Privacy Policy

1. Introduction

MalFlow ("we", "our", or "us") is a personal finance management application that helps you track your income, expenses, assets, loans, goals, and overall financial health. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our web and mobile applications.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your name, email address, and authentication credentials. If you sign in with Google or Apple, we receive your basic profile information from those providers.

2.2 Financial Data

You voluntarily provide financial data including transactions, financial account details (account names, balances, categories), budget information, savings goals, asset holdings, loan details, recurring rules, installment plans, and credit card information. This data is entered and managed entirely by you.

2.3 Usage Data

We collect basic usage analytics such as app opens and feature interactions to improve the user experience. We do not track your browsing activity outside of MalFlow.

2.4 Exchange Rate Data

When you use multi-currency features, we fetch exchange rates from third-party providers. No personal information is shared in these requests.

3. How We Use Your Information

• To provide and maintain the MalFlow service, including dashboards, reports, insights, and financial health scores
• To calculate net worth, savings rates, budget comparisons, cash flow forecasts, and spending analytics
• To generate personalized financial insights and recommendations
• To enable shared account access when you invite other members
• To send important notifications about your account (verification, security alerts)
• To improve and optimize the application

4. Data Storage and Security

Your data is stored securely using Google Firebase infrastructure, which provides encryption at rest and in transit. We implement the following security measures:

• All data is transmitted over HTTPS/TLS encryption
• Firebase Authentication handles secure credential management
• Optional two-factor authentication (2FA) via authenticator apps
• Firestore security rules enforce access control at the database level
• Balance masking feature to hide sensitive financial data on screen
• Activity logging tracks all data modifications for shared accounts

5. Data Sharing

5.1 Shared Accounts

You may choose to share your financial data with other MalFlow users by inviting them as viewers, editors, or managers. Shared members can access your data according to their assigned role permissions. You can revoke access at any time.

5.2 Third Parties

We do not sell, trade, or rent your personal or financial information to third parties. We do not share your data with advertisers. The only third-party services involved are:

• Google Firebase — for authentication, data storage, and hosting
• Google and Apple — only if you choose to sign in with these providers
• Exchange rate APIs — anonymous requests for currency conversion rates

6. Data Retention and Deletion

Your data is retained as long as your account is active. You have full control over your data:

• Export your data at any time using the backup feature (JSON format)
• Delete specific records (transactions, goals, assets, loans, etc.) individually
• Delete all data using the "Delete All Data" option in Settings
• Delete your entire account, which permanently removes all associated data

7. Your Rights

You have the right to:

• Access all your personal and financial data stored in MalFlow
• Export your data in a portable format
• Correct or update your information at any time
• Delete your data or your entire account
• Revoke shared access to your financial data
• Enable or disable balance masking for privacy

8. Cookies and Local Storage

We use essential cookies for authentication session management and locale preferences. We do not use tracking cookies or third-party advertising cookies.

9. Children's Privacy

MalFlow is not intended for use by children under the age of 13. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "Last updated" date.