Your data, your terms.

We collect the minimum needed to run ExpenseFlow:

• Account data — email, name, hashed password, workspace memberships.
• Expense data — transactions, categories, receipts, budgets, approvals you create inside the app.
• Usage telemetry — anonymous page views, feature usage, performance metrics. No third-party ad pixels.
• Optional integrations — when you connect a bank feed, OCR service, or AI provider, only the credentials you choose to share.

We use your data to operate the service — render your dashboard, run approvals, ship notifications, and answer your support emails. That's it.

We do not sell your data, rent it, share it with advertisers, or use your transactions to train shared AI models. Your spending is yours.

ExpenseFlow's AI Coach streams answers through the provider you choose — OpenAI, OpenRouter, NVIDIA NIM, or a local Ollama instance. We pass your prompts straight through; we don't log the bodies, and we don't fine-tune on your data.

When you point us at your own key, the provider's privacy policy applies on top of ours. Pick a provider you trust.

Only the third parties needed to run the app, and only the minimum each one needs:

• Hosting + database — our infrastructure provider (managed Postgres + object storage).
• Email delivery — for transactional mail (verification, approval notifications).
• Payment processor — if you're on a paid plan; they get billing details, not transaction data.
• Your AI provider — only if you've configured one, and only the prompts you generate.

We sign data-processing agreements with each one. We never share your data for advertising or analytics beyond the strictly necessary product telemetry above.

You can, at any time:

• Export — pull your data out as CSV / JSON from your settings page.
• Correct — edit account details and workspace metadata in place.
• Delete — delete your account; we wipe personal data within 30 days, with limited exceptions for legal/financial records where required.
• Object / restrict — for users in the EU/UK, the standard GDPR rights apply.

To exercise any of these, email [email protected] from the account address. We respond within one business day.

Account + expense data lives for as long as your workspace is active. When you delete your account or a workspace, we soft-delete first (so you can recover within 14 days), then hard-delete within 30 days.

Audit logs and append-only approval records are retained for up to 7 years where required for financial-record compliance, even after deletion of the parent workspace.

We use first-party cookies for session auth (JWT + refresh) and a small amount of localStorage for your UI preferences (dark mode, sidebar state). No third-party tracking cookies, no ad SDKs.

ExpenseFlow operates from Nepal. If you're outside Nepal, your data is processed in the region where our infrastructure provider hosts it. We use standard contractual clauses where required for cross-border transfer.