Our commitment to your privacy
Your financial data is private and belongs to you. We never sell your data, and we're transparent about what we collect and why. You can export your data at any time, and delete your account whenever you want.
1. Information we collect
1.1 Information you provide
- Account information: when you sign up with Google, we receive your name, email address and profile picture from your Google account.
- Passkeys: if you add a passkey, we store its public key and a name for it. Your fingerprint, face or device PIN never leaves your device.
- Bank connection data: when you connect your bank accounts through Plaid, we receive transaction history, account balances and account metadata.
- Bitcoin wallets: the extended public keys (xpub, ypub or zpub) you add, the addresses derived from them, and their transactions, along with any transactions you enter or import.
- User-generated content: categories, tags, notes, attachments such as receipts, and budget settings you create within the application.
1.2 Automatically collected information
- Device information: the browser, operating system and IP address you signed in from, kept with your session for security purposes. We don't use analytics or tracking tools.
- Cookies: session cookies to keep you signed in, and a cookie that remembers display preferences (such as BTC or sats).
2. How we use your information
We use the information we collect to:
- Provide and maintain our personal finance management service
- Automatically categorize your transactions by matching merchant names and descriptions against categories you have chosen previously
- Generate spending insights, trends, budget tracking and bitcoin tax reports
- Sync transaction data from your connected bank accounts and bitcoin wallets
- Communicate with you about service updates or issues
- Improve our service through your feedback
- Ensure security and prevent fraud or unauthorized access
3. How we share your information
3.1 Third-party service providers
- Plaid: we use Plaid to connect to your bank accounts. Plaid has read-only access to your transaction data. See Plaid's Privacy Policy.
- Google: used for sign-in. See Google's Privacy Policy.
- Electrum servers: to sync a bitcoin wallet, its addresses are sent to an Electrum server. You can use your own; we only use a shared server after you agree to it.
- CoinGecko: we look up historical and current bitcoin prices. Nothing about you or your wallets is sent.
- AI assistants you connect: an assistant you approve (for example Claude) can read and change your transactions, categories, tags and budgets on your behalf, under its own provider's privacy policy. You can disconnect it at any time from your Account page.
- Hosting providers: our infrastructure providers may host your data but do not have access to view it.
3.2 What we don't do
- We never sell your data to advertisers or third parties
- We never share your financial data for marketing purposes
- We never use your data to train AI models for other companies
3.3 Legal requirements
We may disclose your information if required by law, such as:
- In response to valid legal process (subpoena, court order)
- To protect the rights, property, or safety of CoinFlow, our users, or others
- To detect, prevent, or address fraud or security issues
4. Data security
We implement industry-standard security measures to protect your data:
- Encryption: all data is encrypted in transit (HTTPS/TLS), and our off-site backups are encrypted before they leave our server
- No stored bank credentials: we never store your bank login credentials; Plaid handles authentication
- Read-only access: we only have read-only access to your bank accounts and bitcoin wallets; we cannot move money
- Access controls: user data is isolated with strict access controls
5. Data retention
- Active accounts: we retain your data for as long as your account is active
- Inactive accounts: if you haven't signed in for 2 years, we may email you before deleting your account
- Deleted accounts: deleting your account schedules it for removal after a 14-day grace period, during which it keeps working and the deletion can be cancelled. Once that passes, all of your data is permanently removed, including any uploaded files and your bank connections at Plaid.
- Legal requirements: some data may be retained longer if required by law
6. Your rights and choices
6.1 Access and export
- View all your data within the application
- Export your transaction data as CSV at any time
- Request a complete copy of your data
6.2 Correction and deletion
- Update or correct your information in the application
- Delete individual transactions, categories, or budgets
- Delete your entire account and all associated data, from Account → Delete account, or by emailing privacy@mattraydub.com if you would rather we did it
6.3 Disconnect bank accounts
- Disconnect any bank account at any time
- This revokes CoinFlow's access to that account through Plaid
- Historical transaction data remains until you delete it
7. GDPR compliance (EU users)
If you're located in the European Economic Area (EEA), you have additional rights:
- Right to access: request what personal data we have about you
- Right to rectification: correct inaccurate data
- Right to erasure: request deletion of your data ("right to be forgotten")
- Right to data portability: receive your data in a machine-readable format
- Right to object: object to processing of your personal data
- Right to restriction: request restriction of processing
8. Children's privacy
CoinFlow is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.
9. International data transfers
Your data may be transferred to and processed in countries other than your own. We ensure that such transfers comply with applicable data protection laws and that appropriate safeguards are in place.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the application. Your continued use of CoinFlow after changes take effect constitutes acceptance of the updated policy.
11. Contact us
If you have questions about this Privacy Policy or our data practices, email privacy@mattraydub.com. We aim to respond within 48 hours.
This privacy policy was last updated in October 2026 and is effective as of that date. See also our Terms of Service.