Privacy Policy

Last updated: September 8, 2026

FinFlow ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application FinFlow (the "App").

Information We Collect

Personal Information

• Account Information: Email address, name, user ID, optional age range, and optional phone number
• Financial Data: Expenses, income sources, financial goals, credit card information
• Usage Data: How you interact with the app, features used, preferences

Automatically Collected Information

• Device Information: Device type, operating system, unique device identifiers
• App Usage: Service activity and feature usage
• Location Data: We do not request precise device location. When you choose to connect a bank, Plaid may infer approximate location from network and device information for service operation and security.

How We Use Your Information

Primary Uses

• Provide Services: Process your financial data, generate insights, track goals
• Personalization: Customize AI recommendations and financial advice
• Communication: Send notifications about goals, expenses, and insights
• Support: Respond to your questions and provide customer service

Analytics and Improvement

• App Performance: Monitor app stability and performance
• Feature Development: Understand usage patterns to improve features
• User Experience: Optimize the app interface and functionality

Information Sharing

Limited Sharing

We may share your information only in these circumstances:

• Service Providers: With providers that help us operate authentication, cloud storage, notifications, subscriptions, financial insights, and optional communications. Optional bank connection uses Plaid with your authorization.
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

Data Protection

Service providers process information for their services. Bank connections also follow the permissions you approve and Plaid’s privacy policy.

Data Security

Security Measures

• Encryption: All data is encrypted in transit and at rest
• Access Controls: Strict access controls limit who can access your data
• Regular Audits: We regularly review and update our security practices
• Secure Infrastructure: We use industry-standard cloud infrastructure (Firebase)

Your Responsibility

• Keep your login credentials secure
• Don't share your account with others
• Log out when using shared devices

Data Retention

How Long We Keep Data

• Active Accounts: We retain your data as long as your account is active
• Deletion: You can request account deletion at any time in Account settings

Data Deletion

• Account Deletion: You can delete your account in the app settings
• Data Export: You can export your data before deletion
• Processing: Sign-in is disabled when your request is accepted. Financial records and your account are removed in the background, and linked service cleanup is requested. Cleanup may take additional time if a service is unavailable.
• Deletion Record: We retain a minimal account identifier and cleanup status to prevent deleted data from being restored by delayed updates.
• Billing: Payment providers maintain their own billing records. App Store subscriptions must be cancelled through Apple

Your Rights and Choices

Access and Control

• View Your Data: Access all your personal information in the app
• Update Information: Modify your account information at any time
• Delete Account: Remove your account and all associated data
• Export Data: Download a copy of your data

Communication Preferences

• Notifications: Control which notifications you receive
• Marketing: Opt out of marketing communications
• Updates: Choose how you receive app updates

Text Message Reminders (SMS)

Opt-In and Consent

• SMS bill reminders are optional and only sent after explicit opt-in.
• We store your consent status, consent timestamp, and reminder phone number.
• Message and data rates may apply based on your wireless carrier plan.

What We Send

• We send event-triggered bill reminders only (for example, reminders sent before a due date).
• We do not use SMS reminders for marketing campaigns.
• Reminder frequency is limited and may include monthly caps to reduce message volume.

Opt-Out and Data Handling

• You can opt out at any time in app settings or by replying STOP to a reminder.
• When you opt out, we disable SMS reminders and record the opt-out event.
• We retain only the minimum SMS-related data needed for consent, delivery, and compliance.

Children's Privacy

Age Requirements

• Minimum Age: Users must be 13 years or older
• Parental Consent: Users under 18 need parental consent

Protection Measures

• We do not knowingly collect data from children under 13

Third-Party Services

Services We Use

• Firebase: Backend services, authentication, database
• RevenueCat, Apple, and Google Play: Subscription purchases, entitlement verification, and purchase analytics. Web subscriptions use Stripe.
• Plaid: Optional bank connections, account balances, transactions, and connection security. See Plaid’s privacy policy.
• OpenAI: Financial information needed to generate requested insights.
• Twilio and Klaviyo: Optional SMS and email communications.
• Notifications: Firebase Cloud Messaging uses installation identifiers to deliver enabled notifications. Optional app analytics uses Google Analytics for Firebase only after you allow app analytics on that device. It measures general app usage and signup/setup events, excludes advertising identifiers and financial contents, and can be turned off in Privacy choices. Website analytics and advertising tools depend on a separate browser consent choice.

Third-Party Policies

• Each service has its own privacy policy
• We only use services that meet our privacy standards
• Links to third-party policies are available upon request

Changes to This Policy

Policy Updates

• Notification: We will notify you of significant changes
• Review: Please review this policy periodically
• Acceptance: Continued use means acceptance of changes

Contact for Changes

• Email us with questions about policy changes
• We're happy to explain any modifications

Contact Information

Legal Compliance

GDPR (European Users)

• Right to access, rectification, and erasure
• Right to data portability
• Right to restrict processing
• Right to object to processing
• Right to withdraw consent

CCPA (California Residents)

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt out of data sales
• Right to non-discrimination

Data Breach Procedures

Our Response

• Detection: We monitor for security incidents
• Notification: We will notify you within 72 hours of discovery
• Investigation: Thorough investigation of any incidents
• Remediation: Immediate steps to prevent future breaches

Your Actions

• Monitor your accounts for suspicious activity
• Report any concerns immediately
• Change passwords if recommended

Compliance

Standards We Follow

• GDPR: European data protection regulations
• CCPA: California privacy laws
• COPPA: Children's online privacy protection
• Industry Standards: Best practices for financial apps

Regular Audits

• Annual privacy audits
• Security assessments
• Compliance reviews