Privacy policy

Last updated: October 4, 2026

1. Data controller

Lukas Kamm (Flatwise)
Fronfestgasse 11
92224 Amberg
Email: info@flatwi.se

2. Previous waitlist

The waitlist is closed. If you signed up previously, we stored only your email address and the date and time you signed up.

3. Purpose and legal basis

Your previous consent applies only to information about the launch of Flatwise and, where applicable, early access. This website no longer accepts waitlist signups. The legal basis is your consent under Article 6(1)(a) GDPR.

4. Storage and recipients

Your data is processed by Vercel Inc. for hosting, Notion Labs, Inc. for the waitlist, and Resend, Inc. for contact management and the later delivery of the announced early-access information. For processing outside the EU, we rely on the EU Standard Contractual Clauses.

5. Retention and your rights

Your address is stored until you unsubscribe, request deletion, or at most until the official launch plus a reasonable follow-up period. You have rights of access, rectification, erasure, restriction, withdrawal of consent and complaint. Simply email info@flatwi.se to exercise these rights.

6. Hosting & analytics

This website uses Vercel Web Analytics for anonymized, cookie-free audience measurement. No personal profiles are created and no IP addresses are permanently stored.

7. Flatwise for iOS: account and household data

This policy also applies to the Flatwise app. When you use Sign in with Apple, the app processes your app-specific Apple user identifier and, where provided by Apple, your email address and name. If Apple provides your name when you first sign in, Flatwise uses it for your profile. Existing profile names take precedence; you can edit your name later. When registering by email, you enter your display name yourself. Your name is saved with your account and shown to your group members. A profile picture is optional. Flatwise does not receive your Apple password. The app uses the Apple user identifier to associate your account and a derived identifier for shared member profiles.

Flatwise processes the tasks you enter, including due dates, recurrence, assignments and completions, group memberships, people, expenses and settlements. This data supports personal and shared organization, fair task distribution and the calculation of shared expenses. The legal basis for necessary account functions is Article 6(1)(b) GDPR.

8. Appwrite Cloud, shared spaces and recipients

To sign in, the app sends the short-lived identity token issued by Apple to Appwrite Cloud over an encrypted connection. Appwrite verifies the sign-in and manages your Flatwise account and its session in the Frankfurt project region. The session is stored on your device only in the iOS Keychain. Your Apple password is not transmitted. During regular Apple sign-in, a server-side function exchanges the one-time Apple authorization code for a refresh token. This token is stored in an encrypted database column accessible only on the server, so authorization can be revoked during account deletion without another Apple sign-in. After successful revocation, the token is removed; the remaining technical deletion record is removed once account deletion is complete. The required developer key remains exclusively in the protected server configuration.

The app also stores application data locally on your device. Your profile, optional profile picture, groups, tasks, expenses, settlements, activities and personal backup are stored in the Appwrite project region Frankfurt. This lets you join groups, share content with members and reload your data when you sign in again.

In shared groups, your name, optional profile picture, shared tasks, assignments, expenses, settlements and activities are shared with connected members. The app retrieves up to 90 days of activity; older entries are scheduled for cleanup during successful synchronization. Group invitations are verified on the server using a non-public Appwrite record. The public link contains only a random invitation code. Anyone who knows the link can see the group name, type, current member count and, where available, the creator's display name on the invitation page, but no profile pictures, account data or content. Only share the link with the intended people.

Apple processes the data needed for Apple sign-in and App Store purchases under its own terms. Appwrite processes the described account and application data as a technical service provider. For details about Apple's privacy practices, see Apple's privacy policy; for information about Appwrite, see the Appwrite privacy policy.

When you sign in by email, Flatwise processes your email address and a short-lived sign-in link to create your account session.

If you report content, we store your description and the associated account, member and group identifiers to investigate abuse. These reports are accessible only to the operator. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in protecting users and operating the service safely. Reports are deleted after the investigation and a 90-day follow-up period, unless required legal retention obligations apply. Associated reports are removed when the account is deleted.

Personal calendar blocks, including titles, locations, notes, time zones, series exceptions and sharing choices, are stored in Appwrite. Only the owner can read the full records. Selected groups receive a server-generated view: with “Busy only”, titles, locations and notes are not transmitted to other members. Sharing changes take effect after server confirmation. Existing entries are not automatically shared with groups you join later. Information already received offline cannot be remotely erased immediately; a confirmed sync removes revoked shares from the app cache. Other members’ calendar data is not included in your personal Flatwise backup.

If you enable “Share usage data”, you help us understand how Flatwise is used and improve the app. This optional choice covers visits to app sections, saving entries, interactions with the Plus offer and setting up a Flatwise widget. Task, calendar, financial and widget content is not sent with these reports. Sharing is off by default and can be disabled at any time in Settings, stopping new usage reports.

