Summary
Cashflow Pilot is local-first and does not require a bank login, cloud account, or advertising identifier. Your imported statements, transactions, budgets, forecasts, goals, and settings stay on your device or in your browser by default. If you choose optional Cloud Sync or other account features, the data needed to provide those features may be transmitted to and stored by Cashflow Pilot's cloud services.
- No bank credentials: Cashflow Pilot does not ask for online banking usernames, passwords, or MFA codes.
- No selling data: We do not sell financial data or use it for advertising.
- Cloud features are opt-in: Local-first use does not require Cloud Sync. Other than the limited analytics and ordinary hosting data described below, financial records are not sent to Cashflow Pilot unless you enable a cloud feature or choose to export, back up, share, or send them.
Data stored locally
The app may store information you enter or import, including account names, statement rows, merchant descriptions, categories, budgets, recurring items, goals, debts, forecast settings, app preferences, and local diagnostic/export files.
On iOS, app data may be stored in local app storage such as SQLite. On the web, app data may be stored in browser storage. Clearing app data, deleting the app, clearing browser storage, or changing devices may remove local records unless you created a backup.
Statement imports and files
When you import a statement export, Cashflow Pilot processes it so you can review transactions and build local reports. Imported files and parsed rows are not uploaded to us automatically.
If you choose to send a screenshot, CSV, diagnostic export, or backup to support, that material may contain financial or personal information. Only send files you are comfortable sharing.
Data we collect
Cashflow Pilot is designed not to collect advertising or cross-site tracking data. Local financial records stay on your device by default. If you enable optional account or Cloud Sync features, Cashflow Pilot may process the account identifiers, authentication metadata, and app data needed to provide the feature. The iOS app may also send limited Firebase Analytics events so we can understand basic app usage and screen navigation.
We may receive limited information in these cases:
- Cloud account and sync: If you enable an account or Cloud Sync, information required to authenticate you and provide the enabled cloud feature may be transmitted to and stored by Cashflow Pilot's cloud services. Cloud data is separate from the local device copy.
- Optional third-party financial connections: If you explicitly connect SimpleFIN, Lunch Flow or another supported provider, Cashflow Pilot may relay provider access credentials and requested account/transaction/holding data through its authenticated API to retrieve the information you requested. These requests are separate from ordinary Cloud Sync; third-party providers have their own privacy practices and terms. Connection credentials may be kept in session memory, a separately encrypted device vault, or an explicitly chosen owner-only end-to-end encrypted credential vault. They are not included in ordinary financial record sync or financial backups.
- Newsletter communications: If you explicitly opt in to marketing emails, Cashflow Pilot may share your email address and subscription preferences with Brevo for subscriber and campaign management. Signing in does not subscribe you to newsletters, and you can opt out.
- Support email: If you email support, we receive your email address, message, attachments, and any details you choose to include.
- App analytics: Firebase Analytics may receive limited events such as app opened, screen viewed, app version, platform, tab, and screen name. We do not send balances, transactions, merchant names, account names, statement contents, budgets, goals, debts, search text, imported files, or other user-entered financial details.
- Website hosting: Our website host may process ordinary web request information, such as IP address, browser details, requested URLs, and timestamps, to deliver and protect the site.
- App platform services: Apple or your device platform may process information related to app downloads, purchases, crash reporting, backups, or operating-system services according to their own policies and settings.
Optional bank connections: access, storage and third parties
SimpleFIN Bridge and Lunch Flow Bridge: Cashflow Pilot uses an optional SimpleFIN-compatible bank-data connector to retrieve read-only account balances and transactions. Lunch Flow's separate Personal REST API is also available for supported investment holdings. The provider and bank may have their own account-authorization, aggregation, retention and deletion practices; Lunch Flow and SimpleFIN must not be treated as having identical upstream arrangements.
Credentials and request processing: For SimpleFIN Bridge, SimpleFIN states that, when bank credentials are required, its connectivity partner MX handles them and SimpleFIN does not receive them. Cashflow Pilot's authenticated Worker temporarily receives the bridge access URL/token, uses it to call a restricted provider host over HTTPS, and processes the account/transaction response for the requested operation. This relay is not end-to-end encrypted against the Worker. Our connector is designed not to persist the credential, raw provider response or online-banking password in its database, financial backups or logs. Financial records you review and import are stored in the app and, if enabled, in encrypted financial Cloud Sync.
Credential saving choices: Don't save (the default) keeps the bridge access credential in temporary application memory. This device stores an expressly approved credential in the iOS Keychain or in a browser vault encrypted with a user passphrase. Encrypted sync stores an expressly approved credential in a separate, owner-only end-to-end encrypted connection vault, accessible after unlocking the Cashflow Pilot recovery secret. Saving to the encrypted connection vault is not the same as including credentials in ordinary financial records or exported backups. Choosing Don't save does not delete earlier saved copies.
SimpleFIN's published third-party practices: According to the SimpleFIN Bridge Privacy Policy (effective October 27, 2026), SimpleFIN Bridge does not retain banking data, while MX retains account and transaction data during the connection, potentially indefinitely, with associated MX data removed within two weeks after a SimpleFIN account or connection is deleted. The policy notes that SimpleFIN's data processing may occur in the United States. These statements describe SimpleFIN's arrangement, not Cashflow Pilot's local storage or Lunch Flow's policies.
Provider security disclosure: SimpleFIN's Security Policy reports a May 28, 2026 MX account-mixing incident that could have exposed balances, account names and transactions between up to 39 users over four hours; SimpleFIN says bank usernames/passwords were not exposed. We disclose this external event for transparency; it was not reported as a Cashflow Pilot breach.
