Privacy policy

The short version

• Flow saves your entries on your device first and syncs them to our server, so they are safe and on your other devices.
• Flow never asks for access to your bank. Bank SMS you paste are read on your device; the message is never uploaded.
• No ads, no analytics, no trackers, no third-party scripts.
• You can export everything whenever you like, and deleting your account removes it from our server at once.

What we keep on our server

• Your account: your email address and a password hash (made with Argon2id; we never keep the password itself) if you add them, your language, whether your email is confirmed, and when the account was created and last used. An account started without signing up has no email or password.
• What you log in Flow: entries (amount, date and time, category, vendor, tags, note, how it was added, whether it’s an estimate), categories, vendors with any website you set, tags, budgets, bills and installments, no-spend days, dismissed insights and your settings. When you delete an entry, a deleted record stays for 400 days so your other devices remove it too, then it is removed for good.
• Sign-ins: for each device you sign in on, a hashed session token, the browser’s name and version, the IP address, and when the session started, was last used and expires (90 days after last use unless the operator sets another length).
• Activity days: the days your account synced, which we count to know how many people use Flow.
• Notifications: if you allow them, your browser’s push address and keys, and a log of which reminders were sent and when, so none is sent twice.
• Plans and payments: your plan, its status and end date; for Stripe, your customer and subscription ids; for each payment, the provider, its reference, amount, currency and status; for Zarinpal, the card number with all but the first six and last four digits removed.
• Email links: sign-in help and confirmation links are stored only as hashes, and so are the unsubscribe links in the weekly digest.

What stays on your device

• A full copy of your Flow data lives in your browser’s storage, with any changes still waiting to sync, so Flow works offline.
• Bank SMS: the text is read on the device and kept only in memory while you review it. Only the entry you save is synced (with the shop or bank name as its note when no vendor matched). Text you share into the installed app waits in a small inbox on the device until Flow reads it.
• Your theme, the step you reached while starting, and the month you’re looking at are kept in the browser too.

Cookies

Flow sets three cookies, all needed for it to work: flow_session keeps you signed in, flow_guest lets you return to an account you set aside when you logged in to another, and flow_locale remembers your language. There are no advertising or tracking cookies.

Who helps us run Flow

• Hosting: our server and database run on infrastructure chosen by Mehdi Teymorian. The web server in front of Flow may keep short access logs (IP address, the page requested with any sign-in or email-link codes removed, the browser) to keep the service running and secure. Flow’s own logs record your account id but not your IP address, amounts, notes or tokens.
• Email provider: sends confirmation and password emails, trial and plan reminders, and the weekly digest if you turn it on (it includes your week’s totals).
• Stripe, for international cards: gets an internal account id, and your email once you’ve confirmed it, to set up your payments. You type your card on Stripe’s page; we never see it.
• Zarinpal, for Iranian bank cards: gets the amount, a short description, an order id, and your email once you’ve confirmed it. You type your card on Zarinpal’s page.
• Push services run by your browser’s maker (for example Google, Apple or Mozilla): deliver reminders. Messages are encrypted so they can’t read them.
• Vendor websites: if you give a vendor a website, our server fetches that site’s public icon. The site sees our server, not you. Icons are cached by website, not by person.

What we don’t do

We don’t sell or share your data for advertising, we don’t build profiles, and we don’t connect to your bank. Pages load nothing from other websites.

How long we keep things

• Your account and everything in it: until you delete it.
• An account started without signing up (no email or password) and unused for 180 days is deleted with everything in it, since nobody could sign back in to it.
• Deleted entries: removed for good 400 days after you delete them.
• Records of sent reminders and of payment providers’ notices: 90 days.
• Sign-ins: until they expire or you sign out. Expired sessions are deleted every day.
• Email links: a password link works for an hour and a confirmation link for seven days. Used and expired links are deleted a week later.
• Push addresses: removed when you turn notifications off, when your browser says the address is gone, or after repeated failed deliveries.
• Backups: the operator may keep database backups for a limited time to recover from failures.

Your choices

• Take it with you: Settings → Data exports a CSV or a full backup, made on your device, on every plan.
• Change anything: every entry, category and setting can be edited in the app.
• Delete your account: Settings → Account. It happens at once: your account and all your Flow data are removed from our database, any Stripe subscription is cancelled on the spot (the running period isn’t refunded) and your customer record at Stripe is deleted, and this device’s copy is wiped. What remains: backups for a limited time, logs that may contain your account id, and the payment providers’ own records, which they keep under their policies.
• Stop email: the weekly digest has an unsubscribe link and a switch in Settings. Account emails (confirmation, password, plan reminders) can’t be turned off while you have an account.
• Ask us: write to support@flowapp.ir for a copy of your data, a correction, or anything else about your privacy.

Security

Connections are encrypted, passwords and tokens are stored only as hashes, pages run under a strict content security policy, and sign-in attempts are rate-limited. No system is perfect; if you find a problem, please tell us at support@flowapp.ir.

Changes to this policy

When this policy changes we update this page and the date at the top. If a change matters for how your data is used, we’ll tell you in the app or by email before it applies.