Privacy Policy

This Privacy Policy explains how FLOW BUDGETING APP, a Nova Scotia sole proprietorship (NS Business Number 754968378NS0001) ("Flow," "we," "us," or "our") collects, uses, and protects information when you use the Flow application (the "Service"), in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). By using the Service, you agree to this Policy.

1. Information We Collect

We collect: (a) account information you provide, such as your email address and password; (b) budgeting data you create, such as categories, budgets, and income; and (c) financial-account information retrieved through Plaid when you connect a bank, such as balances, transactions, and institution details. We may also collect limited technical data needed to operate the Service.

2. How We Use Your Information

We use your information to provide and improve the Service — to display your transactions and budgets, generate spending insights, authenticate you, secure your account, and respond to support requests. We do not use your financial data for advertising.

3. Bank Data and Plaid

When you connect a financial account, Plaid Inc. accesses your data from your financial institution on your behalf and provides it to us. Plaid’s handling of your information is governed by Plaid’s own privacy policy. We receive only the data needed to provide the Service and do not store your bank login credentials — those are handled by Plaid.

4. How We Store and Protect Your Information

Your data is stored using our infrastructure provider, Supabase, and protected by access controls such as row-level security and encryption in transit. Your information may be stored and processed outside Canada, including in the United States, where it may be subject to the laws of that jurisdiction. While we take reasonable measures to protect your information, no method of storage or transmission is completely secure, and we cannot guarantee absolute security.

5. How We Share Information

We do not sell your personal information. We share information only with service providers that help us operate the Service (such as Plaid and Supabase) under appropriate confidentiality obligations, when required by law, to protect our rights, or in connection with a business transfer.

6. Data Retention and Deletion

We retain your information for as long as your account is active or as needed to provide the Service. You can permanently delete your account and all associated data in the app (Profile → Login & Security → Delete Account) or by following the steps on our account deletion page. Some information may be retained as required by law.

7. Your Privacy Rights Under Canadian Law

Under PIPEDA, you have the right to access the personal information we hold about you, request that we correct it, and withdraw your consent to our use of it (subject to legal or contractual restrictions) — including by disconnecting a linked financial account at any time within the app. To exercise these rights, contact our privacy contact at venomghalactic@gmail.com. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada. If you are a resident of Quebec, you have equivalent rights under Quebec's Act Respecting the Protection of Personal Information in the Private Sector and may complain to the Commission d'accès à l'information du Québec.

8. Breach Notification

If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and report the breach to the Privacy Commissioner of Canada, as required by PIPEDA.

9. Children’s Privacy

The Service is not directed to individuals under 18, and we do not knowingly collect information from them. If you believe a minor has provided us information, contact us and we will delete it.

10. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will take reasonable steps to notify you. The "Last updated" date above indicates when the Policy was last revised.

11. Contact

If you have questions about this Policy or your data, or wish to exercise your privacy rights, contact our privacy officer at venomghalactic@gmail.com.