MyFundFlow Privacy Policy

Effective Date: 10/01/2025

Last Updated: 10/11/2025

Introduction

Welcome to MyFundFlow. We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how MyFundFlow LLC ("we," "us," or "our"), the maker of MyFundFlow, collects, uses, stores, and shares information when you use our web application, mobile applications, and services (collectively, the "App" or "Services").

By using MyFundFlow, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, please do not use our App.

Information We Collect

Information You Provide Directly

When you create an account and use MyFundFlow, we collect:

Account Information: Email address, password (encrypted), and profile preferences
Financial Information: Savings goals, debt account details, income amounts, budget categories, and expense data you manually enter
User-Generated Content: Custom categories, notes, goal descriptions, and budget preferences

Financial Data via Plaid Integration (Optional)

With your explicit consent, we use Plaid Inc. ("Plaid") to securely connect your bank accounts. When you choose to link accounts through Plaid:

Transaction Data: Transaction history, amounts, dates, merchant names, and categories
Account Information: Account balances, account types, account names, and routing/account numbers
Identity Information: Account holder names associated with connected accounts

Important: We NEVER see or store your bank login credentials. These are handled securely by Plaid and encrypted in transit. For more information about how Plaid handles your data, please review Plaid's Privacy Policy.

Transaction Retention: We retain transaction data from the time you connect Plaid onwards to provide 12-month financial insights and trends. Currently, transaction data is kept indefinitely unless you delete your account or manually delete your transaction history (see Your Data Rights section). We may implement automatic deletion of transactions older than 12 months in the future.

Plaid Disconnection: If you disconnect Plaid, we retain your historical transaction data to preserve your financial insights and trends. You can manually delete all transaction history at any time through your account settings.

Automatically Collected Information

When you use our App, we automatically collect:

Device Information: Device type, operating system version, browser type, unique device identifiers
Usage Data: Features accessed, pages viewed, time spent in app, button clicks, error logs, crash reports
IP Address: We collect and store your IP address when you register and login for security purposes, specifically to detect suspicious login activity from unusual locations
Location Data: Approximate geographic location derived from your IP address (city/state level) for security monitoring
Performance Data: Page load times, API response times, and app performance metrics

Analytics and Tracking

We use the following third-party services to understand how users interact with our app:

Sentry: Error tracking and crash reporting to identify and fix bugs
Vercel Analytics: Website performance metrics and page view analytics
Vercel Speed Insights: Performance monitoring and optimization data
Google Analytics: User behavior analytics, feature usage patterns, and traffic sources

These services may use cookies and similar tracking technologies. For web app users, please see our Cookie Policy section below.

Information We Do Not Collect

We do NOT collect precise GPS geolocation data
We do NOT access your contacts, photos, camera, or microphone without explicit permission
We do NOT collect information about minors under 16
We do NOT collect biometric data (though we may support Face ID/Touch ID via your device's secure enclave)

How We Use Your Information

We use collected information for the following purposes:

Provide Services: Deliver budgeting, debt tracking, savings goals, and financial allocation features
Financial Calculations: Generate personalized budget recommendations and savings projections based on your data
Improve Services: Analyze usage patterns to enhance features, fix bugs, and optimize user experience
Security: Detect and prevent fraud, unauthorized access, suspicious login activity, and security incidents
Communication: Send essential account notifications, service updates, security alerts, and password reset emails
Customer Support: Respond to your inquiries, troubleshoot issues, and provide assistance
Legal Compliance: Meet legal obligations and enforce our Terms of Service
Product Development: Understand which features are most valuable to improve the app

We do NOT use your information for:

Targeted advertising or marketing to you
Selling or renting your data to third parties
Creating user profiles for external parties
Sharing with data brokers

Future Advertising: We may display advertisements in the future, including our own promotional content for premium features and/or third-party ads through Google AdSense. If implemented, we will update this policy and provide opt-out options where applicable.

How We Share Your Information

We share your information only in the following limited circumstances:

Service Providers

We work with trusted third-party service providers who help us operate the App:

Plaid Inc.: Securely connects your financial accounts (only with your consent)
Cloud Infrastructure:
- AWS (Amazon Web Services) for backend hosting and computing (US-West region, California)
- Supabase for database storage (US-East region)
Payment Processing: Stripe for subscription billing and payment processing (for premium features)
Analytics & Monitoring: Sentry, Vercel Analytics, Vercel Speed Insights, and Google Analytics for performance monitoring and usage analytics
Email Services: Email service providers for account notifications and support communications

All service providers are contractually obligated to protect your data and use it only for specified purposes. We do not give these providers permission to use your data for their own purposes.

