How Flo handles your data

Effective September 22, 2026 · Updated October 21, 2026 · Applies to floapp.app, floforecast.com, the Flo Forecast app and the Flo web app at app.floapp.app

This policy explains what JustJoshin LLC ("we", "us") collects when you use Flo, why, and what control you have over it. It's written to be read, not skimmed; if anything is unclear, email support@floapp.app.

The short version

• We collect the minimum needed to forecast your cash flow: an email address to sign you in, and, only if you choose to link a bank or Apple Wallet, your account balances and transactions, read-only, through Plaid or from Wallet on your iPhone.
• We never see or store your bank username or password. Plaid handles that on its own screen.
• We don't sell your data, and we don't use it for advertising.
• If you join the early-access list on this website, we keep your email only to send your beta invitation.
• You can disconnect your bank or delete your account and all of its data from inside the app at any time.

This website

floapp.app and floforecast.com are static pages, hosted by GitHub Pages. They set no cookies, run no analytics, and load nothing from anyone else. They collect two things, and only if you choose to give them:

• The early-access list. If you join it, we store your email address, the page you signed up from, and when. We use it only to send you a TestFlight invitation and, when Flo launches, one note that it's available. We don't add you to a newsletter, and we don't share or sell the list. The list is stored in Supabase in the United States, which keeps standard request logs (including IP address) for security. To be taken off the list at any time, email support@floapp.app and we'll delete your address.
• Email. If you email us, from here or with Send feedback in the app (which fills in the app version, your phone's model and your Flo email so we can look into it), we keep the message so we can reply.

The web app. app.floapp.app is Flo itself in a browser, and everything under "The app" below applies to it. To keep you signed in, it saves your sign-in session, and a copy of the data it last loaded so pages open quickly, in your browser's storage for that tab only. Both are gone when you close the tab or sign out. Flo sets no advertising or tracking cookies there, runs no analytics, and sends no crash reports from the web app. If you buy a subscription on the web, the checkout is provided by Stripe, which may set cookies of its own to prevent fraud.

The app: what we collect and why

Account information. When you create an account we store your email address and, if you use Sign in with Apple, the identifier Apple provides (which may be a private relay address) and, if Apple shares it, your name. We use it to sign you in, send verification and password-reset messages and security notices (for example, when your password changes or two-step sign-in is turned on or off), and contact you about your account. We don't send marketing email.

Two-step sign-in (optional). If you sign in with a password, you can add a second step: a 6-digit code from your phone's Passwords app or an authenticator app. If you turn it on, the setup key that links your authenticator to your account is stored with your account. The codes are made on your own device, and we never see or store them. If you lose your authenticator you can ask for a reset, which takes effect after 24 hours; we email and notify you when one is requested so you can cancel it. Turning two-step sign-in off deletes the setup key.

App lock (optional). If you turn on Lock Flo when I leave it, your iPhone checks your Face ID or passcode. Flo is only told whether it matched; it never receives your face data or passcode.

Bank data, if you link an account. Linking is optional. If you do, you sign in to your bank on Plaid's screen; Plaid gives us a read-only token that lets us retrieve, for each account you choose:

• its name, type, the last four digits of its number, the bank's name, and its current and available balance;
• its transactions: date, the merchant's name and the bank's own description, amount, pending status, Plaid's category for it, whether it was online or in person, and the merchant's logo and website;
• for credit cards and loans: the credit limit, interest rate, statement balance and date, minimum payment, due date, last payment, interest charged, and whether a payment is overdue; for loans, also the amount first borrowed, the date it started and the date it's due to be paid off;
• for investment accounts (a 401k, an IRA, a brokerage account): the activity inside them, such as contributions, purchases, sales, dividends and fees, with the name and ticker of the holding involved. Flo also keeps a daily record of each linked account's balance, so it can show how an account has changed over time.

We use this to build your forecast, match transactions to the bills and income you've set up, and show you your activity. We don't receive your full account or routing numbers, and we cannot initiate payments, transfers, or withdrawals. Plaid's own handling of your data is described in the Plaid End User Privacy Policy.

