Privacy policy
Last updated 2026-09-03
This policy covers two things that are worth keeping apart: waybook.io, the website you are reading, and Waybook, the financial planning application itself. They collect very different amounts of information, and the website collects far less than you might assume.
The short version. The website holds an email address if you give us one, and sets no cookies. The application holds the financial information you enter, encrypts it on your device before it is stored, and does not connect to your bank accounts today. We do not sell personal information, we do not share it for advertising, and we do not use it to train anything.
Who is responsible
Waybook is operated by Alpha Peak Technologies LLC, a Utah limited liability company ("Waybook", "we", "us"). We are the controller of the personal information described in this policy.
Waybook is a trade name of Alpha Peak Technologies LLC. If you look for "Waybook" in a business registry you will not find one — the company is Alpha Peak Technologies LLC.
Postal address: 4015 W 5800 N, Mountain Green, UT 84050
Privacy contact: privacy@waybook.io
What the website collects
If you join the early-access list, we collect and store:
| What | Why | Kept for |
|---|---|---|
| Your email address | To send the confirmation message and the updates you asked for, and to invite you to test Waybook if you said you were interested. | Until you unsubscribe, then a minimal suppression record — see below. |
| Whether you ticked the marketing box, and when | Evidence that you agreed, and to what version of the wording. It is the record that lets us prove we did not add you without asking. | As long as the subscription, and afterwards as part of the suppression record. |
| Whether you ticked the testing box | So that an invitation to test an unfinished build goes only to people who asked for one. | As long as the subscription. |
| Which page you signed up from | To understand which parts of the site are doing their job. | As long as the subscription. |
| Confirmation status and dates | To operate double opt-in and to delete signups that are never confirmed. | As long as the subscription. |
That is the whole list. We do not ask for your name, and there is no field for one. We never ask for financial information on this website, and no page here has anywhere to put it. If you receive an email that appears to be from Waybook and asks for bank details, it is not from us — please forward it to security@waybook.io.
Cookies, and the fact that there are none
waybook.io sets no cookies. It writes nothing to local storage or session storage, and it loads no third-party scripts, fonts, pixels or embeds. There is no consent banner because there is nothing to consent to.
The site does count how often pages are viewed and how often the signup form is started and completed. Those counts are aggregate: an event name and a page path, added to a daily total. No identifier is created, nothing is stored on your device, and the counts cannot be linked to you or to an email address. The cookie policy describes this in full.
Information handled automatically when you visit
Like every website, waybook.io is reached over a network, and serving a page necessarily involves your IP address, the browser you are using and the page you asked for. Our infrastructure provider processes these to deliver the page and to protect the site from attack and abuse.
We do not build profiles from it, do not use it for advertising, and do not store raw IP addresses in our own database. Signup rate limiting works from a short-lived, one-way hash rather than from the address itself, held for about 24 hours and then discarded.
What the application collects
Waybook is a workbook. Nearly everything in it is there because you typed it or imported it, and it stays in categories you can see:
- Plan inputs — pay, bonus, tax elections, benefit choices, housing costs, debts, the ages of the people in your household, and the life events you have dated.
- Records — accounts and their balances, transactions, investment positions, recurring charges and the categories you sort them into.
- Files you import — the CSV exports you choose to bring in, and the column mapping you used.
- Preferences — theme, page arrangement and similar settings.
- Account and household — your email address, a display name if you set one, which household you belong to, your role in it, and any invitation you sent or accepted. Never a password: sign-in is handled by Google and we never receive one.
What it does not collect today. There is no bank connection yet, so there are no credentials, no access tokens and no automatically retrieved account data. Connections through a regulated provider are planned; this policy will be updated to describe exactly what is collected and who receives it before that ships. There is no analytics, error-reporting, advertising or profiling code in the application. Apart from signing you in and saving your encrypted workbook, it makes no third-party calls at all. The tax and benefit reference figures it uses are built into the software with their published sources, not fetched from anywhere.
How the application stores it
Hosted. Your workbook is encrypted on your own device before it leaves it, and what we store is ciphertext. We hold no key and no passphrase and cannot read your financial information. This is a technical property rather than a promise about our intentions, and it means we cannot recover your data for you either. The security page describes the mechanism.
Self-hosted. If you run Waybook on your own machine, your workbook is a file on your own disk and we never receive it. It is not encrypted at rest in that shape.
Sign-in is separate from your data. Google’s identity service holds your email address and password and tells us, in a signed token, that you are who you say you are. It never receives your workbook, your balances or anything else you put into Waybook. Your account credentials and your financial information are held by different companies, and neither of us has both.
Who else is involved
We use as few outside services as we can, and none of them receives your financial information. The complete list:
| Service | What it does | What it sees |
|---|---|---|
| Cloudflare | Hosts and serves both waybook.io and the application, and stores the encrypted workbook. | Website requests. For the application, ciphertext it cannot read. |
| Google (Firebase Authentication) | Runs sign-up, sign-in, password reset and email verification for the application. | Your email address, your password (which we never see), and sign-in metadata such as times and devices. No financial data of any kind. |
| Email delivery provider | Sends the confirmation, welcome and update messages you asked for. | Your email address and the content of those messages. Nothing else. |
The current provider for each is named, with what it receives, in our published subprocessor list. We will update that list and this policy before adding a subprocessor that handles personal information.
We may also disclose information if we are legally required to, or to protect the rights and safety of people using Waybook. If Waybook is ever acquired, personal information may transfer as part of that; we would say so here first.
What we do not do
- We do not sell personal information, and we have never done so.
- We do not share it for cross-context behavioural advertising or targeted advertising of any kind.
- We do not use your information to train machine-learning models.
- We do not profile you or make automated decisions with legal or similarly significant effects.
These are statements about how the system is actually built, and the reason they can be stated flatly is that there is no advertising technology in it to switch off.
How long we keep things
| What | How long |
|---|---|
| A confirmed subscription | Until you unsubscribe or ask us to delete it. |
| An unconfirmed signup | Deleted after 30 days. If you never click the confirmation link, the record goes. |
| A confirmation link | Valid for 7 days, then it stops working. |
| A suppression record after you unsubscribe | Kept indefinitely — see below. |
| Rate-limiting counters | About 24 hours. |
| Aggregate page and form counts | Indefinitely. They contain no personal information. |
| Your hosted workbook | Until you delete it or close your account. |
Why a suppression record outlives the subscription. When you unsubscribe we keep a one-way hash of your address, and the fact and date of the unsubscribe, and nothing else. It exists so that a later import or a re-signup cannot quietly put you back on the list. Deleting it entirely would mean forgetting that you asked us to stop, which is the opposite of honouring the request. If you would rather we deleted even that, ask and we will, and we will explain the consequence.
Your choices and rights
You can ask us to give you a copy of your information, correct it, delete it, or stop emailing you — and we will do those things regardless of where you live and regardless of whether a particular law obliges us to. It is simpler than tracking who qualifies for what.
Depending on where you live you may also have specific rights, including access, correction, deletion, portability, opting out of sale or targeted advertising, limiting the use of sensitive information, and appealing a refusal. Because we do not sell or share personal information for advertising, the opt-out rights have nothing to act on — but you may still exercise them and we will confirm that in writing.
How to make a request, what we will ask you for, and how long we take is set out on privacy choices. We will not discriminate against you for exercising any of it.
There is no mailing list. This website does not collect an email address, there is nothing to subscribe to, and Waybook sends no marketing email to anybody.
An early-access form was on this site briefly in September 2026. It was removed before the product launched and before any message was ever sent from it. If you used it, write to privacy@waybook.io and the address will be deleted.
If a mailing list is ever added, it will be double opt-in, every message will carry a working unsubscribe link, and this section will say so before a single message goes out.
Children
Waybook is meant for adults managing a household’s money and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, write to privacy@waybook.io and we will delete it.
Where information is processed
Waybook is operated from the United States and information is processed there. Our infrastructure provider operates a global network, so a request may be served from a location near you.
Waybook is not currently offered to people in the European Economic Area or the United Kingdom, and the early-access list is not marketed there. If that changes, this policy will be updated to describe the transfer safeguards and the additional rights that apply before any such offer is made.
Security
The security page describes how Waybook is protected, including what is not yet in place. In summary: the hosted workbook is encrypted before it reaches us, sign-in is handled by Google so we hold no password, there are no bank connections yet, and Waybook has not been independently audited or certified.
No system is perfectly secure. If we ever become aware of a breach affecting your information, we will tell you and the relevant authorities as required, and we will say what happened rather than the least we can get away with.
Changes to this policy
If we change this policy we will update the date at the top. If the change is material — a new category of information, a new purpose, a new subprocessor handling personal information — we will say so on the website and, if you are on the list, by email, before it takes effect.
Contact
Privacy: privacy@waybook.io
Security: security@waybook.io
Anything else: hello@waybook.io
Postal: Alpha Peak Technologies LLC, 4015 W 5800 N, Mountain Green, UT 84050