Privacy Policy

1. Information We Collect

When you create a VeloFlow account we collect your name and email address. When you link a bank account via Plaid, VeloFlow receives read-only access to your account balances, transactions, and investment holdings. We never receive your bank login credentials — those are handled entirely by Plaid.

If you use Sign in with Apple in our iPhone app, Apple shares your name (the first time only) and an email address with us. If you choose Hide My Email, that address is a private relay from Apple that forwards to you, and we never see your real address. We also keep a token from Apple for one purpose: when you delete your VeloFlow account, we use it to tell Apple to remove VeloFlow from your Apple ID's Sign in with Apple settings.

We also collect:

• Device and browser information for security and fraud prevention
• Usage data (pages visited, features used) to improve the product
• Passkey / biometric credential identifiers (not biometric data itself)
• If you arrived through one of our marketing links, which campaign it came from (for example, the post and where it was shared), so we can tell which of our posts lead people to VeloFlow and to Pro. It is only ever reported as totals per campaign, is never sold, and is deleted with your account or when you turn off analytics in Settings → Privacy.

2. How We Use Your Information

• To display your net worth, transactions, and investment portfolio
• To generate AI-powered financial insights and recommendations
• To process payments for Pro subscriptions via Stripe
• To send the notifications you turn on in Settings, such as the Weekly Report, AI Nudges and Market Alerts. For Market Alerts we keep the last price we saw for each of your holdings, so the next day's price has something to compare with. Turning Market Alerts off, or deleting your account, deletes those prices.
• To send up to three emails in your first few days that help you finish setting up your account, if you signed up outside the European Economic Area, the UK and Switzerland. They stop as soon as you add an account, and every one has a one-tap unsubscribe link.
• To improve VeloFlow's features and performance

3. Data Sharing

We do not sell your personal data. We share data only with:

• Plaid — to retrieve bank account data on your behalf
• Stripe — to process subscription payments
• Google (Gemini) — to generate the AI insights you see in the app, we send a limited financial summary: balances, category spending totals, APRs, and the names of bills or holdings. We never send your name, email address, account numbers, or bank credentials. This data is used solely to produce your requested insight — it is not used for advertising, not sold, and not used to build user profiles. AI-generated insights are educational only and are not financial, investment, or tax advice.
• Google Analytics — to understand which features are used and where people get stuck, so we know what to improve. We send screen names and interaction events only. Page addresses are stripped of any query string before they are sent, and we never send your name, email address, account numbers, balances, or transaction data. Advertising features and Google Signals are switched off, so this data is not used to build an advertising profile of you. You can turn this off entirely: decline it in the cookie banner, or switch it off at any time in Settings → Privacy, and nothing is sent and no analytics cookie is set. See Cookies, below.
• Sentry — to receive crash and error reports so we can fix faults we would otherwise never hear about. Reports contain the error, the screen it happened on, and your user ID; request bodies, cookies and access tokens are stripped before sending. You can turn this off in Settings → Privacy.
• Resend — to deliver email: password resets, security notices, a copy of any feedback you send us, and the set-up emails described in section 2. We send your email address, your first name for the greeting, and the contents of that message, nothing else. Resend does not use it for its own purposes.
• Google (Firebase Cloud Messaging) — to deliver push notifications to Android devices and browsers, if you turn them on. We send a device registration token and the notification text. The token identifies your device, not you, and it is deleted when you turn notifications off or delete your account.
• Apple (Apple Push Notification service) — to deliver push notifications to iPhones and iPads, on the same terms: a device token and the notification text, nothing else. With either service, some notifications you can turn on carry financial details in their text: the Weekly Report (last week's spending total and largest category), AI Nudges (an estimated checking balance and the bills due), and Market Alerts (a holding's symbol, how far it moved, and the position's value). Your device may show that text on the lock screen unless you hide notification previews in your device settings.
• Vercel / Supabase — infrastructure providers that host and store your data under strict data processing agreements

4. Data Retention

We retain your data for as long as your account is active. When you delete your account, all personal data, linked bank connections, transaction history, and financial data are permanently deleted within 30 days. Stripe billing records may be retained as required by law.

5. Security

We use industry-standard security practices including:

• Encryption in transit: All data is transmitted over HTTPS/TLS
• Encryption at rest: Plaid access tokens are encrypted using AES-256-GCM before being stored in our database. The encryption key is stored separately from the data.
• Password security: Passwords are hashed using bcrypt and never stored in plaintext
• Session security: Sessions use httpOnly, Secure, SameSite cookies
• Security headers: Our web app enforces Content Security Policy, HSTS, X-Frame-Options, and other OWASP-recommended headers
• Bank credentials: Never stored by VeloFlow — handled entirely by Plaid's secure infrastructure
• Passkey authentication: Biometric credential identifiers use WebAuthn — your raw biometric data never leaves your device

6. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Delete your account and all associated data (via Settings → Privacy → Delete Account)
• Unlink your bank accounts at any time (via Settings → Linked Accounts)
• Opt out of analytics (via the cookie banner or Settings → Privacy) and crash reporting (via Settings → Privacy)

7. Mobile App Permissions

The VeloFlow mobile apps for Android and iOS request the following permissions. Both apps are shells around the same VeloFlow web app, so the data they handle is identical — only the platform names for each permission differ.

Android

• Internet and network state — required to load the VeloFlow app and communicate with our servers
• Biometric / Fingerprint — used only for local on-device authentication. Your biometric data is never transmitted to VeloFlow servers. Only a cryptographic credential identifier is stored.
• Notifications — used to deliver the alerts you turn on in Settings. You can disable them at any time in Settings or in your device settings.
• Vibration — used for haptic feedback within the app
• Run at startup — used only to restore your scheduled notifications after the device restarts

iOS

• Face ID / Touch ID — used only for local on-device authentication. Your biometric data is never transmitted to VeloFlow servers. Only a cryptographic credential identifier is stored.
• Notifications — used to deliver the alerts you turn on in Settings, including while the app is in the background. You can disable them at any time in Settings or in your device settings.

Neither app requests access to your location, contacts, SMS messages, or call logs.

Microphone — used only by the optional voice-input feature on the Wearables screen. Your device asks for permission the first time you use it, the microphone is active only while that feature is running, and VeloFlow does not record or store any audio. Speech is transcribed by your browser or device's own speech-recognition service, which may process the audio on the vendor's servers; the resulting text is what VeloFlow receives.

8. Children's Privacy

VeloFlow is intended for users who are at least 18 years of age. We do not knowingly collect personal information from minors. If you are under 18, do not use VeloFlow.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notification. Continued use of VeloFlow after changes constitutes acceptance of the updated policy.

11. Contact

VeloFlow is operated by Obsidian & Ivory LLC, a limited liability company formed in Arizona, which is the data controller for the information described in this policy.

For privacy questions or data requests, contact us at support@velo-flow.io.