By linking an account, you give JustJoshin LLC and Plaid permission to act on your behalf to access and send us your financial information from your bank, and you agree to Plaid transferring, storing, and processing that information in accordance with the Plaid End User Privacy Policy.

Apple Wallet, if you link it. On iPhone you can link Apple Card, Apple Cash or Apple Savings, with Apple's permission. From Wallet on that iPhone, Flo reads the accounts you choose to share: account names, balances, credit limit, due date, minimum payment, and up to the last 12 months of transactions (date, merchant, description, amount, merchant category and pending status). Flo uses it like bank data: for your forecast, budget and credit card payment estimates, in the app, on the web and in notifications. It is never sold, shared with advertisers or used for marketing. Wallet updates when Flo opens on that iPhone. If you sign in with a password, linking Wallet needs two-step sign-in, and turning two-step off removes your Wallet accounts from Flo. In a household, Wallet accounts show to everyone in it, like a bank's, and only the person who shared them can stop sharing.

What you enter. Bills, income, categories, groups, one-off items, notes, your balance floor, account details you add (such as a card's interest rate or when a loan started), and, if you track by hand instead of linking a bank, the balance and transactions you type in. For an investment account you track by hand, that includes each total you enter when you update it, kept so Flo can show how the account has changed, and, if money goes in from your paycheck, how much you put in each paycheck and your employer's match.

Smarter sorting (optional AI). Off unless you turn it on, and Flo asks first. When it's on, to name unfamiliar businesses and suggest categories and budget amounts, Flo sends Anthropic (the maker of Claude) the business name and category as your bank or Apple Wallet wrote them, amounts, how often a charge repeats, and your category and group names. It never sends your email, account numbers or balances, payments to or from people, or transfers, and your name is removed first if your sign-in shared it. Anthropic doesn't train its models on this data and normally deletes it within 30 days. Every suggestion waits for you to accept it. You can turn Smarter sorting off at any time in Settings.

Households (optional). You can invite other people to share your budget. If you do, everyone in the household sees the same thing: every account and its balance, every transaction, the categories, the bills and the plan. Each person keeps their own sign-in and password; nothing is shared until someone enters an invite code on their own phone, and the invite screen says what they will see before they join. A bank connection stays with the person who linked it, and only they can change or remove it. A member can leave at any time from Settings, and the person who made the household can remove a member; whoever leaves takes the banks they linked and that history with them, and the rest stays with the household.

Subscriptions. Linking a bank needs a subscription, bought through Apple in the iPhone app or by card on the web. Apple handles payment in the app. On the web, payment is handled by Stripe, which receives your card details and the email address, name and billing address its checkout asks for. Either way, we never see your card number. To know what you've bought, Flo uses RevenueCat, which receives Apple's receipt or Stripe's payment confirmation, your Flo user ID (a random identifier, not your email), and the app version and device type. RevenueCat stores this in the United States under its own privacy policy and does not sell it. We keep only whether a subscription is active and until when. Tracking by hand never needs a subscription.

Notifications, if you allow them. If you turn on notifications, we store your phone's push token (an address for delivering notifications to that device, not a phone number or identifier of you) so our server can send them. Notifications are delivered through Expo's push service and Apple Push Notification service. They say that your cash flow needs a look, a card payment is due, a bank stopped syncing, Apple Wallet data is about to be removed, or something changed in your account's security, and never include an amount. Turning notifications off in Settings removes the token.

Crash reports. If the app crashes or runs into an error, a report is sent to Sentry so we can fix it: the error and where in the code it happened, the app version, your device model and OS version, your Flo account's ID (a random identifier, not your name or email), so we can tell crashes apart and look into one you tell us about, and a short trail of what the app did just before: which screens it showed, taps on the screen, and which of Flo's servers it called and whether each call worked, but not what was asked for or what came back. It does not include your name, your email, your IP address, or anything from your accounts. Before anything is sent, the text of the report is stripped of anything shaped like an amount of money, an email address, a long number, or an access token, because the wording of an error is written by whatever failed, and can carry those without anyone having intended it. Flo records no analytics, no screen recordings, and no session replay. You can turn crash reports off in Settings, and nothing is sent from then on.

