Privacy Policy

FundsFlow is a private personal ledger for recording money you send, receive, or pass along within your own circle of friends. It is not a payments app, a bank, a lending product, or an investment product — it does not move money on your behalf. This policy explains what information the app and its backend collect, why, and how it is protected.

• Phone number — used solely to verify your identity via Firebase Authentication OTP sign-in. We never see or store your OTP code.
• Friend records you create — names, optional phone numbers, and optional notes for the people in your ledger.
• Transaction records you create — sender, receiver, amount, date, optional note, and optional reference ID.
• Attachments you choose to upload — receipt images or PDF files attached to a transaction.

• We do not access your contacts, SMS, call logs, or any data outside what you manually enter into the app.
• We do not collect location data.
• We do not use advertising identifiers or run ads.

Your data exists only to power your own ledger. It is never shared with the friends you record transactions about, never sold, and never used for advertising. Every request to our backend is authenticated and scoped to your account — there is no code path where one user's ledger is visible to another user.

• Firebase Authentication (Google) — verifies your phone number and issues your sign-in session. We do not store your OTP.
• Supabase PostgreSQL — stores your friends, transactions, and account records, behind a backend that authenticates every request.
• Supabase Storage — stores attachment files in a private bucket. Files are never public; access requires a short-lived signed link generated on demand.

These are the only third parties that process your data, and each is used strictly as infrastructure — none of them has independent access to use your data for their own purposes.

Your data is retained for as long as your account exists. You can permanently delete your account and all associated data at any time from within the app, or by following the steps on our account deletion page. Deletion is immediate and permanent — we do not retain backups of deleted accounts.

FundsFlow is not directed at children and is not intended for use by anyone under the age required by applicable law to manage their own account.

If this policy changes, the "last updated" date above will change with it. Material changes will be reflected here before they take effect.

Questions about this policy or your data can be sent to contact@battutheboss.com.