This privacy notice for Kostas Filios ("Company," "we," "us," or "our"), located in Athens, Greece, describes how and why we might collect, store, use, and/or share ("process") your information when you use our services ("Services"), including:

• the Wishbox Finance mobile application
• the website at https://wishboxapp.com
• the Hermes API at https://wishboxapp.com/api
• any related sales, support, or account features that link to this notice

Questions or concerns? If you do not agree with our policies and practices, please do not use our Services. Contact us at wishboxappinfo@gmail.com.

SUMMARY OF KEY POINTS

Local-first by default. You can use Wishbox to track transactions, wishboxes, and budgets on your device without creating an account. That on-device data is not uploaded unless you choose a cloud feature described below.

What personal information do we process? It depends on how you use the Services. An optional account, Wishbox+, Collaboration, Cloud Sync, push notifications, and the AI Assistant each send specific data off the device. Learn more.

Do we process sensitive personal information? We do not collect Apple or GDPR special-category data such as health, race, or biometric identifiers. If you use Collaboration, Cloud Sync, or the AI Assistant, financial details you enter (amounts, categories, descriptions, wishbox titles) may leave the device. Optional voice input is processed for speech-to-text and is not used to create a voiceprint.

Do we receive information from third parties? Yes, when you choose those features: Apple or Google for sign-in and in-app purchases, Apple or Google for push delivery, OpenAI when you use Wishbox Assistant, and Apple iCloud or Google Drive when you turn on Cloud Sync.

How do we process your information? To provide, secure, and administer the Services you ask for (accounts, subscriptions, collaboration, assistant), and to comply with law. We do not sell personal information and we do not use it for advertising. Learn more.

Your rights. Depending on where you live, you may have rights to access, correct, or delete your information. Email wishboxappinfo@gmail.com. Learn more.

1. WHAT INFORMATION DO WE COLLECT?

In Short: We collect information you provide, information created when you use optional cloud features, and limited technical data needed to run the Services.

Information that stays on your device

Transactions, wishboxes, categories, budgets, backups, and CSV/Excel imports are stored in the app database on your device. We do not receive this data unless you sign in and use Collaboration, Wishbox Assistant, Cloud Sync, or another feature that you explicitly enable. The Apple Watch companion shows data stored on your paired phone. If you use Wishbox Assistant from the Watch, the same assistant terms and privacy practices apply.

Account information (optional)

If you create an account or sign in with Apple or Google, we may process:

• email address
• name
• password (stored hashed on our servers; never shared with OpenAI)
• a public user ID used for collaboration
• an optional profile photo, if you upload one

Apple Sign In and Google Sign In send us an identity token and the profile information you allow (typically email and name). We do not offer Facebook or Twitter login.

Voice input (optional)

If you tap the microphone in Wishbox Assistant, we record only while the mic is active. That audio is sent to our servers and then to OpenAI to convert it to text. We do not store the recording on Wishbox servers. The transcript is treated as a message you sent (including for chat history). Language is detected automatically, so you can speak Greek or another language even if your phone is set to English. We do not use voice recordings to identify you or to build a voiceprint.

Purchases

Wishbox+ is billed by Apple or Google. We do not collect payment card numbers. We store subscription receipts, product identifiers, transaction identifiers, and expiration needed to unlock Plus. Payment data is processed by Apple and Google under their notices: Apple Privacy Policy and Google Privacy Policy.

Device identifiers

We use a device identifier to bind Wishbox+ entitlements to your installation and may store a push token (FCM or APNs) if you enable notifications. These identifiers are not used for advertising and we do not collect IDFA or Google Advertising ID.

Push notifications

If you allow notifications, we store a device push token and your notification preferences so we can send collaboration or account updates. You can disable notifications in your device settings.

Information we do not collect

• precise or coarse location
• contacts, calendar, clipboard, or camera (beyond an optional photo-library avatar)
• advertising identifiers, analytics SDKs, or crash-reporting SDKs
• offer walls or in-app advertising

2. COLLABORATION

If you share a wishbox with others, we store on our servers the shared item metadata (titles, icons, currency, balances as needed to sync) and the transactions belonging to that shared wishbox, including amounts, dates, categories, and descriptions. Members of that collaboration can see the shared data. Unrelated wishboxes and accounts stay on your device.

