FinFlow Privacy Policy
This policy explains what information the FinFlow app ("FinFlow", "the app", "we") handles, why, and the choices you have. FinFlow is a personal finance app for tracking accounts, cards, spending, budgets, bills, loans and savings goals.
- Your financial records are stored on your phone. We don't run servers that receive them.
- The FinFlow app has no user accounts, ads, analytics or tracking. We don't sell or share your data.
- Data leaves your phone only for features you use: exchange rates, Google Drive backups you turn on, and the services described below.
- Every sensitive permission is optional and is asked for only when you turn on the feature that needs it.
1. Information stored on your phone
Everything you enter in FinFlow is saved in the app's private storage on your device. Only FinFlow can read it. This includes:
- Financial records: accounts, cards, balances, transactions, categories, budgets, goals, bills and repeating payments, installment plans, loans, assets, money owed to or by people you add, and allocations.
- Card and account details you choose to enter: names, last four digits, and optionally full card or account numbers, IBAN, SWIFT/BIC, expiry date and security code (CVV/CVC). Full numbers and security codes are encrypted (see section 5).
- Profile details you choose to enter: name, nickname, email address, phone number and profile photo. These stay on your phone and are used only to personalise the app.
- Photos and files: receipt photos, card photos, custom icons and statement files you add.
- Bank alerts: if you turn on bank alerts, the text of messages that look like bank transactions (see section 2).
- Places for reminders: if you use place reminders, the places you mark.
- Settings and app progress: preferences, themes, reminder settings and money coach progress.
The in-app assistant answers questions on your phone using your records. It does not send your questions or data to an AI service.
2. Permissions and why they're used
Except for basic internet access, every permission is optional. FinFlow asks for each one only when you turn on the feature that needs it, and you can turn it off at any time in the app or in your phone's settings.
| Permission | Used for |
|---|---|
| Notification access | Bank alerts (optional). FinFlow reads incoming notifications and keeps only those that look like a bank or wallet transaction, meaning a message containing an amount. It stores up to 500 characters of that message so you can review it and add it as a transaction. Other notifications are ignored and not stored. You can mute any app as a source. |
| Receive SMS | Bank SMS alerts (optional). Same as above for text messages from your bank. Messages that don't look like transactions are ignored and not stored. FinFlow never sends SMS and doesn't read your existing inbox. |
| Location (including background) | Place reminders (optional money coach feature). FinFlow can remind you of your budget when you arrive at a place you marked, such as a mall. It uses Android's geofencing through Google Play services. Your places are stored on your phone. FinFlow does not record or keep a history of where you go. |
| Camera | Taking photos of receipts and cards inside the app. Receipt text is read on your phone (Google ML Kit, offline). |
| Microphone | Asking the assistant by voice, only while you hold or tap the mic button. See section 3 for how speech is processed. |
| Notifications | Budget alerts, bill and card payment reminders, backup status and quick-add shortcuts. |
| Internet and network state | Downloading exchange rates and, if you turn it on, Google Drive backups. |
| Wi-Fi state, local network, foreground service, wake lock | PC Manager (optional). Lets you open FinFlow in a web browser on a computer on the same network. These permissions keep the connection running while you use it. |
| Run at startup | Restoring reminders, place reminders and widgets after your phone restarts. |
3. When information leaves your phone
Exchange rates
To convert totals between currencies, FinFlow downloads daily rates from Frankfurter and, as a fallback, ExchangeRate-API (open.er-api.com). The request contains only a currency code, such as "AED". Like any internet request, these services can see your IP address. No financial records are sent.
Google Drive backups (optional)
If you connect Google Drive, FinFlow uploads backup files to your own Google Drive. It uses limited access that covers only files FinFlow creates. FinFlow cannot see your other Drive files. Each backup is encrypted on your phone with your backup passcode before it's uploaded, so Google and we cannot read its contents. FinFlow also reads your Google account email to show which account is connected. Google's handling of your Drive is covered by the Google Privacy Policy.
Backup files you export
When you save or share a backup, report (PDF) or CSV export, it goes to the place or app you choose. Backups are encrypted with your backup passcode. PDF reports and CSV exports are not encrypted, so keep them somewhere safe.
