an in-app notification or email to registered users for significant changes.

Your continued use of Wallflake after any changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically.