Back to Home

MyFundFlow Data Retention and Deletion Policy

Effective Date: 10/01/2025

Last Updated: 10/11/2025

Legal Entity: MyFundFlow LLC

Application: MyFundFlow Web and Mobile Applications

1. Overview

This Data Retention and Deletion Policy outlines how MyFundFlow LLC ("we," "us," or "our"), maker of MyFundFlow, collects, stores, retains, and deletes user data in compliance with applicable data privacy laws and regulations including the California Consumer Privacy Act (CCPA), General Data Protection Regulation (GDPR), and other relevant privacy legislation.

This policy applies to all data collected through the MyFundFlow web application (myfundflow.app) and mobile applications (iOS and Android).

2. Purpose and Scope

Purpose: To ensure transparent data handling practices that respect user privacy while maintaining operational and legal requirements.

Scope: This policy covers all personal data and user-generated content collected through MyFundFlow Services.

3. Data Categories and Retention Periods

3.1 User Account Data

Data Includes: Email address, hashed passwords, account creation date, last login date, account preferences, subscription tier

Retention Period:

  • Active Accounts: Retained indefinitely while account remains active and user continues using the app
  • Inactive Accounts: Currently retained indefinitely; we do NOT automatically delete inactive accounts
  • Future Implementation: May implement automatic deletion after 365 days of inactivity with 30-day advance notice to users
  • Deleted Accounts: Permanently deleted within 30 days of deletion request

Deletion Trigger:

  • User-initiated account deletion through app settings
  • User-initiated deletion request via email to support@myfundflow.app
  • Account termination for Terms of Service violations

3.2 Financial Data - Plaid Integration

Data Includes: Bank account information, transaction history, transaction amounts, merchant names, transaction categories, account balances, account types, account holder names

Retention Period:

  • Active Connection: Retained while Plaid integration is active and user maintains connection
  • Transaction History: Retained indefinitely from the time of Plaid connection onwards to provide 12-month financial insights and historical trend analysis
  • After Plaid Disconnection: Historical transaction data is retained to preserve user's financial insights and progress
  • Future Implementation: May implement rolling deletion of transactions older than 12 months for free-tier users (premium users may retain unlimited history)

User Control:

  • Users can disconnect Plaid at any time (historical data preserved)
  • Users can manually delete all transaction history through Settings > Privacy > "Delete All Transaction History"
  • Users can delete entire account (all transaction data deleted within 30 days)

Deletion Trigger:

  • User clicks "Delete All Transaction History" button
  • User deletes entire account
  • User requests deletion via email to support@myfundflow.app

Important Note: When you disconnect Plaid, we preserve your historical transaction data so you don't lose your insights and progress. You maintain full control and can delete this data separately at any time.

3.3 User-Generated Financial Data

Data Includes: Manually entered income amounts, savings goals, debt account details, budget categories, expense records, custom categories, notes, goal descriptions

Retention Period:

  • Active Accounts: Retained while account is active
  • Soft Deletes: User-deleted items (e.g., deleted goals, deleted budget categories) are immediately removed from database (hard delete, no grace period)
  • Account Deletion: Permanently deleted within 30 days of account deletion request

Deletion Trigger:

  • User deletes specific items (goals, budgets, debts)
  • User deletes entire account

3.4 Usage and Analytics Data

Data Includes: App usage patterns, feature adoption, session duration, pages viewed, buttons clicked, user flows, device information (type, OS version, browser), crash reports, error logs, performance metrics

Third-Party Services:

  • Sentry (error tracking)
  • Vercel Analytics (website performance)
  • Vercel Speed Insights (performance monitoring)
  • Google Analytics (user behavior and traffic sources)

Retention Period:

  • Identified Data: Retained for the duration of active account use
  • Anonymized Aggregates: May be retained indefinitely for product improvement and analytics
  • Account Deletion: User-identifiable usage data deleted within 30 days of account deletion request
  • Crash Reports: Retained in Sentry per their retention policies (typically 90 days)

Deletion Trigger:

  • Account deletion (user-identifiable data only)
  • Anonymized data may be retained permanently

3.5 Authentication and Security Logs

Data Includes: Login timestamps, registration timestamps, IP addresses, device fingerprints, session tokens, refresh tokens, authentication attempts (successful and failed), security events

Storage Location: IP addresses stored in refresh_tokens table associated with user sessions

Retention Period:

