Privacy Policy

Last updated: 4 October 2026

Your financial data is private. FlowFund does not sell, share, or monetize your personal data. We do not run ads. We do not share data with third parties for marketing. Your finances are your business.

1. Who We Are

FlowFund ("we", "us", "our") is a personal finance platform operated at flowfund.finance. For GDPR purposes, we act as the Data Controller for personal data you provide when using the Service.

Contact: privacy@flowfund.finance

2. What Data We Collect

• Account data: Email address and password (hashed with bcrypt, never stored in plain text)
• Financial data you enter: Transactions, goals, debts, income, bills, assets — entered by you and stored in your account
• Usage analytics: Which public pages are visited and a few product steps (signed up, finished onboarding, added a first transaction, started checkout, paid), so we can see where FlowFund loses people. Once you have an account these are linked to it by a random user ID — never your name or email, and never amounts, balances or anything you type. Pages inside your account send no page views at all. PostHog derives an approximate location (country and city) from your IP address and then discards the IP itself; it is never stored.
• Bank connection (optional): If you connect a bank, the read-only access token our provider TrueLayer issues, stored encrypted (AES-256-GCM), and the transactions it returns
• Profile preferences: Currency, language, notification settings
• Uploaded files: Documents stored in your Vault, videos uploaded to Reels

3. What We Never Collect

• We never see or store your bank login credentials — you sign in to your bank on TrueLayer's and your bank's own pages
• We never require KYC — no government ID, no address verification, no identity documents
• We never sell your data to advertisers, data brokers, or third parties
• We never use your financial data to train AI models outside of generating your personal insights
• We do not use advertising cookies or tracking pixels

4. Legal Basis for Processing (GDPR)

• Contract performance: We process your data to provide the service you signed up for
• Legitimate interest (Art. 6(1)(f) GDPR): Product analytics as described in section 2, to find and fix where people get stuck. You can object at any time (section 8).
• Consent: AI insights run on your financial data only when you use an AI feature (AI buttons and chat) and for the weekly summary email, which you can turn off in Settings → Email

5. How We Store Your Data

All data is stored on Supabase infrastructure with AES-256 encryption at rest. All data transmission uses TLS 1.3. Supabase operates EU-region servers (Frankfurt, Germany) ensuring GDPR-compliant data residency. Authentication uses JWT tokens. Passwords are never stored in plain text — only bcrypt hashes.

6. AI Features and Your Data

When you use the AI features (the AI Financial Advisor, chat and analysis), your financial summary (transaction totals, categories, goal progress) — and an image, if you send one — is sent to NVIDIA's hosted AI API (NVIDIA Corporation, USA), which runs open models such as Meta Llama. We do not send personally identifying information (name, email address) to the AI API.

7. Third-Party Services

• Supabase: Database and authentication — EU data storage (Frankfurt)
• Vercel: Hosting and CDN; the server functions that read your data run in Frankfurt, Germany
• Dodo Payments: Card payments for Pro, as Merchant of Record — they process your payment details, VAT and invoices; we never see card numbers
• NOWPayments: Crypto payments, only if you choose to pay in crypto
• TrueLayer: Optional bank sync in supported European countries — read-only access you authorise and can disconnect at any time
• NVIDIA: AI features (section 6)
• Resend: Sending account and notification emails
• PostHog (EU Cloud, Frankfurt): Product analytics (section 2). On the website it stores nothing on your device — no cookies, no local storage — and it is not loaded at all if your browser sends Global Privacy Control or Do Not Track
• Google: Optional "Continue with Google" sign-in (our web fonts are hosted on our own servers, so pages load nothing from Google)
• Android app only: Google Play (purchases), RevenueCat (subscription status) and Sentry (crash reports)

8. Your Rights Under GDPR

If you are in the EU or EEA, you have the following rights:

• Right of access: Request a copy of all data we hold about you
• Right to rectification: Correct inaccurate personal data
• Right to erasure: Request deletion of your account and all associated data
• Right to data portability: Export your data in CSV or JSON format
• Right to object: Object to product analytics at any time by emailing privacy@flowfund.finance; we then exclude your account. Browsers that send Global Privacy Control or Do Not Track are never measured by PostHog.

Export or delete your data from your Settings → Data & Privacy page; for everything else, email privacy@flowfund.finance. We respond within 30 days.

9. Data Retention

Account data is retained until you delete your account. Analytics events in our database are deleted together with your account. Events in PostHog carry only a random user ID, which no longer points to anyone once your account is gone; if you want them removed from PostHog as well, email us and we delete them there. When you delete your account, all personal data is permanently deleted within 30 days from all systems.

10. Cookies

Your login session is kept in your browser's local storage, which is strictly necessary to sign you in. We do not use advertising cookies, tracking pixels, or analytics cookies: PostHog runs without storing anything on your device. If you arrive through a campaign link (for example one with utm_source=reddit), we keep that source in local storage so a later signup can be attributed to it; it contains no personal data.

11. Changes to This Policy

We will notify registered users by email of any material changes to this policy. The "Last updated" date at the top of this page will always reflect the current version.

12. Contact

For privacy questions: privacy@flowfund.finance

For general support: support@flowfund.finance