Privacy Policy

FlowDash ("we", "us", or "our") operates the website flowdash.cc and its associated services. This Privacy Policy explains how we collect, use, store, and protect your information when you use FlowDash.

By using FlowDash, you agree to the practices described in this policy. If you do not agree, please discontinue use of the service.

What access we request:

FlowDash requests read-only access to your Gmail account. This means we can read your emails but cannot send, delete, modify, or compose emails on your behalf.

Specifically, we access:

• Email subjects, sender addresses, and body text — to identify bills and financial notices
• PDF and document attachments — to extract bill amounts, due dates, and account references

What we do with your Gmail data:

• Extract bill information (biller name, amount due, due date) and display it on your FlowDash Bills dashboard
• Surface upcoming payment due dates so you know what is due and when
• Load extracted bill data into your personal finance system automatically

What we do NOT do with your Gmail data:

• We do not read emails unrelated to bills, financial notices, or payment receipts
• We do not store the full raw content of your emails — only the extracted fields (biller, amount, due date)
• We do not sell, share, rent, or transfer your Gmail data to any third party
• We do not use your Gmail data to train or improve AI or machine learning models
• We do not use your Gmail data for advertising or marketing purposes
• We do not allow humans to read your emails unless you explicitly request support and provide consent

Google API Services User Data Policy:FlowDash's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Account information:

Name and email address collected when you sign up, used to create and manage your account.

Financial data you enter:

Bills, income figures, transactions, and budget data you manually input into FlowDash.

Gmail-derived data (if connected):

Extracted bill details — biller name, amount, due date — stored in your account to power your dashboard. Raw email content is processed transiently and discarded; only the extracted fields are retained.

Usage data:

Standard server logs including IP address, browser type, pages visited, and timestamps. Used for security monitoring, debugging, and improving the service.

Bank statements (if uploaded):

PDF bank statements you upload for AI analysis. These are processed to extract transaction data and are not stored permanently after analysis is complete.

• To provide and maintain the FlowDash service
• To display your bills, due dates, and financial summary on your personal dashboard
• To run the Barefoot Investor bucket calculations on your income and expenses
• To generate AI-powered SWOT analysis from uploaded bank statements
• To send important account or service notifications
• To detect and prevent fraud, abuse, or unauthorised access
• To improve the service based on aggregated, anonymised usage patterns

We do not sell your personal data. We share data only in the following limited circumstances:

• Infrastructure providers: Hosting and database services (e.g. Supabase, Cloudflare) that process data on our behalf under strict data processing agreements and with no right to use your data for their own purposes.
• AI processing: Anonymised or de-identified financial data may be sent to AI providers (Anthropic) solely to generate your analysis reports. This data is not used to train models.
• Legal obligations: If required by law, court order, or to protect the safety of users or the public.
• Business transfer: In the event of a merger or acquisition, with advance notice to you and the same privacy protections applying.

We retain your account data for as long as your account is active. If you delete your account, all associated personal data is permanently deleted within 30 days.

Gmail-derived data (extracted bill details) is deleted immediately when you disconnect your Gmail account or delete your FlowDash account.

Bank statement files uploaded for analysis are deleted from our servers immediately after processing is complete.

We use industry-standard security measures including:

• Encryption in transit (TLS 1.2+) for all data transferred between your browser and our servers
• Encryption at rest for all stored personal data
• Row-level security in our database — your data is only accessible by your account
• OAuth 2.0 for Gmail access — we never see or store your Google password

No method of transmission over the internet is 100% secure. While we take every reasonable precaution, we cannot guarantee absolute security.

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data in your account
• Request permanent deletion of your data and account
• Disconnect your Gmail account at any time (Settings page or via Google)
• Export your FlowDash data in a portable format
• Withdraw consent for optional data processing at any time

To exercise any of these rights, email us at teeninetyeight@gmail.com. We will respond within 30 days.

FlowDash is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe we have done so, contact us immediately and we will delete the information.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a revised date, and for material changes, by email. Your continued use of FlowDash after changes are posted constitutes acceptance of the revised policy.

For any questions about this Privacy Policy or your data: