Draft, pending legal review

Privacy policy

This draft describes the information this website actually collects. It is not a promise that a lawyer has signed off.

Who operates WalletMe

WalletMe operates this service. WalletMe is not a corporation, and this policy does not name a state of incorporation. The governing law for the terms is California.

Information the public site collects

If you ask for a company account, the signup form sends:

• Your name
• Email address
• Password
• Company name
• The group name you expect to use
• The version of the terms you agreed to

Sign-in sends your email and password. Forgot password sends your email. The site does not ask for a phone number, a postal address from you, or a payment card.

The signup form asks you to agree to the Terms and this policy before the request is sent. That checkbox starts unchecked. The form does not ask for marketing email.

Information a signed-in company enters

After an admin approves the company, people at that company can enter:

• Facility names
• Group names, and on the platform screen a group slug
• Staff email, password, role, and which facilities that person can open
• Customer name, email, group, and an amount of money on the card
• An optional password so that customer can sign in
• Card template name, logo text, colors, background, and the fields placed on the card, including links
• Email template name, subject, and body, and the recipient, subject, and body of a message the company queues
• Notes and status on a signup request
• API keys and webhook secrets, which are shown once and then kept hidden

The company enters customer information so it can issue a card and send email about that card. WalletMe also stores the card id, content version, design version, and the last time the wallet pass was used, when the API returns those values. When a pass is added to Apple Wallet, we store that device’s device library identifier and push token. We use them only to send pass updates to that device.

What we do not collect here

• No analytics account, advertising id, or marketing pixel
• No payment card number. Nothing is charged, and Stripe is not used
• No values in localStorage or sessionStorage
• No marketing preference, because that control is off

This website does not add its own analytics. Railway, which hosts the site, and the company API may keep ordinary connection logs such as the time of a request. We do not use those logs to advertise to you.

Why we use it

We use account information to create the company, sign you in, and reset a password when you ask. We use customer, facility, card, and email information to run the card the company set up and to send the messages the company queues. We use the sign-in cookie to know who is signed in. We use the story cookie only to remember that you chose Hide story.

Cookies

The cookie list is on the cookie policy. Both cookies are first-party. The sign-in cookie is strictly necessary for a signed-in session. The story cookie is written only after you click Hide story. The site does not set any other cookie, and it does not load a non-essential script.

Sale and sharing

We do not sell personal information. We do not share it for cross-context behavioral advertising. Those words are used in the sense of the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA).

California rights

If you are a California resident, you can ask us to:

• Know the categories and the specific pieces of personal information we collected about you
• Correct inaccurate personal information
• Delete personal information

Email hello at walletmeinc dot com with the request. We will not charge you a different price, or refuse the service, because you exercised these rights. We do not offer a financial incentive for personal information. We do not sell or share personal information, so there is no separate “do not sell or share” toggle to turn off a sale that is not happening.

Do Not Track

California’s Online Privacy Protection Act asks us to say how we respond to a browser Do Not Track signal. This site does not track you across other websites. A Do Not Track signal does not change what we store, because there is no tracking script to turn off. We still set the sign-in cookie after you log in, and the story cookie after you click Hide story. We don't sell or share personal data, so a Global Privacy Control signal has nothing to change. The site doesn't currently read it.

European Union and the United Kingdom

WalletMe does not claim to comply with the GDPR or the UK GDPR. The forms ask only for the fields the product uses. If you are in the European Union or the United Kingdom, email hello at walletmeinc dot com to ask for a copy of your information or for deletion. We do not set non-essential cookies. If we add any later, they will not run until you consent.

Who else handles the information

• Railway hosts this website.
• Railway hosts the Postgres database that stores the account and customer records.
• Railway hosts Redis.
• When file storage is turned on, files are kept in S3-compatible object storage. The service does not name a separate vendor for that store.
• The company API is WalletMe’s own service. The browser calls it for sign-in and for the dashboard. It stores the account and customer records.
• Apple Wallet receives a pass only when someone adds that pass on their device. The site does not embed an Apple script. The add page links to a pass file on the API.
• Zoho sends transactional email over SMTP. The site does not load an email vendor in the browser. Local development can use Mailpit. Marketing email is not sent.
• Stripe is not a subprocessor. The product does not take payment.

How long we keep it

• The sign-in cookie expires after 8 hours or when you sign out. The server also rejects a session that is no longer valid.
• The story cookie is set to expire after one year, or sooner if you clear it.
• Company, staff, customer, card, and email records stay while that company account is open. Email hello at walletmeinc dot com to ask for deletion or correction. We may keep a record we need to secure the service or to meet a legal duty.

Children

WalletMe is a tool for a business and its staff. It is not directed at children. If you believe we have a child’s information, email us and ask us to delete it.

Changes

Last updated 22 October 2026. This page is a draft and is not in effect as a final policy until it has been reviewed.