Privacy Policy

Flowly is built on a simple principle: your financial data is yours. We designed the product specifically so that we cannot read it — not because we chose not to look, but because the architecture makes it technically impossible.

This policy explains what we do and don't collect, how we protect it, and what your rights are.

Data controller: Malek El-Masry, operating as Flowly (hello@flowlybudget.com)

What we collect

At purchase (via Stripe):

• Your email address — so we can send you your license key
• Your name — used to personalise the welcome email
• Payment details — handled entirely by Stripe; we never see your card number

We store your email and name alongside your license key in our database so we can help you recover your key if you lose it.

In the app:

• Your expenses, income settings, savings goals, and currency — stored encrypted (see below)
• A last_synced timestamp — so we can see when the app was last used (no content, just a date)

What we do NOT collect:

• Bank account details or credentials of any kind
• Device identifiers, IP addresses, or location data
• Advertising cookies or tracking pixels
• Usage analytics or behavioural data

End-to-end encryption of your financial data

All financial data you enter — expenses, budgets, goals, settings — is encrypted on your device before it is sent to our servers. This is called client-side encryption.

Here is how it works:

1. When you unlock the app with your license key, your browser derives a 256-bit AES-GCM encryption key from that license key using PBKDF2 (100,000 iterations, SHA-256).
2. This derived key lives only in your browser's memory. It is never written to disk, never sent to our servers, and never stored anywhere outside your device.
3. Before any data leaves your device, it is encrypted with this key. Our servers receive and store ciphertext only.
4. When you load the app, the data is downloaded as ciphertext and decrypted in your browser using the key derived from your license key.

This means: even if someone gained access to our database, they would see nothing but random-looking encrypted bytes. We, as the operators, cannot read your financial data. This is not a policy — it is a technical guarantee.

The only data readable on our servers is your email, name, license key UUID, and your last sync timestamp.

Third-party services

We use the following services to operate Flowly:

• Stripe — payment processing. Handles all card data. Subject to Stripe's Privacy Policy.
• Supabase — encrypted database storage (PostgreSQL). Hosted in the EU. Subject to Supabase's Privacy Policy.
• Cloudflare — website hosting and delivery. Processes request metadata. Subject to Cloudflare's Privacy Policy.
• Resend — transactional email delivery (license key emails only). Subject to Resend's Privacy Policy.

We do not sell, rent, or share your personal data with any other third party for advertising or marketing purposes.

Data retention

We retain your purchase email and name for as long as you hold an active license, so we can help you recover your key. Your encrypted app data is retained as long as you use the app.

To request deletion of your data, email hello@flowlybudget.com with your purchase email address. We will delete your license record and encrypted data within 14 days.

Cookies and local storage

Flowly does not use cookies. The app uses your browser's localStorage to cache your data locally for offline use. This data never leaves your device unless you are actively syncing. You can clear it at any time by clearing your browser's site data for flowlybudget.com.

Your rights

You have the right to:

• Know what data we hold about you
• Request a copy of your data
• Request correction of inaccurate data
• Request deletion of your data
• Withdraw consent at any time

To exercise any of these rights, contact hello@flowlybudget.com.

If you are located in the European Economic Area (EEA), you also have rights under GDPR. If you are in California, you have rights under CCPA. We honour these rights globally regardless of your location.

Terms of Service

By purchasing and using Flowly, you agree to these terms. Please read them — they are short and written in plain language.

License

When you purchase Flowly, you receive a personal, non-transferable, lifetime license to use the app.

• Your license works on any number of your own devices — phone, tablet, laptop — via FlowSync
• You may not share, resell, or transfer your license key to another person
• Each license is for personal use by one individual
• Your license does not expire

Payments & refunds

Flowly is sold as a one-time payment of $5 USD. There is no subscription and no recurring charge.

Refund policy: We offer a 30-day no-questions-asked refund. If Flowly isn't right for you, email hello@flowlybudget.com within 30 days of purchase and we will process a full refund. After 30 days, refunds are considered on a case-by-case basis.

All payments are processed by Stripe. Your card details are never seen or stored by us.

Acceptable use

You agree not to:

• Reverse engineer, decompile, or attempt to extract the source code of Flowly
• Resell, sublicense, or redistribute your license key
• Use Flowly for any unlawful purpose

Service availability

Flowly's cloud sync (FlowSync) is provided as a convenience feature and may occasionally be unavailable due to maintenance or third-party outages. All your data is cached locally on your device, so the app continues to work offline. We are not liable for any loss of data caused by a device failure or by clearing your browser's storage.

Limitation of liability

Flowly is provided "as is" without warranties of any kind, express or implied. We are not liable for any financial decisions made based on information displayed in the app, nor for any loss of data.

In no event shall our total liability exceed the amount you paid for your license ($5).

Changes to these terms

We may update these terms from time to time. Significant changes will be communicated via email to your purchase address. Continued use of Flowly after changes take effect constitutes acceptance of the revised terms.

Governing law

These terms are governed by the laws of New South Wales, Australia. Any disputes will be resolved in the courts of New South Wales, Australia.

Contact

For any questions about this policy, your data, or your license:

Email: hello@flowlybudget.com
Product: flowlybudget.com

We aim to respond to all enquiries within 2 business days.