Section, save and Plus events are sent to our own Appwrite backend without an account session, account ID or persistent device identifier. Daily statistics are kept for at most 90 days. Random identifiers used to prevent duplicate counts are deleted within 25 hours. These aggregated figures cannot be linked to an account and therefore cannot be deleted on an account-by-account basis.

Separately, with the same sharing choice, we associate with your account whether at least one Flatwise widget has been set up. Existing widgets are detected when you open the app. Only this status is stored, not the number, placement or content of widgets. Each account counts at most once as having set up a widget in the admin dashboard. The milestone is retained until account deletion, even if the widget is later removed or sharing is disabled. Existing account and group data also provides the per-account milestones “task created”, “group created” and “group joined”. Separately, account management and targeted technical notices use the last reported app version and explicit confirmations of notices.

9. Optional device features

Photos and the camera are used only when you choose a profile picture or scan a receipt. Receipt text recognition runs on your device; a receipt photo is not uploaded to a Flatwise server for this purpose. Expense data extracted from a receipt is stored like other shared expenses. Profile pictures may be synchronized with your profile and connected members.

Personal reminders are scheduled locally with your iOS permission. Notifications about other members’ changes are off by default and can be subscribed to per person and group. Appwrite processes an APNs device token, its account association and your subscriptions for this purpose. Appwrite Messaging and Apple Push Notification service deliver generic notices without event titles, locations or notes. Delivery is not guaranteed. Signing out removes the device registration when the server is reachable; switching accounts reassigns delivery ownership.

With Flatwise Plus and calendar permission, the app can display Apple calendars and export your own events and selected tasks. Supported writable Apple events from loaded time ranges are automatically imported into Appwrite as private linked Flatwise events, including their title, location and note. They are shared with groups only when you choose to do so. Read-only sources remain viewable. Changes to linked events are synchronized while the app is active; technical EventKit identifiers and the sync baseline remain stored on the device for the relevant account. Deleting an imported event in Flatwise leaves the Apple original intact. A synchronized destination calendar transmits exported data to its provider and, where applicable, its shared members. When disconnecting, the options shown in the app apply to previously exported entries. Signing out pauses the connection; connection settings can be restored when the same account signs in again. Account deletion removes the account’s connection settings.

Flatwise widgets use a local snapshot shared with the app for tasks, events and balances. Depending on the selected widget, this content may be visible on the Home or Lock Screen. Widgets require Flatwise Plus. Task actions use the signed-in account and existing permissions.

Flatwise Plus purchases are handled through Apple's App Store. The app checks purchase entitlements using StoreKit and does not receive credit card or bank details. The iOS app contains no advertising trackers or analytics SDKs.

10. Signing out, account deletion and retention

Signing out ends your Appwrite session. Account and application data stored in Appwrite Cloud remains available for a later sign-in; local app data also remains on your device. While you use your account, profile and group data is stored for the described functions. You can edit or delete individual tasks and expenses in the app.

Under Settings → Danger Zone → Delete account, you can start deletion after reviewing the displayed consequences and explicitly confirming. This deletes your Appwrite account, profile and personal backup, member profile in connected spaces, and local tasks, expenses, settlements, profile picture caches, memberships, sessions and account settings. The app leaves groups owned by others. Groups you created, including shared data and public invitation codes, are removed for all members.

Shared tasks, expenses, settlements and previous activities in spaces created by others remain available to their members and may still contain earlier names. For an additional deletion request, contact info@flatwi.se. Previously exported calendar events and independently saved copies held by other members are not recalled by account deletion. For Apple-linked accounts, Apple sign-in authorization is revoked on the server as part of account deletion. Your Apple Account itself and App Store purchases are not deleted.

Deletion requires a working connection to Appwrite. It remains pending if you are offline or a server error occurs; data already deleted is not restored. The app pauses cloud changes on this device and offers a retry. It signs you out only after cloud deletion and local cleanup are confirmed. A waitlist signup on this website is separate and can be deleted by email.

Signing out or switching accounts clears the account-bound calendar cache, unsynced calendar changes and local calendar reminders. Account deletion also removes your own calendar blocks, shared group views and change subscriptions. Leaving a group removes its share while keeping your personal block.

11. Your privacy rights in the app

Subject to the applicable legal requirements, you may request access, rectification, erasure, restriction of processing and data portability, withdraw consent for the future and object to processing based on legitimate interests. Please write to info@flatwi.se. You may complain to a data protection authority, particularly where you normally live, where you work or where the alleged infringement took place. For private providers in Bavaria, the competent authority is the Bavarian State Office for Data Protection Supervision . The app does not make automated decisions with legal or similarly significant effects.