Privacy Policy

Last updated: 3 November 2026

1. Controller

Radek Vomočil, Bučina 11, 566 01 Vysoké Mýto, Czech Republic, IČO 11982756, e-mail wealthdecoded.brand@gmail.com is the controller of personal data processed in WealthDecoded.

2. What we process and why

• Account data – e-mail address, password (stored only as a secure hash by our authentication provider), account creation date, your consents and their time. Purpose: providing your account. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• Content you enter – finances (transactions, budgets, savings), plans, goals and habits. Purpose: storing, synchronising and showing your dashboard. Legal basis: contract (Art. 6(1)(b)).
• Health and fitness information you choose to enter – food diary, workouts, body weight. These are special categories of data; we process them only on the basis of your explicit consent (Art. 9(2)(a)), given when you create your account. You can withdraw consent at any time by deleting this information or your account; withdrawal does not affect earlier processing.
• Purchase status – whether you bought full access, the Paddle transaction reference, amount and currency. Legal basis: contract and legal obligations.
• Technical data – IP address and request logs kept by our hosting and database providers for security and operation. Legal basis: legitimate interest in a secure service (Art. 6(1)(f)).

We do not sell your data, do not use it for advertising or profiling, and do not use tracking or analytics cookies.

3. Who processes data for us

• Supabase (database and sign-in) – data stored in the EU (Frankfurt, Germany), under a data processing agreement.
• Netlify, Inc. (delivery of the website files) – may process IP addresses in server logs.
• Paddle.com – our reseller and Merchant of Record. When you buy, Paddle processes your payment, billing and tax data as an independent controller under its own privacy notice. We receive only your purchase status and reference.

Some providers may process data outside the EU/EEA; in that case transfers are protected by the European Commission’s standard contractual clauses or an adequacy decision.

4. How long we keep data

Your account and content are kept until you delete your account (Settings → Delete account), which permanently removes them from our database. Records of purchases are kept by Paddle for the periods required by tax law. Server logs are kept for a short period by our providers.

5. Data in your browser

We do not store your dashboard data in your browser. Your sign-in session is kept in the browser’s session storage, or — only if you tick “Keep me signed in on this device” — in local storage. The Paddle checkout window may use its own cookies when you open it.

6. Security

Connections are encrypted (HTTPS). Every record is tied to your account and protected by row-level security in the database, so other users cannot read or change it. Passwords must have at least 12 characters.

7. Your rights

You have the right of access, rectification, erasure, restriction, data portability (Backup downloads all your data as a file), objection, and to withdraw consent. Contact us at wealthdecoded.brand@gmail.com. You may also lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz) or the authority in your country.

8. Children

WealthDecoded is not intended for anyone under 16.

9. Changes

We will publish any changes on this page and, for significant changes, notify you in the app or by e-mail.