3. CLOUD SYNC

Cloud Sync is optional and requires Wishbox+. If you connect iCloud or Google Drive, the app uploads a copy of the database on your device (transactions, wishboxes, categories, settings, and related app data) to that service under your account. Wishbox does not host that file on our servers. The copy is stored and processed by the service you choose under their terms and privacy notices:

• Apple Privacy Policy (iCloud)
• Google Privacy Policy (Google Drive)

The upload is a zip of the app database. Wishbox does not encrypt that file with a separate password or key. Access is controlled by your iCloud or Google Drive account and that provider's security. Anyone with access to that account can read the copy.

When more than one device syncs, the newest copy wins. Restoring a cloud copy replaces the data on that device.

You can disconnect Cloud Sync in the app. Disconnecting stops new uploads from this device; it does not by itself delete the file already stored in your iCloud or Google Drive account. To remove that copy, delete the Wishbox Sync files in that account yourself. We cannot delete them for you. Cloud Sync is separate from Collaboration.

4. AI ASSISTANT AND OPENAI

Wishbox Assistant is optional. It requires a Wishbox+ subscription and your explicit agreement in the app. You can revoke that agreement in Settings → AI Assistant. Turning consent off stops new data from being sent to OpenAI. It does not by itself delete stored chat history or collaboration data you already published; you can delete conversations in the assistant history, or email us to request deletion.

When you use the assistant, we send to OpenAI (via our API) the data needed to answer you, which may include:

• your messages and the assistant replies
• voice recordings you send with the microphone, used only to transcribe them into text (we do not keep the audio file)
• filters such as wishbox or source titles and date ranges
• aggregated statistics you allow for a source
• published collaboration transactions when you choose to share a source (recent amounts, dates, descriptions, and categories)
• import samples (file headers and a small number of sample rows) if you use import help

Voice is recorded only while the microphone is active. We send the audio to OpenAI for speech-to-text with automatic language detection, then handle the transcript like a typed message. We do not store voice recordings on Wishbox servers, and we do not use them to create a voiceprint.

We store a consent receipt on our servers (account, terms version, platform, app version, IP address, user agent, and time). We store assistant chat history on our servers so you can reopen conversations, up to the limit you set in the app (default 50, maximum 100). Older conversations beyond that limit are removed automatically.

OpenAI processes this data to transcribe optional voice input and generate replies. We do not use assistant data for advertising. We configure our OpenAI chat requests so they are not stored in OpenAI's dashboard. Voice is sent through OpenAI's audio transcription API; we do not keep the recording. OpenAI's handling of API data, including whether it is used to train models, is described in OpenAI's Privacy Policy and OpenAI's enterprise privacy information. We do not control OpenAI's policies and they may change.

Assistant output can be wrong. It is not financial, tax, or investment advice. Do not paste other people's private data into the assistant unless you have the right to do so. Do not record other people with the microphone unless you have the right to do so.

5. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process information to provide the features you use, authenticate you, validate subscriptions, sync shared wishboxes, run Cloud Sync to your own storage, run the assistant you opted into, send the notifications you enabled, secure the Services, and comply with law.

• Account and authentication. Create and maintain your optional account, including Apple or Google sign-in.
• App functionality. Collaboration sync, Cloud Sync to a service you connect, Wishbox+ entitlement checks, currency rates, avatars, and support.
• AI Assistant. Only after consent, to generate replies through OpenAI, including transcribing optional voice input.
• Security and operations. We keep limited API logs (method, route, status, and technical metadata). Assistant message contents, financial filters, tool payloads, and voice audio are redacted from those logs.
• Legal. To comply with law, enforce our terms, or respond to lawful requests.

We do not sell personal information and we do not use it for third-party or developer advertising.

6. WHAT LEGAL BASES DO WE RELY ON?

In Short: We process personal information when we have a valid reason under applicable law.

If you are in the EU or UK: we may rely on (1) performance of a contract (providing the app features you request, including Cloud Sync when you connect a service), (2) consent (AI Assistant and optional notifications), (3) legitimate interests (securing the API, preventing abuse), and (4) legal obligations. Connecting Cloud Sync is a feature you turn on; we do not store a separate Cloud Sync consent receipt.

If you are in Canada: we may process information with your express or implied consent, or as otherwise permitted by law. You may withdraw consent by contacting us or, for the assistant, in Settings → AI Assistant. You can disconnect Cloud Sync in the app at any time.

7. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We share information with the processors needed to run a feature you use, and as required by law.

