The short version: We collect only what we need to run FlowCheck. We never sell your financial data. Your bank credentials never touch our servers. You can delete everything at any time.
1. Overview
FlowCheck ("we," "our," or "us") is a personal finance application ("App") operated by FlowCheck. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our mobile application and related services (collectively, the "Service").
By using FlowCheck, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our Service.
2.1 Account Information
When you create a FlowCheck account, we collect:
- Email address (for account authentication and notifications)
- Display name and optional phone number (set by you in Profile settings)
- Authentication identifiers (Firebase Auth UID)
- Device token for push notifications (optional, if you grant permission)
- Profile picture or avatar initial (generated from your name; custom photos stored only if you provide them)
You can update your name, email address, and phone number at any time through Settings → Edit Profile. Email address changes require recent re-authentication for your security and trigger a Firebase email verification to the new address.
2.2 Financial Data (via Plaid)
If you choose to connect a bank account, we receive the following data from Plaid on your behalf:
- Account balances (checking, savings, credit, investment)
- Transaction history (merchant name, amount, date, category)
- Account metadata (institution name, account type, last 4 digits of account number)
We never receive or store your bank username, password, or full account numbers. These credentials are handled exclusively by Plaid's secure infrastructure.
2.3 Manually Entered Data
You may optionally enter:
- Manual account balances (savings accounts, debts not connected via Plaid)
- Financial goals (name, target amount, target date)
- Bill reminders (name, amount, due date)
- Monthly budget limits by category
- A manually entered credit score (from your bank or credit monitoring service)
2.4 Device & Usage Data
We may automatically collect:
- Device type, operating system version, and app version
- Crash reports and error logs (for debugging purposes)
- App feature usage patterns (aggregated, not personally identifiable)
- IP address (used for fraud prevention only, not stored long-term)
3. Plaid — Bank Connection
FlowCheck uses Plaid Technologies, Inc. to securely connect to your financial institutions. When you connect a bank account:
- You authenticate directly with Plaid — your credentials never reach FlowCheck servers
- Plaid provides us with an access token, which we store securely on our backend (never in the app or on your device)
- We use this token only to sync your accounts and transactions
- You may connect multiple financial institutions simultaneously. Each connection is managed independently — disconnecting one bank does not affect your other connected banks.
- When you disconnect a bank, we immediately revoke that bank's Plaid access token and delete all accounts and transaction history associated with it from our systems. If you disconnect all banks, your Plaid-linked status is fully cleared.
- When you delete your account, all Plaid connections are revoked and all associated financial data is deleted across all linked banks.
Plaid's data practices are governed by their own privacy policy, available at plaid.com/legal/privacy-policy. By using the bank connection feature, you agree to Plaid's End User Privacy Policy.
4. Credit Score
FlowCheck allows you to manually enter a credit score you already know from your bank, credit card issuer, or credit monitoring service (such as Credit Karma, Experian app, or your bank's app). FlowCheck does not retrieve credit reports or contact any credit bureau directly.
- The score you enter is stored in your FlowCheck account and used only to display your financial health score within the app
- FlowCheck never performs credit inquiries (hard or soft) on your behalf
- No Social Security Number or personal identifying information is required or requested
- Your manually entered credit score is deleted when you delete your FlowCheck account
5. Firebase (Google)
FlowCheck uses Google Firebase for the following purposes:
- Firebase Authentication: Securely manages your account login (email/password and Apple Sign-In). Firebase handles credential storage and session management.
- Firestore Database: Stores your account data, financial summaries, goals, bills, and app preferences in a secure, encrypted database. Access is restricted by Firebase Security Rules — only you can read your own data.
- Firebase Cloud Messaging (FCM): Used to deliver budget alerts and bill reminders to your device (only if you grant notification permission).
Google's data practices for Firebase are governed by the Google Privacy Policy. Your data is stored in the United States on Google Cloud infrastructure.
5a. Notification Center & History
FlowCheck includes an in-app notification center that displays a history of alerts sent to you, such as bill reminders, budget alerts, and sync confirmations. Specifically:
- Notification history is stored in your personal Firestore database (in a
notifications subcollection under your user record). Only you can access it.
- Each record contains the notification title, body, type (e.g., "bill_due"), read/unread status, and a server-generated timestamp.
- Notifications are retained for the life of your account. When you delete your account, all notification history is deleted as part of the full data erasure process.
- Push notification delivery tokens (FCM tokens) are registered on our backend to route alerts to the correct device. If your device token changes (e.g., app reinstall), the old token is automatically replaced. Tokens are removed when your account is deleted.
You can revoke push notification permission at any time through iOS Settings → FlowCheck → Notifications. This stops future push delivery but does not delete existing notification history from the app.
