Privacy Policy

The short version

• Your messages, your household picture, and any files you upload are encrypted at rest under per-household keys.
• Sign-in is passwordless - we email you a one-time link, so there's no password to leak.
• Walt doesn't link to your bank or pull data from financial institutions - your information comes from you.
• We don't sell your personal information, and we don't use your private content for advertising.
• To make Walt work, your conversations are processed by our AI providers and stored with the service providers listed below.
• We use analytics and error-reporting tools to understand public-site traffic, improve the product, and catch bugs. Those tools are not allowed to receive your financial values, document contents, message text, account names or numbers, filenames, email address, or display name.
• You can ask us to delete your data at any time at hello@dearwalt.com.

Information we collect

Information you give us

• Account details - your email address (used for the passwordless sign-in link), the display name you choose, and, optionally, the gender you provide so Walt can refer to each person correctly.
• Content you create - the messages you send, the household picture Walt maintains, and any files you upload (such as PDFs, images, or CSVs).
• People you invite - if you invite someone, we process the email address you provide to send the invitation.

Information we collect automatically

• Basic usage and security logs - standard request data (such as timestamps and error logs) used to operate and protect the service.
• Analytics and product usage events - public-page visits and clicks, sign-in funnel events, and coarse in-product events such as messages sent, chats created, invites sent, documents opened, or review jobs succeeding or failing. We use coarse event names, booleans, counts, and type buckets rather than private content.
• A lightweight presence signal - we record when you were last active so Walt knows whether to nudge someone in-app or by email, rather than emailing people who are already here.

How your content is protected

Content is encrypted at rest using envelope encryption. Each household has its own random data-encryption key; your content is encrypted with that key (AES-256-GCM), and the key itself is stored only in wrapped form, encrypted under a master key that lives outside the database. The practical effect: a database dump, a storage leak, or even a leaked service key exposes only ciphertext.

What's encrypted: message content, your household picture, the summaries extracted from your files, and the file bytes themselves.

What stays readable (metadata): the information needed to route, join, and sign you in - identifiers, household and member records, timestamps, file names and types, and the name, email address, and any gender on an account.

Your private chats and your shared picture

This is core to how Walt works, so we want to be clear about it:

• Each member has a private chat with Walt. The messages in your private thread are yours: we don't show one member the message contents of another's private thread, and that is enforced at the database level (row-level security), not just hidden in the interface.
• To keep the household's picture honest, Walt reconciles each conversation into shared artifacts every member can see: the one shared household picture, a per-chat picture of what's known, decided, and still open in that chat, and any files you upload in a chat (together with the summary Walt extracts from them). These shared pictures and uploaded files are visible to every member, even when the underlying detail came from one member's private thread.
• Household-level facts - money facts like income, expenses, accounts, and debts; firm joint decisions; household-level goals; standing arrangements such as who handles what; household members you describe, like kids or pets; and dates that shape the household's year - move from a private chat into the shared picture automatically, as Walt reconciles each conversation. It isn't a manual step a member takes for each item.

The shared household picture can also include information about household members who don't use Walt - including children (for example names, birthdays, or school details) - when adult account holders share it in conversation. That information is encrypted at rest like everything else, is never used for advertising, and is deleted along with the household's data. Children are not users and can't create accounts.

How we use your information

• To provide Walt - replies, your reconciled household picture, and sync.
• To send transactional email - your sign-in link, invitations, and the occasional nudge when someone needs your input.
• To keep the service secure, reliable, and working as intended.
• To understand feature adoption, improve Walt, measure public-site performance, and diagnose errors.
• To respond to you when you contact us.

Analytics, cookies, and error reporting

Walt uses Google Analytics on public pages with geo-gated consent: EEA, UK, and Swiss visitors are asked to opt in first, while visitors in other regions receive notice and can opt out. We use PostHog for product usage analytics and service improvements, with autocapture and session replay disabled; this includes subscription plan-state changes (for example that a household upgraded or canceled, and whether the plan is monthly or yearly), some of which are recorded server-side from our payment processor's notifications rather than from your session. Payment details, amounts, and invoices never leave Stripe. We use Sentry to report and diagnose errors.

