Privacy Policy

At RexFlow, privacy isn't a feature we added — it's how the app is built. This policy explains, in plain language, what data we collect, what we deliberately don't, and the control you have over your information. This is a general template and does not constitute legal advice.

The short version

• We never ask for or store your bank logins, account numbers or card details.
• RexFlow stores only the income, spending and goal figures you choose to enter.
• Your data is stored on your device first (local-first) and synced securely to your account.
• Our product analytics never capture dollar amounts or personal information.
• You can delete your account — and all associated data — at any time.

Information we collect

Information you provide

To create an account we collect your email address and an optional display name. Within the app, you enter financial figures — income amounts and sources, spending entries, bucket allocations, categories, savings goals and recurring schedules. This information is yours; we use it only to provide the app's features.

Information we deliberately do not collect

We do not connect to your bank, request card numbers, or import third-party transaction feeds. There are no bank credentials to leak because we never have them.

Analytics

We use privacy-preserving product analytics to understand which features are used and where people get stuck. These analytics are designed so that no dollar amounts and no personally identifying information are ever sent — a finance app should never record money on screen. Session replay and screen recording are turned off. We identify accounts only by an anonymous identifier, never your email.

How we use your information

• To operate core features: splitting income, tracking spending and showing your health score.
• To sync your data securely across your devices.
• To send essential account communications (for example, email verification and password reset).
• To improve the app through aggregate, non-identifying usage trends.

How your data is stored and protected

RexFlow is local-first: your data lives on your device so the app works offline and stays fast. When you're online, data syncs over encrypted HTTPS connections to our backend, which is protected with modern authentication (signed tokens verified against a rotating key set), strict server-side validation, request rate limiting and hardened security headers. Money values are stored as exact integer amounts to avoid rounding errors.

Service providers

We rely on a small number of reputable infrastructure providers to run RexFlow — for example, a managed database and authentication provider, error-monitoring, and app-store distribution. These providers process data on our behalf under their own security and privacy commitments, and only to the extent needed to deliver the service.

Your rights and choices

You are in control of your data. From within the app you can edit or delete individual entries at any time, and you can delete your entire account. When you delete your account we offer two paths:

• Restorable archive: your account is deactivated and retained for a short window so you can restore it if you change your mind.
• Immediate erasure: on request, we permanently delete your account and all associated financial data right away.

Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA, including the right to access, correct, export or erase your data. To exercise any of these, email us at support@rexflow.app.

Children

RexFlow is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their data.

Changes to this policy

We may update this policy as the product evolves. When we make material changes we'll update the date above and, where appropriate, notify you in the app.

Contact

Questions about privacy? Email support@rexflow.app or visit our contact page.