6. RevenueCat — Subscriptions
FlowCheck uses RevenueCat to manage in-app subscriptions (FlowCheck Pro). RevenueCat receives:
- A random anonymous user ID (not your email or name)
- Subscription status and product identifiers from Apple's App Store
- Purchase timestamps for subscription management
RevenueCat does not receive your financial data. Their privacy policy is at revenuecat.com/privacy. All payment processing is handled by Apple — FlowCheck never touches your payment card information.
7. PostHog — Analytics
FlowCheck uses PostHog to collect anonymous app usage analytics. This helps us understand how the app is being used so we can fix bugs and improve the experience.
PostHog receives:
- A random anonymous user ID (your Firebase UID — not your email or name)
- App interaction events such as which screens are viewed and which tabs are visited
- Non-financial app events such as paywall views and feature engagement
- Device type and app version
PostHog does not receive any of the following: your name, email address, bank account data, transaction history, balances, or any other financial information. We have explicitly disabled automatic data capture and only send carefully selected non-sensitive events.
PostHog data is stored on PostHog's US-based infrastructure. Their privacy policy is at posthog.com/privacy.
8. How We Use Your Information
We use the information we collect to:
- Provide, operate, and improve the FlowCheck app and services
- Display your accounts, transactions, balances, and financial summaries
- Send budget alerts, bill reminders, and important account notifications
- Authenticate you securely and prevent unauthorized access
- Respond to your support requests and inquiries
- Detect and prevent fraud, security threats, and abuse
- Comply with legal obligations
We do not use your data for advertising, behavioral profiling, or selling to third parties.
9. Data Sharing & Disclosure
We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:
- Service Providers: We share data with Plaid, Firebase (Google), RevenueCat, and PostHog solely to operate the features described in this policy. Each provider is bound by data processing agreements and their own privacy policies.
- Legal Requirements: We may disclose information if required by law, court order, or to protect the rights, safety, or property of FlowCheck, our users, or the public.
- Business Transfer: If FlowCheck is acquired or merges with another company, your data may be transferred. We will notify you and give you the opportunity to delete your account before any such transfer is finalized.
9. Security
We implement industry-standard security measures to protect your data:
- All data in transit is encrypted using TLS 1.2 or higher (HTTPS)
- All data at rest is encrypted using AES-256 encryption
- Firebase Security Rules restrict database access to authenticated users and only their own data
- Plaid access tokens are stored only on our backend servers, never in the app or on your device
- Our backend API requires authentication (Firebase ID token) on every request
- Rate limiting is applied to all API endpoints to prevent abuse
- The app uses biometric authentication (Face ID / Touch ID) to prevent unauthorized device access
While we take strong precautions, no system is completely secure. If you become aware of any security issue, please contact us immediately at security@getflowcheck.app.
10. Data Retention
We retain your data for as long as your account is active or as needed to provide the Service. When you delete your account:
- Your Plaid connections are immediately revoked and all synced financial data (accounts and transactions) is deleted for every connected bank
- Your Firestore data (goals, bills, budgets, settings, notification history) is deleted within 30 days
- Your push notification device token (FCM token) is removed immediately
- Your Firebase Auth account is deleted immediately
- Transaction data cached for the purposes of displaying your history is deleted within 30 days
- Backup copies may persist for up to 90 days in encrypted backup storage before being permanently purged
11. Your Rights Under CCPA (California Residents)
If you are a California resident, the California Consumer Privacy Act (CCPA) grants you specific rights regarding your personal information:
- Right to Know: You may request information about the categories and specific pieces of personal data we have collected about you.
- Right to Delete: You may request that we delete your personal data. You can do this at any time through Settings → Delete Account in the app.
- Right to Opt-Out of Sale: We do not sell personal information. There is nothing to opt out of.
- Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA rights.
To exercise your CCPA rights, contact us at privacy@getflowcheck.app or via our Support page. We will respond to verified requests within 45 days.
12. Your Rights Under GDPR (EU/EEA Residents)
If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):
- Right of Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Request correction of inaccurate personal data.
- Right to Erasure ("Right to Be Forgotten"): Request deletion of your personal data (available in-app via Settings → Delete Account).
- Right to Restriction of Processing: Request that we restrict how we process your data in certain circumstances.
- Right to Data Portability: Request a copy of your data in a structured, machine-readable format.
- Right to Object: Object to processing of your personal data for legitimate interests.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
The lawful bases for our data processing are: contract performance (providing the app features you've signed up for), legitimate interests (security, fraud prevention, and service improvement), and legal obligation (compliance with applicable laws).
To exercise GDPR rights, contact: privacy@getflowcheck.app. You also have the right to lodge a complaint with your local Data Protection Authority.
13. Children's Privacy
FlowCheck is not directed to children under the age of 13 (or under 16 in the EU). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately at privacy@getflowcheck.app and we will delete such information promptly.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Last Updated" date at the top of this policy
- Notify you via email (if you have provided one) or via an in-app notification
- Where required by law, obtain your consent before making changes effective
Your continued use of FlowCheck after any changes constitutes acceptance of the updated policy.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out:
We aim to respond to all privacy inquiries within 5 business days.