Privacy Policy

Last Updated: September 2026

1. Information We Collect

1.1 Information You Provide

• Account Information: When you sign up using Google OAuth, we collect your name, email address, and profile information from your Google account.
• Bank Connection Data: When you connect your bank accounts through Plaid, we receive transaction history, account balances, and account metadata.
• User-Generated Content: Custom categories, tags, notes, and budget settings you create within the application.

1.2 Automatically Collected Information

• Usage Data: Information about how you interact with our service (features used, pages visited).
• Device Information: Browser type, operating system, IP address for security purposes.
• Cookies: Session cookies to maintain your login state.

2. How We Use Your Information

We use the information we collect to:

• Provide and maintain our personal finance management service
• Automatically categorize your transactions by matching merchant names and descriptions against categories you have chosen previously
• Generate spending insights, trends, and budget tracking
• Sync transaction data from your connected bank accounts
• Communicate with you about service updates or issues
• Improve our service through analytics and user feedback
• Ensure security and prevent fraud or unauthorized access

3. How We Share Your Information

3.1 Third-Party Service Providers

• Plaid: We use Plaid to securely connect to your bank accounts. Plaid has read-only access to your transaction data. See Plaid's Privacy Policy.
• Google OAuth: Used for authentication. See Google's Privacy Policy.
• Hosting Providers: Our infrastructure providers may host your data but do not have access to view it.

3.2 What We Don't Do

3.3 Legal Requirements

We may disclose your information if required by law, such as:

• In response to valid legal process (subpoena, court order)
• To protect the rights, property, or safety of Coin Flow, our users, or others
• To detect, prevent, or address fraud or security issues

4. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: All data is encrypted in transit (HTTPS/TLS) and at rest (AES-256)
• No Stored Credentials: We never store your bank login credentials - Plaid handles authentication
• Read-Only Access: We only have read-only access to your bank accounts - we cannot move money
• Access Controls: User data is isolated with strict access controls
• Regular Security Audits: We perform regular security assessments

5. Data Retention

• Active Accounts: We retain your data for as long as your account is active
• Inactive Accounts: If you haven't logged in for 2 years, we may email you before deleting your account
• Deleted Accounts: Deleting your account schedules it for removal after a 14-day grace period, during which it keeps working and the deletion can be cancelled. Once that passes, all of your data is permanently removed, including any uploaded files and your bank connections at Plaid.
• Legal Requirements: Some data may be retained longer if required by law

6. Your Rights and Choices

You have the following rights regarding your personal data:

6.1 Access and Export

• View all your data within the application
• Export your transaction data as CSV at any time
• Request a complete copy of your data

6.2 Correction and Deletion

• Update or correct your information in account settings
• Delete individual transactions, categories, or budgets
• Delete your entire account and all associated data, from Settings → Delete account — or by emailing mattraydub+privacy@gmail.com if you would rather we did it

6.3 Disconnect Bank Accounts

• Disconnect any bank account at any time
• This revokes Coin Flow's access to that account through Plaid
• Historical transaction data remains until you delete it

7. GDPR Compliance (EU Users)

If you're located in the European Economic Area (EEA), you have additional rights:

• Right to Access: Request what personal data we have about you
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing of your personal data
• Right to Restriction: Request restriction of processing

8. Children's Privacy

Coin Flow is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

9. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure that such transfers comply with applicable data protection laws and that appropriate safeguards are in place.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the application. Your continued use of Coin Flow after changes take effect constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

---