Privacy

This describes what the software actually does, not what it intends to. Where a claim below is enforced by how the site is built rather than by policy, it says so.

If you do not sign in

The planner works completely without an account, and that is the intended way to try it. In that mode your plans, spending entries and wish list are held in your own browser's local storage under keys beginning cashflow. — no row anywhere has your name on it, and clearing your browser data deletes the lot permanently, including from us, because we never had it.

One thing does leave your browser: when the forecast is calculated, the plan's figures are sent to the server, calculated, and the answer returned. Nothing from that request is written down — the calculation routes hold no data and have no database access for your plan. This is a real reduction on doing the arithmetic in your browser, and it is stated here rather than glossed over.

If you sign in

Signing in is what makes a plan portable between devices and lets you export it. From then on the following is stored against your account:

• Your account: the identifier your sign-in provider gives us, your email address, and your name if the provider supplies one.
• Your plans: the figures you enter — income, bills, balances, rates, dates.
• Spending you log against a budget, including any note you write.
• Your wish list and the price history of each item.
• Recorded days. Once a day has passed, the plan's figures for it are written down so editing the plan cannot rewrite the past.
• Balance readings you enter to check the plan against reality.

That is the whole list. It exists because those things are the app; none of it is collected for any other purpose.

Cookies

Three, all strictly functional. None is used for tracking or advertising, and there is no third-party cookie.

• cashflow_session — set when you sign in. Holds your account number and an expiry, signed so it cannot be forged, and readable only by the server, never by JavaScript. Thirty days.
• cashflow_anon — set for everyone, signed in or not. Holds a random identifier and nothing else. Its only job is to rate-limit the calculation endpoint fairly, so one visitor cannot exhaust it for everybody. Twenty-four hours.
• cashflow_oauth_state — set for ten minutes while you sign in, to ensure the sign-in that completes is the one you started.

What is deliberately not done

No analytics, no tag manager, no advertising pixel, no session recording, no fingerprinting. This is enforced, not merely promised: the page is served with a Content-Security-Policy permitting scripts only from this site, so a third-party tracker cannot execute here even if one were added by mistake.

Your figures are never sold, rented, shared with advertisers, or used to train machine-learning models.

Other services involved

• Sign-in is handled by WorkOS. If you sign in, they receive what any sign-in provider must: your email address and authentication details. They never receive your plan. If you never sign in, no request is made to them at all.
• Price lookups. If you ask a wish list item to be priced, one of two things happens. If you supplied a product link, this server fetches that page — so the shop sees a request, without anything identifying you. If the item has no link, its name is sent to a pricing service (pricesapi.io) to search for. Nothing else about you or your plan is included. Prices are only ever looked up when you ask.
• A bank statement you import never leaves your browser. The file is read and parsed on your own device; only the entries you confirm are saved, and the file itself is never uploaded.

Server logs

The web server records requests so the site can be kept working — the time, the page, the response, and how long it took. Addresses are shortened before they are written, so a record identifies a network rather than a device or a person, and cookies are never written to the log. These records are kept for ninety days and then deleted. No address is ever stored in the database.

Who can see your data

Administration of this site can see counts and account details — how many plans exist, when an account was created, which tier it is on. It cannot open your plan, your spending, your recorded days, or even a plan's name. That is a limit built into the software rather than a rule somebody follows, and it is why a message saying "my numbers look wrong" has to be answered by asking rather than by looking.

Every administrative action that changes anything is recorded in an audit log that cannot be edited or deleted.

Keeping, exporting and deleting

• Export. Signed in, you can download everything held about you as a single file, at any time, free.
• Deleting a plan holds it in a trash for thirty days in case you change your mind, then removes it permanently along with its spending, wishes and recorded days.
• Deleting your account removes everything belonging to it — plans, spending, wishes, price history and recorded days. Ask through the contact page.
• Data is kept while your account exists, because it is the thing you came for. There is no separate retention period.

Messages you send

The contact form stores what you type — your message, and the name and email address if you give them — so a person can read and reply. It also records which browser sent it, to help diagnose bugs. Your IP address is not stored with it. Nothing in the form is required except the message itself.

Children

This is not intended for use by children, and no account should be created for one.

Changes

If what the software stores changes, this page changes with it — it is a description of the code, so the two are meant to move together. Material changes will be noted here with a date.

Asking

Questions about any of this, a request for a copy of your data, or a request to delete it: use the contact page. It reaches a person.