Revocation and deletion: Forgetting a credential in Cashflow Pilot does not revoke the provider token, remove another saved device/cloud copy, or delete imported financial records. To revoke upstream access, use the provider's connection/revocation controls and your bank's connected-app controls where available. Delete device-vault and encrypted-sync copies separately, and remove imported records or backups separately if desired. Different providers have different retention policies. Read the full security explanation.
Tracking, ads, and third parties
Cashflow Pilot does not use third-party advertising SDKs, does not track you across apps or websites for advertising, and does not sell personal information.
Firebase Analytics is used only for limited product usage metrics in the iOS app. It is not used to collect financial records or to track you across other companies' apps or websites.
Optional provider connections send the requested data through the service needed to retrieve it; availability and credential handling vary by provider. Connection data is not automatically the same as Cloud Sync data. Product-news subscriptions require a separate opt-in. Marketing campaigns are managed through Brevo, independently of essential account emails.
Optional cloud account and sync features are covered by this policy. If Cashflow Pilot later adds materially different uses of personal information, advertising, or broader tracking, this policy and applicable app-store privacy disclosures will be updated before those practices are introduced.
Retention and deletion
Local app data remains on your device until you delete it, reset local data in the app, clear browser storage, uninstall the app, or restore from a different backup. We cannot recover or delete data that exists only in your local browser or device storage.
If you enable a Cashflow cloud account, the account settings provide a server-side deletion path for account and cloud data. Support emails are retained only as long as reasonably needed to respond, troubleshoot, maintain records, or comply with legal obligations. You can request deletion of support emails or attachments by contacting us, subject to records we may be required or reasonably need to retain.
Encryption & safeguards
Local data: Cashflow Pilot stores local-only records in browser storage on the web and local app storage such as SQLite on iOS. The protection of those local copies depends in part on the security safeguards provided by your device, operating system, browser, device passcode, and backup settings. Unless a feature specifically says otherwise, do not assume that local browser or SQLite records have a separate Cashflow Pilot application-level encryption layer beyond those platform protections.
Financial Cloud Sync: When you enable Cloud Sync, your financial records are encrypted on your device with AES-256-GCM before upload. Our server stores the ciphertext and opaque identifiers and cannot decrypt your financial records. Cloudflare D1 encryption at rest is a separate, additional safeguard.
Account and service metadata: Account email, authentication, sessions, device and administration data, optional provider connection traffic and support communications are not necessarily end-to-end encrypted and may be processed where needed for those features.
Recovery and backups: You keep the 43-character secret. Cashflow Pilot cannot retrieve or bypass it. If it is lost, preserve an accessible unlocked local copy or a complete usable backup before a destructive cloud reset/deletion and fresh sync. With neither the secret nor another usable copy, cloud financial data is unrecoverable. Exported backup files may contain readable financial data and should be stored securely. See recovery guidance.
Data in transit: Cashflow Pilot uses HTTPS/TLS for traffic to its hosted website and cloud APIs. Cloudflare states that transfers between Workers and D1, between Cloudflare network nodes and D1, and D1 API access are protected with TLS/SSL.
Exports and backups: Files you export or download may be readable outside Cashflow Pilot. Store them securely and use device or storage encryption appropriate for financial information.
Sharing and sending financial information
Owner-authorized encrypted sharing: When enabled, a spouse or accountant must use their own verified account and encryption identity. The owner separately authorizes a selected scope or record projection. Encrypted snapshots and permitted collaboration commands are stored as ciphertext; the Worker does not receive the owner's recovery secret or readable financial records. Invitation and grant information, such as account identifiers, relationship/scope and status, can remain server-readable to enforce permission.
Sending invoices or quotes: Choosing to send a branded PDF by email is different from encrypted Cloud Sync. The intended recipient and any chosen email provider must process the message and attachment in readable form. The optional Brevo sender is disabled unless the operator has verified that open and click tracking are fully disabled and granted the feature. Sending is a deliberate user action; delivery is not assumed from provider acceptance.
Revocation: Removing a sharing permission blocks future authorized access but cannot erase information a recipient has already viewed or saved.
Security
Cashflow Pilot minimizes server-side exposure by keeping financial records local by default and uses safeguards appropriate to the features you choose. No storage or transmission method can be guaranteed to be completely secure.
You are responsible for protecting your device, device passcode, browser profile, iCloud/device backups, and any exported files you create. Before sharing exports or backups, review them for personal or financial information.
Your rights under PIPEDA
Where the Personal Information Protection and Electronic Documents Act (PIPEDA) applies, you have rights concerning personal information that Cashflow Pilot holds about you. Data stored only on your device is already under your direct control and is not available to us.
- Access: You may ask whether we hold personal information about you and request access to it, subject to limited exceptions permitted by law.
- Use and disclosure: You may ask how personal information we hold has been used and, where applicable, to whom it has been disclosed.
- Correction: You may challenge the accuracy or completeness of personal information we hold and ask us to correct or amend it where appropriate.
- Challenge compliance: You may raise a privacy concern or challenge our compliance with applicable privacy principles. If a concern is not resolved, you may have the right to complain to the Office of the Privacy Commissioner of Canada.
To make an access, correction, or privacy request, email support@cashflowpilot.ca. We may need to verify your identity before disclosing or changing personal information. PIPEDA access requests are generally answered within 30 days, subject to lawful extensions and exceptions.
Children
Cashflow Pilot is not intended for children. We do not knowingly collect personal information from children through the app.
Changes
We may update this policy as the app changes. The updated version will be posted on this page with a new last-updated date.
Contact
For access, correction, or privacy requests, questions about cloud data or deletion, and support requests, contact: