Privacy Policy

Effective and last updated: 18 July 2026

This Privacy Policy explains how FinFlow (“FinFlow”, “we”, “us”) collects, uses, shares, stores and deletes information when you use the FinFlow mobile application, API and related support services (the “Service”).

1. Information we collect

• Account and identity information: name, email address, profile image, account identifier, language, main currency, and Google or Apple sign-in identifiers.
• Financial information you provide: accounts, balances, transactions, categories, budgets, goals, debts, assets, recurring payments, subscriptions, notes and other planning data.
• Imported information: transaction data you choose to import from a supported bank connection. FinFlow requests only the access needed for features you enable and does not ask you to send banking passwords through support.
• Images and extracted data: profile photos and receipt images you choose to upload, plus text and line items extracted from receipts.
• Location: precise location and a location label only when you grant permission and choose to attach location to a transaction.
• Purchase information: App Store product, subscription status, transaction identifiers and expiration information. Apple processes payment-card details; FinFlow does not receive or store full card details.
• Device and technical information: push token, platform, app version, notification preferences, request logs, IP address and diagnostics needed for security and reliability.
• Support communications: messages and diagnostic details you send to support.

2. How we use information

We process information to create and secure your account; synchronise data across devices; calculate balances, budgets, forecasts and financial indicators; provide exports, reminders and notifications; verify Premium access; answer support requests; prevent abuse; diagnose failures; and comply with legal obligations.

When you explicitly use an AI or receipt-scanning feature, the data needed for that request may be sent to OpenAI (API) to generate the requested result. Depending on the feature, that may include a short description of a purchase, selected category/amount summaries, a user question, or a receipt image you chose to upload. We do not send banking passwords or full payment-card numbers to OpenAI. Many FinFlow insights run on our own servers with deterministic rules and do not call OpenAI. AI output may be inaccurate and should be reviewed by you.

3. Permissions and your choices

Camera, photo library, microphone, speech recognition, location and notification access are optional and requested only for features that need them. You can deny or revoke permissions in iOS Settings. Some related features will then be unavailable.

4. How we share information

We do not sell personal information and do not use it to track you across other companies’ apps or websites. We share only what is necessary with service providers acting on our behalf, including infrastructure and database hosting (e.g. Render), Apple and Google sign-in, Apple In-App Purchase, push notification delivery, image processing, email/support services and OpenAI for optional AI/receipt features you invoke. We may also disclose information if required by law, to protect users or the Service, or as part of a business transfer subject to appropriate safeguards.

5. Legal bases and international processing

Where applicable law requires a legal basis, we rely on performance of our contract with you, your consent for optional permissions and features, our legitimate interests in securing and improving the Service, and compliance with legal obligations. Providers may process data in countries outside your residence; we use contractual and technical safeguards where required.

6. Retention

Account and financial data is retained while your account is active. Operational logs and security records are retained only as long as reasonably necessary for reliability, fraud prevention and legal compliance. App Store purchase records may be retained as required for accounting, dispute handling and entitlement verification. Backups are deleted on their normal rotation schedule.

7. Security

We use HTTPS/TLS in transit, password hashing, access controls and server-side authorization. Authentication tokens are stored using the iOS Keychain where available. No system is completely secure; promptly contact us if you believe your account has been compromised.

8. Your rights and account deletion

Depending on your location, you may request access, correction, export, deletion, restriction or objection, and may withdraw consent for optional processing. You can edit profile information, export data and permanently delete your FinFlow account under Settings → Delete account. Account deletion removes associated application data, subject to limited legal retention. It does not cancel an App Store subscription; subscriptions must be managed through Apple.

9. Children

FinFlow is not directed to children under 16 and we do not knowingly collect their personal information. A parent or guardian who believes a child provided information should contact us.

10. Changes to this policy

We may update this policy as the Service or legal requirements change. The current version and effective date are always published at this URL. Material changes may also be communicated in the app.

11. Contact

Privacy and data requests: uu36548@gmail.com
General support: uu36548@gmail.com