These tools are configured for a content-safe telemetry boundary: no message text, document contents, financial values, account names or numbers, filenames, email addresses, display names, or raw identifiers are intentionally sent in analytics or error payloads.

AI processing

Walt's replies and its continuously reconciled household picture are generated using third-party large-language-model providers. The relevant conversation content is decrypted on our servers and sent to the provider to produce a response, then re-encrypted at rest. When you upload a document (such as a PDF, image, or CSV) - a financial statement, a contractor's quote, an itinerary, a school or medical form - it's read the same way: sent to the model to extract the key facts (figures, dates, terms) for your picture.

We use two providers for different steps. Anthropic's Claude models generate Walt's chat replies and read the documents you upload. OpenAI's models power the reconciliation step - the part that builds your shared household picture from each conversation. Each receives the relevant decrypted content only to perform its step.

We don't use your private content to train models, and under both providers' standard API terms the content we send through their APIs isn't used to train their models either.

After a file is read, we keep an encrypted summary of what it contained, and we currently retain the original uploaded file (encrypted) as part of your household's data, so it stays available to you.

Service providers

We share information only with the providers we rely on to run Walt, and only as needed to deliver the service:

• Supabase - database, authentication, realtime sync, and file storage.
• Anthropic - the Claude models that power Walt's replies, name your chats, and read the documents you upload.
• OpenAI - the models that power the reconciliation step that builds your shared household picture (see AI processing above).
• Resend - delivery of transactional email (sign-in links, invitations, and nudges).
• Netlify - hosting and content delivery.
• Google Analytics - public-site analytics. Visitors in EEA, UK, and Swiss regions are asked to opt in before Google Analytics loads; visitors in other regions receive notice and can opt out.
• PostHog - product analytics and service-improvement metrics for signed-in usage, plus subscription plan-state changes (never payment details or amounts).
• Sentry - error reporting and operational debugging.

When Walt emails someone a nudge, the email carries only a short, non-sensitive teaser - never figures or the underlying private message. Walt writes these teasers to refer to household members who don't have accounts by role or topic rather than by name. One honest caveat: chat titles - chosen by you, or suggested by Walt's auto-naming - appear in notification email subjects and labels, and can include names you've used in a title. Walt is instructed to name chats after the topic, not a person, which reduces but doesn't eliminate that possibility.

Sharing and disclosure

We do not sell your personal information. We don't share your private content except with the service providers above to operate Walt, when you direct us to, or where we're required to by law.

Data retention and deletion

We keep your information for as long as your account is active or as needed to provide the service, including the original files you upload. You can delete your account yourself at any time from your profile settings (Edit profile, then Delete account). This permanently removes your account and the private data in any household where you're the only member - your messages, your household picture, and the original files you uploaded. In a household you share, we keep the shared household picture and documents so the other members still have them, and we anonymize your former membership. You can also email hello@dearwalt.com to request deletion; we action emailed requests within 30 days, subject to any legal obligations to retain certain records.

Your choices and rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information. You can correct your name and details, and delete your account, yourself from your profile settings. For access or a copy of your data, email hello@dearwalt.com and we'll help.

California residents (CCPA/CPRA). Depending on applicability, you may have the right to know what we collect, to delete it, to correct it, and to limit the use of sensitive personal information - which includes financial information. We don't sell your personal information or share it for cross-context behavioral advertising, and we won't discriminate against you for exercising your rights.

Children

Walt isn't directed to children under 18, and we don't knowingly collect personal information from them.

Changes to this policy

If we make material changes, we'll update the date above and, where appropriate, let you know in the product. Your continued use after an update means you accept the revised policy.

Contact

Questions about your privacy? Email hello@dearwalt.com. See also our Terms of Service.