Legal Requirements

We may disclose your information if required to do so by law or in response to:

Valid legal processes (subpoenas, court orders, search warrants)
Requests from law enforcement or government agencies
Protection of our legal rights, property, or safety
Prevention of fraud, security incidents, or illegal activity
Defense against legal claims

Business Transfers

In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred to the acquiring entity. We will notify you via email and/or prominent notice in the App at least 30 days before your information becomes subject to a different privacy policy, and you will have the option to delete your account before the transfer.

With Your Consent

We may share your information for purposes not described in this policy with your explicit consent.

What We Do NOT Do

We do NOT:

Sell your personal information to anyone
Rent your data to third parties
Share your data with data brokers
Provide your financial information to advertisers
Share your data for purposes unrelated to providing our Services

Data Retention

We retain your information only as long as necessary to provide Services and fulfill the purposes described in this Privacy Policy:

Active Accounts: Retained while your account is active and you continue using the App
Inactive Accounts: Currently retained indefinitely; we do not automatically delete inactive accounts but may implement automatic deletion after 365 days of inactivity in the future
Transaction Data: Retained from the time you connect Plaid onwards to provide 12-month insights. Currently kept indefinitely unless you manually delete or delete your account. We may implement rolling 12-month deletion in the future
Financial Goals & Budgets: Retained while your account is active
Plaid Connection: When you disconnect Plaid, your historical transaction data is retained to preserve your insights. You can manually delete all transaction history separately
Usage Analytics: Aggregate, anonymized analytics may be retained indefinitely for product improvement
IP Addresses & Login Data: Stored in our refresh tokens table and retained indefinitely for security and fraud prevention purposes
Deleted Accounts: All personal data permanently deleted within 30 days of account deletion request
Backups: We do not currently maintain automated backups. If we implement backups in the future, deleted data will be purged from backups within 90 days

Your Data Rights and Choices

Depending on your location, you may have the following rights:

Access and Portability

Request a copy of your personal information (email support@myfundflow.app)
View your data within the App settings
Export your budget and financial data by emailing support@myfundflow.app

Correction

Update or correct account information through your profile settings
Modify financial goals, debts, income, and budget categories at any time

Deletion

Delete Entire Account: Remove your account and all associated data permanently through App settings or by emailing support@myfundflow.app
Delete Transaction History Only: Remove all transaction data while keeping your account, goals, and settings (available in a future update)
Disconnect Plaid: Disconnect bank account integration at any time through account settings
All deletion requests processed within 30 days

Opt-Out Options

Disable analytics and crash reporting by emailing support@myfundflow.app
Unsubscribe from non-essential email communications
Opt out of biometric authentication on mobile devices
Opt out of cookies through browser settings (web users)

California Residents (CCPA Rights)

California residents have additional rights under the California Consumer Privacy Act:

Right to Know: What personal information we collect, use, disclose, and sell
Right to Delete: Request deletion of your personal information
Right to Opt-Out: We do NOT sell personal information, so no opt-out is needed
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

Notice at Collection: We collect the categories of personal information described in this policy for the business purposes outlined in the "How We Use Your Information" section.

To Exercise CCPA Rights: Email support@myfundflow.app with subject line "CCPA Request" or delete your account through App settings.

European Union Residents (GDPR Rights)

EU/EEA/UK residents have rights under the General Data Protection Regulation:

Right to Access: Obtain confirmation of what personal data we process
Right to Rectification: Correct inaccurate personal data
Right to Erasure: Request deletion of your personal data
Right to Restrict Processing: Limit how we use your data
Right to Data Portability: Receive your data in a structured, machine-readable format
Right to Object: Object to processing based on legitimate interests
Right to Withdraw Consent: Withdraw consent for data processing at any time
Right to Lodge a Complaint: File a complaint with your supervisory authority

Legal Basis for Processing (GDPR):

Contract Performance: Necessary to provide Services you've requested
Consent: You've given explicit consent (e.g., Plaid connection)
Legitimate Interests: Fraud prevention, security, service improvement

To Exercise GDPR Rights: Email support@myfundflow.app with subject line "GDPR Request"

Data Security

We implement industry-standard security measures to protect your information:

Encryption:
- All data encrypted in transit using TLS 1.3
- Passwords hashed using bcrypt (salted, industry-standard)
- Sensitive data encrypted at rest in database
Authentication: Secure JWT-based authentication with refresh tokens
Access Controls: Strict internal access policies; only authorized personnel can access user data
Infrastructure Security:
- AWS security best practices
- Supabase enterprise-grade database security
- Regular security monitoring via Sentry
Third-Party Security: Plaid and Stripe handle financial data with bank-level security

Security Limitations: While we implement strong security measures, no system is 100% secure. We cannot guarantee absolute security of data transmitted over the internet. We will notify you within 72 hours of discovering any data breach affecting your information, as required by law.