• Apple. Sign In, App Store billing, push (APNs), and iCloud if you turn on Cloud Sync with iCloud.
• Google. Sign In, Google Play billing, Firebase Cloud Messaging for push, and Google Drive if you turn on Cloud Sync with Google Drive. We do not use Firebase Analytics.
• OpenAI. Wishbox Assistant messages, optional voice recordings for transcription, and the finance context described above, only after you agree.
• Collaboration members. Shared wishbox data you publish, and your name, email, and avatar as shown in the member list.
• Business transfers. If we merge, sell assets, or similar, information may transfer subject to this notice.

We do not run offer walls, ads networks, or social logins other than Apple and Google.

8. HOW DO WE HANDLE SOCIAL LOGINS?

If you sign in with Apple or Google, we receive the profile information those providers share with us (typically name and email) and use it only to create or link your Wishbox account. Review Apple's and Google's privacy notices for their practices. We do not control those providers.

9. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep information as long as needed for the purposes in this notice, unless a longer period is required by law.

• Account data lasts while your account is open.
• Assistant history is kept up to the number of conversations you choose in the app, then older entries are deleted. Voice recordings are not stored; only the transcript may remain in chat history.
• Consent receipts are kept until you revoke consent or we delete the account.
• Collaboration data lasts while the shared wishbox exists or until it is removed.
• Cloud Sync files remain in your iCloud or Google Drive account until you delete them there. We do not host those files and cannot delete them for you.

When we no longer need personal information, we delete or anonymize it, or isolate it in backups until deletion is possible.

10. HOW DO WE KEEP YOUR INFORMATION SAFE?

We use HTTPS for data in transit to our servers and access controls on those servers. Cloud Sync files in your iCloud or Google Drive account are protected by that provider and your account, not by a Wishbox encryption key. No transmission or storage system is 100% secure. Use the Services on a device you control and keep your account credentials private.

11. INTERNATIONAL TRANSFERS

We are based in Greece. Our servers and processors (including Apple, Google, and OpenAI) may process information in the United States or other countries. Those countries may have different data-protection laws than your own. Google Drive Cloud Sync transfers go from your device to your Google account.

12. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: In some regions, including the EEA, UK, and Canada, you can access, correct, or delete personal information we hold, or withdraw consent.

Email wishboxappinfo@gmail.com to request access, correction, or deletion of your account, collaboration data, or assistant history. We will respond in line with applicable law. You can also:

• update profile information in the app
• revoke AI Assistant consent in Settings → AI Assistant
• delete individual assistant conversations in the app
• disconnect Cloud Sync in the app
• delete Wishbox Sync files in your iCloud or Google Drive account
• disable notifications in device settings

If you are in the EEA or UK and believe we process your information unlawfully, you may complain to your local supervisory authority: EU authorities. Switzerland: FDPIC.

Withdrawing consent: Withdrawal does not affect processing that already happened. Revoking AI consent does not automatically erase prior chat history or published collaboration data.

Upon a request to terminate your account, we will delete or deactivate the account and information from our active databases, except where we must retain limited records for fraud prevention, legal claims, or legal requirements.

13. CONTROLS FOR DO-NOT-TRACK FEATURES

We do not currently respond to DNT browser signals. We do not use third-party advertising or analytics SDKs in the app or on this website.

14. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Yes. California residents have rights to know, delete, and not be discriminated against for exercising privacy rights.

California Civil Code Section 1798.83 (Shine the Light) allows an annual request about personal information disclosed to third parties for direct marketing. We do not disclose personal information for direct marketing.

What categories of personal information do we collect?

Kostas Filios has not sold personal information and will not sell personal information of app users, website visitors, or other consumers. Service providers (Apple, Google, OpenAI) process information on our behalf for the features above.

To exercise CCPA rights, email wishboxappinfo@gmail.com. We will verify your identity before fulfilling a request. We will not discriminate against you for exercising your rights.

15. DO WE MAKE UPDATES TO THIS NOTICE?

Yes. The updated version is shown by the "Last updated" date and takes effect when posted. Material changes to the AI Assistant are also tied to a consent version in the app; you may be asked to agree again before using the assistant.

16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

Kostas Filios, Athens, Greece. Email: wishboxappinfo@gmail.com.

Related documents: Terms of Service and End User License Agreement.

17. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Email wishboxappinfo@gmail.com to request access, correction, or deletion of your account and related server data (including assistant history and collaboration data we host). You can also manage assistant consent and conversation history in the app. Cloud Sync copies live in your own cloud account; delete those files there, or disconnect Cloud Sync in the app to stop new uploads.