Privacy policy

In short

• Your cards are stored only on your iPhone, encrypted.
• There are no accounts, no ads, no analytics and no tracking.
• A card is sent to our server only to create its Apple Wallet pass. The server does not store or log it.
• We never sell or share your data for advertising.

Who is responsible

Wallet Wingman is made by Hussein Khalil, Austria. Contact: walletwingman.support@gmail.com.

Data on your iPhone

The cards you create (for example Wi-Fi names and passwords, addresses, contacts, pet details and photos you choose) are stored in the app on your iPhone, encrypted with AES-256. The key is kept in the iPhone Keychain. Like other app data, they are included in your own iPhone or iCloud backup. We cannot see them.

You can delete a card in My cards at any time. Deleting the app deletes all its cards. Cards you added to Apple Wallet stay in Wallet until you remove them there.

Creating a Wallet pass

Apple requires every Wallet pass to be signed by its issuer. When you tap Add to Apple Wallet, the app sends the card's content (its fields, colour and, if the card has one, its picture) to our server, which signs the pass and sends it straight back. The server keeps no copy and writes no logs of card content.

With each request the app also sends a random ID created on your iPhone, used only to limit how many requests one device can make. Our server runs on Cloudflare, which processes technical connection data such as your IP address to deliver and protect the service.

Legal basis: providing the service you asked for (GDPR Art. 6(1)(b)) and protecting it against abuse (Art. 6(1)(f)).

Place search

When you search for a place for a travel card, the text you type is sent through our server to Google Places, which returns matching places and their addresses. Google receives the search text, not your cards. Google's privacy policy applies to its part: policies.google.com/privacy.

Purchases

Purchases are handled by Apple. We never see your payment details. To unlock paid cards, our server checks with Apple that a purchase is valid.

Sharing a card

If you share a card, the app creates an encrypted link or file that you send yourself. Anyone who has it can open the card until it expires after 30 days. The card is not stored on our server.

Permissions

• Photos: only the picture you pick for a card.
• Notifications: optional reminders, such as an upcoming vaccination, scheduled on your iPhone.
• Face ID: optional app lock. iOS checks your face; the app never receives biometric data.

Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, and to data portability. Because we do not store your cards, almost everything is in your hands in the app. For any request, write to walletwingman.support@gmail.com. You can also complain to the Austrian Data Protection Authority (dsb.gv.at).

Children

Wallet Wingman is not directed at children under 13 and does not knowingly collect data from them.

Changes

If this policy changes, the new version is published on this page with a new date.