FinFlow · Legal
Privacy Policy
What FinFlow stores about you, why, where it lives, and how you stay in control of it.
Effective 15 October 2026
Who we are
FinFlow (finflow.offshift.dev) is a personal finance ledger operated by Mudit Jain, who decides how your data is processed (the "Data Fiduciary" under India's DPDP Act, 2023). Contact: finflow@offshift.dev or the form at finflow.offshift.dev/contact.
What we collect
Account details: your name, email, and — for password accounts — a username and a securely hashed password (never the password itself). Your records: ledgers, entries (amount, date, type, remarks, category), parties and categories you create or import. Statement uploads: a record of each upload (file name, a fingerprint of the file, row count, how it was read) — the PDF itself is deleted after reading. Technical data: sign-in timestamps and standard server logs needed to keep the service running and secure.
What we never collect
Full card numbers, CVVs, net-banking or UPI credentials, your Gmail or any other Google data beyond your name, email and profile picture, analytics or advertising identifiers.
Google user data
If you choose “Continue with Google”, FinFlow receives from Google only your name, email address, profile picture and Google account ID (the openid, email and profile scopes). We use them only to create your account, sign you in and show your name. They are stored with your account in Supabase (Tokyo, Japan). They are never sold, never used for advertising, and never shared with anyone except the service providers listed below that run FinFlow; no person reads them unless you ask for support. They are deleted when you delete your account, and you can revoke FinFlow’s access to your Google account at any time at myaccount.google.com/permissions. FinFlow’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How we use it
Only to run FinFlow for you: to sign you in, keep your ledgers, read the statements you upload, send you sign-in and account emails, and protect the service from abuse. No selling, no advertising, no profiling.
Legal basis
Your consent, which you give when you accept the Terms. You can withdraw it at any time by deleting your account; that stops all further processing.
Statement PDFs
An uploaded PDF goes to private storage that only FinFlow’s server can read, is parsed, and is deleted right after — it is kept a little longer only while waiting for you to type its password. FinFlow reads statements with its own parser; they are never sent to an AI service.
Service providers
FinFlow relies on: Supabase (database, sign-in and file storage — Tokyo, Japan); Vercel (hosting the app and its server — Tokyo, with app files cached worldwide); Resend (sending sign-in and account emails); Google (Google sign-in, when you choose it); Cloudflare Turnstile (a bot check on sign-up forms). Each processes data only to provide its service to FinFlow.
Where your data lives
In Tokyo, Japan — outside India. It is encrypted in transit (HTTPS) and protected by per-account access controls; nobody but you can see your ledgers through the app.
How we protect it
Everything travels over HTTPS. Your records sit in a private database that only FinFlow’s server can reach, and every request is checked against your signed-in account, so no one else can see your ledgers through the app. Passwords are hashed by Supabase Auth and never stored or seen in plain text. Statement PDFs are deleted right after they are read. There is no staff access to your records.
How long we keep it
For as long as you keep your account. Deleting your account erases your ledgers, entries, parties, categories, upload records and sign-in identity straight away; encrypted database backups that may still contain it are overwritten within 14 days.
Your rights
You can access, correct, export and erase your data yourself: edit any record in the app, download everything from Profile → Your data, or delete your account there. For anything else — or a grievance — write to finflow@offshift.dev or use the form at finflow.offshift.dev/contact; we aim to respond within 7 days.
Children
FinFlow is for people aged 18 and over. We do not knowingly hold data about anyone younger.
Changes
If this policy changes in a way that affects you, the date below changes and the Terms you accept at sign-in are re-versioned.
Contact
finflow@offshift.dev · finflow.offshift.dev/contact