  • IP Addresses: Retained indefinitely in refresh tokens table for security and fraud prevention purposes
  • Login Events: Retained indefinitely for security monitoring and suspicious activity detection
  • Session Tokens: Expire and are cleaned up according to JWT expiration (1 hour access tokens, longer-lived refresh tokens)
  • Security Incident Logs: Retained for 2 years from incident resolution date

Deletion Trigger:

  • Important: IP addresses and login logs are NOT deleted when user deletes account
  • Retained permanently for fraud prevention, security investigation, and legal compliance
  • Required for detecting patterns of abuse, preventing account takeovers, and investigating security incidents

User Notice: This retention of IP addresses and login data after account deletion is disclosed in our Privacy Policy and is necessary for legitimate security purposes under GDPR Article 6(1)(f) (legitimate interests) and CCPA business purposes exemptions.

3.6 Payment and Subscription Data

Data Includes: Subscription status (active, canceled, expired), subscription tier (free, premium), subscription start/end dates, billing cycle information

Payment Processing: All credit card and payment details are stored and processed exclusively by Stripe, Inc. We do NOT store credit card numbers, CVV codes, or full payment information.

What We Store:

  • Stripe customer ID (reference only)
  • Subscription status
  • Subscription tier level
  • Renewal dates
  • Invoice IDs (for record keeping)

Retention Period:

  • Active Subscriptions: Retained while subscription is active
  • Canceled Subscriptions: Billing history retained for 7 years for accounting, tax compliance, and legal requirements
  • Account Deletion: Subscription status deleted, but billing records retained for 7 years per financial regulations

Deletion Trigger:

  • Automatic deletion after 7 years (financial record retention requirement)
  • User cannot delete billing records before 7 years due to legal requirements

3.7 Customer Support and Communication Data

Data Includes: Support tickets, email correspondence, chat transcripts, feedback submissions, bug reports, feature requests

Retention Period:

  • Active Tickets: Retained until resolution plus 90 days
  • Closed Tickets: Retained for 1 year after ticket closure
  • Account Deletion: Support correspondence deleted within 30 days of account deletion request

Deletion Trigger:

  • Rolling deletion 1 year after ticket closure
  • User account deletion

3.8 Cookies and Web Tracking Data

Data Includes: Session cookies, preference cookies, authentication cookies, analytics cookies (Vercel, Google Analytics)

Retention Period:

  • Essential Cookies: Session duration or as needed for authentication (typically 1-30 days)
  • Analytics Cookies: Per third-party service retention policies (Google Analytics: 26 months default)
  • Preference Cookies: Until user clears browser cookies or revokes consent

User Control:

  • Cookie consent banner on first web visit
  • Users can reject optional cookies (analytics)
  • Users can clear cookies via browser settings
  • Users can opt out of Google Analytics: https://tools.google.com/dlpage/gaoptout

Deletion Trigger:

  • User clears browser cookies
  • User opts out of optional cookies
  • Cookie expiration

3.9 Backup Data

Current Status: We do NOT currently maintain automated database backups.

Future Implementation: If we implement automated backups in the future:

  • Backup Frequency: Daily or weekly (to be determined)
  • Backup Retention: 90 days maximum
  • Deleted Data in Backups: Data marked for deletion will be purged from all backup systems within 90 days
  • User Notification: Privacy Policy will be updated to reflect backup implementation

User Notice: The absence of automated backups means:

  • Faster data deletion (no backup purge delay)
  • Users should maintain their own records of important financial information
  • Lower operational costs enabling free tier sustainability

4. Data Deletion Procedures

4.1 Account Deletion Process

When a user requests account deletion:

Immediate Actions (Within 24 hours):

  1. Disable user login access
  2. Mark account as "pending deletion" in database
  3. Send confirmation email to user

Within 30 Days:

  1. Permanently delete from production database:
    • User account information
    • All transaction data
    • All financial goals and budgets
    • All user-generated content
    • Usage analytics (user-identifiable)
  2. Disconnect Plaid integration
  3. Cancel active subscriptions (via Stripe)
  4. Remove from all application caches

Retained After Deletion:

  • IP addresses and login logs (security/fraud prevention)
  • Anonymized analytics data
  • Billing records (7 years for tax/legal compliance)
  • Security incident logs if applicable

Confirmation:

  • Send deletion confirmation email within 30 days
  • Document deletion completion date in audit log

4.2 Transaction History Deletion Process

When a user requests transaction history deletion only:

Immediate Actions:

  1. Display confirmation modal warning:
    • All transactions will be permanently deleted
    • Financial insights/trends will be reset
    • Budget categories and goals remain intact
    • Action cannot be undone
  2. Require user to type "DELETE" or check "I understand"

Upon Confirmation:

  1. Hard delete all transaction records from database
  2. Delete related transaction metadata and categorizations
  3. Reset calculated insights and trends
  4. Clear transaction-related caches
  5. Log deletion action in audit log with timestamp and IP address

Preserved After Transaction Deletion:

  • User account and login credentials
  • Savings goals and debt accounts
  • Budget categories and preferences
  • Plaid connection (if active - user can sync new transactions)
  • IP addresses and login history

Notification:

  • Show success message
  • Explain that Plaid connection remains active (if applicable)

4.3 Plaid Disconnection Process

When a user disconnects Plaid:

Immediate Actions:

  1. Revoke Plaid access token
  2. Disable automatic transaction sync
  3. Mark Plaid connection as "inactive"

NOT Deleted:

  • Historical transaction data (preserved for user insights)
  • Calculated trends and insights

User Notice:

  • Display message: "Plaid disconnected. Your historical transaction data is preserved to maintain your insights. To delete this data, go to Settings > Privacy > Delete All Transaction History"

4.4 Deletion Request via Email

Users can request deletion by emailing support@myfundflow.app:

Process:

  1. Verify user identity (send verification link to registered email)
  2. Confirm deletion scope (account, transactions only, or specific data)
  3. Process deletion per appropriate procedure above
  4. Send confirmation email within 30 days
  5. Document request and completion in audit log

5. Legal and Regulatory Compliance

5.1 CCPA Compliance (California Consumer Privacy Act)

Right to Delete: California residents can request deletion of personal information, subject to certain exceptions.

Business Purpose Exemptions:

  • We retain IP addresses and security logs for fraud prevention (business purpose exception)
  • We retain billing records for 7 years (legal compliance exception)

Processing Time: Deletion requests processed within 45 days (CCPA allows up to 90 days with notice)

5.2 GDPR Compliance (EU General Data Protection Regulation)

Right to Erasure (Article 17): EU residents can request deletion of personal data.

Lawful Basis for Retention After Deletion Request:

  • IP addresses: Legitimate interest in fraud prevention and security (Article 6(1)(f))
  • Billing records: Legal obligation for tax and accounting compliance (Article 6(1)(c))

Processing Time: Deletion requests processed within 30 days (GDPR requires "without undue delay")

5.3 CalOPPA Compliance (California Online Privacy Protection Act)

Disclosure Requirements: Privacy Policy clearly states data collection, use, and sharing practices (see MyFundFlow Privacy Policy)

5.4 Gramm-Leach-Bliley Act (GLBA) Considerations

While MyFundFlow is not a financial institution, we handle financial data through Plaid integration:

  • Financial data used only for budgeting services provided to users
  • No sharing of financial data with third parties for marketing
  • Security safeguards in place (encryption, access controls)

6. Data Retention Justifications

Why We Retain Data

Account Data: Necessary to provide Services and maintain user accounts

Transaction Data: Essential for providing 12-month financial insights, trend analysis, and budgeting recommendations

IP Addresses: Critical for security monitoring, fraud detection, and prevention of account takeovers

Billing Records: Required by law for tax reporting and financial auditing (7-year retention standard)

Security Logs: Necessary for investigating security incidents and preventing abuse

Analytics Data: Helps improve product features and user experience (anonymized)

Data Minimization Principle

We follow data minimization practices:

  • Collect only data necessary for providing Services
  • Do not collect precise GPS location
  • Do not access contacts, photos, or camera without permission
  • Do not collect biometric data (except via device secure enclave for Face ID/Touch ID)
  • Do not retain credit card information (handled by Stripe)

7. User Rights and Controls

7.1 Access Your Data

  • View account information in app settings
  • Request copy of all personal data via email to support@myfundflow.app
  • Export budget and financial data on request (email support@myfundflow.app)

7.2 Correct Your Data

  • Update account information through profile settings
  • Modify financial goals, debts, and budgets anytime
  • Correct transaction categorizations

7.3 Delete Your Data

  • Full Account Deletion: Settings > Account > Delete Account
  • Transaction History Only: Settings > Privacy > Delete All Transaction History
  • Email Request: support@myfundflow.app with subject "Data Deletion Request"

7.4 Export Your Data (Future)

  • Data portability available on request via support@myfundflow.app
  • Request export via support@myfundflow.app

7.5 Opt-Out Options

  • Disconnect Plaid integration anytime
  • Reject optional cookies (analytics)
  • Disable analytics and crash reporting by emailing support@myfundflow.app

8. Data Storage and Security

8.1 Storage Locations

Primary Storage:

  • Backend Application: AWS US-West (California) - hosted on AWS infrastructure
  • Database: Supabase US-East region - PostgreSQL database

Third-Party Storage:

  • Payment Data: Stripe (encrypted, PCI-DSS compliant)
  • Error Logs: Sentry (US-based servers)
  • Analytics: Vercel (US-based), Google Analytics (Google servers)
  • Transaction Data: Plaid temporarily caches data during sync

Data Transfer: All data encrypted in transit using TLS 1.3

Data at Rest: Sensitive data encrypted at rest (passwords hashed with bcrypt, database encryption)

8.2 Security Measures

  • AES-256 encryption at rest
  • TLS 1.3 encryption in transit
  • Bcrypt password hashing
  • JWT-based authentication
  • Role-based access controls
  • Regular security monitoring via Sentry
  • Secure infrastructure (AWS, Supabase enterprise security)

8.3 Data Backups

Current Status: No automated backups implemented

Implications:

  • Faster data deletion (no backup purge delays)
  • Lower data retention overhead
  • Users responsible for maintaining own records

Future Plans: If backups are implemented:

  • Will update this policy
  • Deleted data purged from backups within 90 days
  • Users will be notified of changes

9. Changes to This Policy

We may update this Data Retention Policy to reflect:

  • Changes in data practices
  • New legal requirements
  • Service improvements
  • Implementation of new features (e.g., automated backups)

Notification of Changes:

  • Updated policy posted in app with new "Last Updated" date
  • Email notification for material changes
  • 30-day notice for significant changes affecting user data

User Acceptance:

  • Continued use of Services constitutes acceptance of updated policy
  • Material changes may require explicit user consent

10. Audit and Compliance

10.1 Internal Audits

We conduct periodic reviews of:

  • Data retention schedules
  • Deletion procedures and completion
  • User data access logs
  • Security incident responses

10.2 Record Keeping

We maintain records of:

  • Data deletion requests and completion dates
  • Retention schedule reviews and updates
  • Data breach incidents and responses
  • User consent and consent withdrawals
  • Privacy setting changes

10.3 Compliance Monitoring

Regular monitoring of:

  • Privacy law changes (CCPA, GDPR updates)
  • Third-party service provider compliance (Plaid, Stripe)
  • User complaints and privacy concerns
  • Data protection best practices

11. Contact Information

For questions about this Data Retention Policy or to exercise your data rights:

Email: support@myfundflow.app

Website: https://myfundflow.app

Response Time: Within 30 days for all data requests

Specific Requests:

  • Data Deletion: support@myfundflow.app (subject: "Data Deletion Request")
  • Data Access: support@myfundflow.app (subject: "Data Access Request")
  • CCPA Requests: support@myfundflow.app (subject: "CCPA Request")
  • GDPR Requests: support@myfundflow.app (subject: "GDPR Request")

Legal Entity: MyFundFlow LLC

Location: California, United States

Data Protection Officer: Available upon request for GDPR inquiries

Document Control

Document Version: 1.0

Effective Date: 10/01/2025

Last Reviewed: 10/11/2025

Next Review Date: One year from effective date

Approved By: MyFundFlow LLC

Related Documents:

  • MyFundFlow Privacy Policy
  • MyFundFlow Terms of Service
  • Plaid Integration Agreement

This policy is designed to comply with:

  • California Consumer Privacy Act (CCPA/CPRA)
  • General Data Protection Regulation (GDPR)
  • California Online Privacy Protection Act (CalOPPA)
  • Gramm-Leach-Bliley Act (GLBA) considerations
  • State data privacy laws
  • Plaid API Terms of Service and Developer Policy

Policy Owner: MyFundFlow LLC

Contact: support@myfundflow.app

Privacy PolicyTerms of ServiceData Retention

© 2025 MyFundFlow LLC. All rights reserved.