Android device backup
If Android backup is turned on in your phone's settings, Android may include FinFlow's data in your Google account backup or a phone-to-phone transfer. Google encrypts this backup, using your screen lock on supported phones. Full card numbers and security codes are tied to your phone's secure hardware and are not restored this way. Use FinFlow's own backup to move them. You can turn off Android backup in your phone's settings.
Voice questions
When you ask the assistant by voice, FinFlow uses your phone's speech recognizer. Where your phone supports it, speech is recognized on the device. Otherwise your phone's speech service, usually Google's, may process the audio under its own privacy policy. FinFlow receives only the text.
Place reminders
Geofencing is provided by Google Play services, which processes location under the Google Privacy Policy. FinFlow itself does not send your location anywhere.
PC Manager
PC Manager shows your FinFlow data in a browser on a computer on the same local network or hotspot as your phone. The data goes directly from your phone to that computer and is not sent to the internet. We recommend turning on the browser access code and using PC Manager only on networks you trust, such as your home Wi-Fi, your phone's hotspot or a USB connection.
Links you open
FinFlow may open web pages, such as a card issuer's page or the Play Store, in your browser. Those sites have their own privacy policies.
4. What we don't do
- We don't require an account or sign-in to use FinFlow.
- We don't collect your financial records on our own servers. We don't operate servers that receive them.
- We don't show ads or include advertising, analytics or tracking tools in the app.
- We don't sell, rent or share your information with third parties.
- We don't connect to your bank or move money. FinFlow only records what you enter or approve.
If you install FinFlow from Google Play, Google may collect information about the installation, such as crash and performance reports you agree to share with developers, under its own policies.
This website. The FinFlow website (finflow.tikryx.com) uses Vercel Web Analytics and Speed Insights to count page visits and measure how quickly pages load. They don't use cookies and don't identify you personally. Vercel receives the page you visited, the site that linked you, and your browser, device type and country. They don't run inside the FinFlow app, including the copy of this policy shown in the app.
5. How your information is protected
- Private storage: FinFlow's data is kept in app-private storage that other apps can't access.
- Encrypted card details: full card and account numbers and security codes are encrypted with a key held in your phone's Android Keystore.
- Encrypted backups: backups are encrypted with a key protected by your backup passcode and a recovery key. Neither is stored by FinFlow or sent to us. If you lose both, we cannot recover your backups.
- App lock: you can lock FinFlow with your fingerprint, face or screen lock. While app lock is on, FinFlow is hidden from screenshots and the recent-apps screen.
- Private notifications: amounts in reminders and alerts are hidden on the lock screen.
- Secure connections: exchange rates and Google Drive use encrypted connections (HTTPS).
No method of storage or transmission is completely secure. Keep your phone's screen lock on and keep your backup passcode private.
6. Your choices, retention and deletion
- Edit or delete records: you can change or delete any record in the app at any time.
- Turn features off: bank alerts, SMS alerts, place reminders, Google Drive backup and PC Manager can each be turned off in the app. You can also remove any permission in your phone's settings.
- Disconnect Google Drive: use Backup & restore in FinFlow. To delete backups already in Drive, delete them from your Google Drive.
- Delete everything: in FinFlow, go to Settings > Data and use Erase all data (your records) or Factory reset FinFlow (records, profile, settings and FinFlow's backups on the phone). Uninstalling FinFlow, or clearing its storage in your phone's settings, also permanently deletes all data on your phone. Backups you saved elsewhere or uploaded to Google Drive stay there until you delete them.
FinFlow keeps your information only for as long as it's on your phone or in backups you control. Because we don't hold your data on our servers, we have nothing to export or delete on your behalf. Every copy is under your control. If you have a question about your data or privacy rights, such as under the Philippines Data Privacy Act of 2012 or the UAE Personal Data Protection Law, contact us.
7. Children
FinFlow is not directed to children under 13, and we do not knowingly collect information from children.
8. Changes to this policy
We may update this policy when FinFlow changes. The new version will be posted on this page with an updated effective date. For significant changes, we will also let you know in the app.
9. Contact
Questions or requests about this policy or your privacy:
Christian Mark Tibong, developer of FinFlow
Email: christianmark.tibong@gmail.com