Cookie Policy (Web App Users)

Our web application (myfundflow.app) uses cookies and similar tracking technologies:

Types of Cookies We Use

Essential Cookies (Necessary)
- Authentication and session management
- Security and fraud prevention
- Cannot be disabled
Analytics Cookies (Optional)
- Vercel Analytics for site performance
- Google Analytics for usage patterns
- Can be disabled via cookie banner
Preference Cookies
- Remember your settings and preferences
- Improve user experience

Managing Cookies

Cookie Consent: When you first visit myfundflow.app, we display a cookie banner allowing you to accept or reject optional cookies.

Browser Settings: You can control cookies through your browser settings:

Block all cookies
Delete existing cookies
Allow cookies only from certain sites

Note: Blocking essential cookies may prevent the App from functioning properly.

Opt-Out Links:

Google Analytics: https://tools.google.com/dlpage/gaoptout

Third-Party Services and Links

Plaid Integration

When you connect bank accounts, you interact directly with Plaid's services. Plaid's privacy practices are governed by their Privacy Policy available at https://plaid.com/legal/. We cannot control Plaid's data practices and are not responsible for their privacy policies.

Stripe Payment Processing

If you subscribe to premium features, Stripe processes your payment information. We do NOT store your credit card details—Stripe handles all payment data securely. We only receive and store:

Subscription status (active, canceled, expired)
Subscription tier (free, premium)
Subscription expiration date

Stripe's privacy policy is available at https://stripe.com/privacy.

External Links

The App may contain links to external websites or resources. We are not responsible for the privacy practices of third-party sites. We encourage you to review their privacy policies before providing any information.

International Data Transfers

Business Location: MyFundFlow LLC operates from California, United States.

Data Storage: Your information is processed and stored on servers located in the United States:

Backend: AWS US-West (California)
Database: Supabase US-East

International Users: By using MyFundFlow, you consent to the transfer of your information to the United States. We implement appropriate safeguards for international data transfers as required by applicable laws.

EU/UK/Swiss Users: We take steps to ensure adequate protection of personal data transferred from the EEA, UK, or Switzerland in accordance with applicable data protection laws.

Children's Privacy

MyFundFlow is not intended for users under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@myfundflow.app, and we will promptly delete such information.

Age Verification: By creating an account, you represent that you are at least 16 years old, or if the age of majority in your jurisdiction is greater than 16, that you have the consent of a parent or legal guardian.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. We will notify you of material changes by:

Updating the "Last Updated" date at the top of this policy
Posting a notice in the App
Sending an email notification to your registered email address
Requiring acceptance of new terms for continued use (for substantial changes)

Your Responsibility: Please review this policy periodically. Your continued use of the App after changes are posted constitutes acceptance of the updated policy.

Material Changes: For significant changes that materially affect your rights, we will provide at least 30 days notice before the changes take effect.

California Shine the Light Law

California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. We do NOT share personal information with third parties for their direct marketing purposes, so we have no disclosures to report under this law.

Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. We currently do not respond to DNT signals, as there is no industry-wide standard for how to handle them. If we implement DNT handling in the future, we will update this policy.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: support@myfundflow.app

Website: https://myfundflow.app

Data Protection Inquiries:

Privacy questions: support@myfundflow.app
Data deletion requests: support@myfundflow.app or use in-app account deletion
CCPA requests: support@myfundflow.app (subject: "CCPA Request")
GDPR requests: support@myfundflow.app (subject: "GDPR Request")

Business Information:

Legal Entity: MyFundFlow LLC
Business Location: California, United States
Data Storage: AWS US-West (California), Supabase US-East

Response Time: We aim to respond to all privacy inquiries within 30 days. For data deletion requests, we process them within 30 days as required by law.

Summary of Key Points

What data we collect: Email, financial information you enter, bank transactions (via Plaid with consent), app usage data, IP addresses for security

How we use it: Provide budgeting services, improve the app, ensure security, send essential notifications

Who we share with: Only essential service providers (Plaid, AWS, Supabase, Stripe, analytics tools), law enforcement if required by law

What we DON'T do: Sell your data, share it for advertising, provide it to data brokers

Your rights: Access, delete, or export your data at any time; delete transaction history separately from account deletion

Contact: support@myfundflow.app for any questions or concerns

Data location: United States (AWS California, Supabase US-East)

This Privacy Policy was last updated on 10/11/2025. Please check back periodically for updates.