Exports, if you ask for them. On iPhone, Export my data in Settings makes the file on your phone and emails it to your account's email address through Resend; we don't keep a copy. On the web it downloads straight to your computer. Once it's in your email or on your computer, it's yours to keep or delete.

What we don't do

• We don't sell, rent, or share your personal or financial data with advertisers or data brokers.
• We don't use your data to train machine-learning models.
• We don't track you across other apps or websites. So a browser's Do Not Track or Global Privacy Control signal has nothing to switch off; we honor both anyway.
• We use your financial data only to run Flo for you.

Who we share it with

We share your data only:

• with the service providers listed below, to run Flo;
• with the people in your household, if you make or join one;
• where you ask us to, for example with Plaid when you link a bank, or with your own inbox when you email yourself an export;
• when the law requires it, such as a valid subpoena or court order, or when it's needed to protect someone from harm or Flo from fraud;
• with a new owner, if Flo or JustJoshin LLC is ever sold or merged. They must keep this policy's promises for the data collected under it, and we'd tell you before that happened.

Where your data lives and who can reach it

Your data is stored in a database hosted by Supabase in the United States, encrypted in transit and at rest. Access is restricted by database-level rules so that your data is readable only by you and, if you have one, the people in your household. Plaid access tokens are kept in a separate, further-restricted store the app itself cannot read. A small number of service providers process data on our behalf solely to run Flo: Supabase (hosting and authentication), Plaid (bank connectivity), Apple (app distribution, Sign in with Apple, payments and notification delivery), Expo (app updates, web app hosting and notification delivery), RevenueCat (subscription status), Stripe (card payments on the web), Anthropic (Smarter sorting, only if you turn it on), Resend (sign-in and account emails, and the exports you ask to have emailed), Sentry (crash reports), and GitHub (this website's hosting). Each is bound by its own terms to use the data only to provide that service. Supabase and GitHub keep standard request logs, including IP addresses, for a limited time for security.

No system is perfectly secure. If a breach ever affects your data, we'll tell you promptly and as the law requires.

On your phone. Flo keeps a copy of the last data it loaded on your phone, so the app still opens with no signal. It's in the app's own storage, protected by your phone's encryption and passcode like everything else on the device, and it's removed when you sign out or delete the app.

How long we keep it

For as long as your account exists. When you delete your account, we revoke the Plaid connection and delete your account record, bank data, and everything you entered within 30 days; backups age out within a further 30 days. If you disconnect a bank without deleting your account, the transactions already imported stay in your account until you delete them or the account. If your subscription ends, your banks stop syncing right away and are disconnected at Plaid 7 days later; the balances and transactions already imported stay, and you can link again any time. Apple Wallet data is kept only while it stays current. If you turn sharing off or stop sharing an account, Flo deletes what came from Wallet the next time it opens on that iPhone. If your Wallet accounts haven't updated in 30 days, for example because Flo was removed from that iPhone, Flo deletes that data, after telling you a week before.

Your choices and rights

• Disconnect a bank at any time from Settings.
• Stop sharing Apple Wallet at any time in your iPhone's Settings, under Privacy & Security, then Wallet.
• Turn Smarter sorting or notifications off at any time from Settings.
• Delete your account from Settings; this is permanent. If you can't get into the app, email us and we'll do it for you.
• Export your data yourself from Settings, under Export my data: a snapshot report as a PDF, or everything as spreadsheets.
• Correct your data, or ask what we hold about you, by emailing support@floapp.app. We'll respond within 30 days and won't charge for it.

To protect your account, we may ask you to confirm a request from your account's email address.

Residents of California and other states with privacy laws have the rights those laws provide, including to know, delete, and correct; we honor those requests for everyone, wherever you live, and we don't discriminate for exercising them. We don't "sell" or "share" personal information as those terms are defined in the California Consumer Privacy Act.

Who Flo is for

Flo is for adults 18 and over, and it's made for the United States: your data is stored and processed there. It isn't directed to children, and we don't knowingly collect data from anyone under 18. If you believe a child has created an account, email us and we'll delete it.

Changes

We'll post any change here and update the date above. If a change matters, the app will ask you to acknowledge the updated policy before you carry on. Earlier versions are available on request.

Contact

JustJoshin LLC · Greenville, South Carolina · support@floapp.app