Privacy Policy

Flowstate Finance is a personal finance management application. This Privacy Policy explains how we handle your personal data.

We collect only the absolute minimum required to provide the service:

• Email address — to identify your account and send essential account emails (verification, password reset only)
• Your financial data — income, expenses, balances, debts, and savings that you choose to enter, stored exclusively for your own use

We do not collect your name unless you provide it. We do not collect payment card details (payments are handled directly by our payment processor).

Your data is used for one purpose only: to provide you with the Flowstate Finance service.

• To maintain and display your account and financial entries
• To send essential transactional emails only (account verification and password reset)

We will never contact you for marketing, promotions, or newsletters. We will never sell, share, rent, or otherwise disclose your personal or financial data to any third party for any purpose.

We do not share your data with third parties. We use minimal infrastructure services (hosting, authentication) solely to keep the app running. These services do not have access to your financial data and are contractually prohibited from using any data for their own purposes.

We do not use advertising networks, analytics platforms, or data brokers.

Your data is stored securely using encryption in transit (TLS) and at rest. Access to stored data is strictly limited to what is needed to serve your own account.

Your data is kept only for as long as your account is active. You can request full deletion of your account and all associated data at any time. We will complete deletion within 30 days of your request.

Under UK GDPR you have the right to access, correct, delete, or export your data at any time. To exercise any of these rights, contact us through the app.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

We use only essential cookies and browser local storage to keep you logged in and save your in-app preferences. We use no advertising, tracking, or analytics cookies whatsoever.

If we ever need to change this policy in a material way, we will notify you via an in-app notice before any change takes effect. We will never retroactively weaken your privacy protections without your explicit consent.

For any privacy questions or data requests, please contact us through the app.

If you choose to connect your bank account via Plaid, Plaid acts as an intermediary between your bank and Flowstate Finance. You authenticate directly with Plaid — we never see or store your bank login credentials (usernames, passwords, or security questions).

Once connected, Plaid transmits certain transaction and account data to us so we can display it in your account. This data includes transaction descriptions, amounts, dates, and account balances. Plaid may also transmit limited account metadata (such as account type and partial account number).

We use this data solely to provide you with the bank feed feature — displaying your transactions within the app. We do not use bank data for marketing, profiling, or sharing with third parties. You may disconnect any bank account at any time, and we will stop receiving new transactions from that account. Previously imported transactions remain in your account data until you delete them.

Plaid is a separate company with its own privacy policy and terms. We encourage you to review Plaid’s privacy practices at plaid.com/privacy.

We take the security of your financial data seriously. Our security measures include:

• Encryption of all data in transit using TLS (Transport Layer Security)
• Encryption of data at rest in our database
• Strict access controls: each user can only read, modify, or delete their own records. No user can access another user’s data.
• Bank credentials are never stored by us — Plaid handles all bank authentication independently
• Payment processing handled entirely by Stripe (PCI-DSS compliant). We never see or store your card details.

Despite these measures, no system is completely secure. In the unlikely event of a data breach, we will notify affected users without undue delay in accordance with our legal obligations under UK GDPR.