Privacy Policy

By creating an account or using Wallflake, you agree to the collection and use of information as described in this policy. If you do not agree with this policy, please do not use Wallflake.

We collect information in the following categories:

We use the information we collect to:

• Provide the service — display personalised stock data, portfolio tracking, dividend reminders, and market screener results.
• Authenticate you — verify your identity when you log in via email/password, Google Sign-In, or phone passcode.
• Send notifications — push notifications for price alerts, dividend announcements, and market updates (only if you grant permission).
• Send transactional emails — passcodes, password reset links, and important account notices.
• Improve the app — analyse usage patterns and crash reports to fix bugs and prioritise new features.
• Serve and measure ads — display in-app advertisements and count impressions and clicks for billing and reporting.
• Show creators audience totals — anonymous, thresholded percentages only.
• Moderate the community — review flagged content and enforce community standards.
• Process payments — manage your subscription and advertiser billing.
• Comply with legal obligations — respond to lawful requests and protect our legal rights.

Wallflake relies on the following processors. Each handles data only as instructed by us and under its own privacy policy:

Where a category lists several providers — email delivery, for instance — we use whichever is configured at the time. We encourage you to review these policies; we are not responsible for the privacy practices of third-party providers.

We share your information only in the following limited circumstances:

• Service providers — the processors listed in Section 4, only as necessary to provide the service.
• Legal requirements — where required by law, court order, or government authority, or to protect the rights and safety of our users.
• Business transfers — in the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you via email or in-app notice.
• Your consent — we may share information with your explicit consent for purposes not covered here.

Posts and comments you publish in MoneyTalk are visible to other users. Your display name and profile image are shown alongside your public content. Your age, gender, investing budget, and other private profile fields are not.

When content is reported by another user, the reported content and relevant account information may be reviewed by our moderation team. Reports are kept confidential — the reporting user's identity is not disclosed to the person whose content was reported.

If you enable push notifications, we collect and store your device's push notification token to deliver price alerts, dividend reminders, news updates, challenge notifications, and broadcast announcements from the Wallflake team.

You can disable notifications at any time through your device settings. Disabling them does not affect in-app notification delivery.

Wallflake uses an over-the-air (OTA) update system. When you open the app, it may check for and automatically download available updates. During this process, version metadata (app version, runtime version, update channel) is transmitted to our update servers. No personally identifiable information is included in these requests.

We retain your personal data for as long as your account is active or as needed to provide our services. Specifically:

• Account data — retained while your account exists. Deleted within 30 days of an account deletion request.
• Portfolio and watchlist data — deleted with your account.
• Analytics data — individual session data deleted after 90 days; aggregated and anonymised after 12 months.
• Passcodes and authentication tokens — automatically expired and deleted within 24 hours.
• Advertising logs — retained for up to 90 days for fraud detection and billing reconciliation.
• Legal obligations — some data, including payment records, may be retained longer where required by applicable law.

To delete your account and all associated data, visit the account deletion page, use the in-app setting, or contact us directly.

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data. You can update most profile information directly in the app settings.
• Deletion — request deletion of your account and personal data. Use our account deletion page for self-service deletion.
• Portability — request a machine-readable copy of your data to transfer to another service.
• Withdraw optional data — clear your gender, investing budget, or other optional profile answers at any time from Edit Profile.
• Opt out of marketing — unsubscribe from promotional emails at any time using the link in any email we send.
• Withdraw consent — disable push notifications in your device settings at any time.

To exercise any of these rights, please contact us using the details in Section 14.

We take the security of your data seriously and implement appropriate technical and organisational measures, including:

• HTTPS encryption for all data transmission between the app and our servers.
• Passwords are hashed using industry-standard bcrypt — we never store plain-text passwords.
• Authentication tokens with short expiry periods and secure refresh mechanisms.
• Rate limiting on authentication endpoints to prevent brute-force attacks.
• Payment processing is handled entirely by Paystack and Stripe; we do not store card numbers on our servers.

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your data to the best of our ability.

This is why we ask for your year of birth during onboarding, and why we do not accept a year implying you are under 18.

Public pages on wallflake.com — news, market data, and public community posts — may be read by anyone 13 or older without an account. We do not knowingly collect personal information from anyone under 13.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at the address in Section 14. We will promptly delete such information from our records.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Send an in-app notification or email to registered users for significant changes.

Your continued use of Wallflake after any changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically.