This Privacy Notice explains how CrashFlow("CrashFlow", "we", "us", "our") collects, uses, shares and protects personal information when you use our website and services (the "Service"). CrashFlow is the data controller for the personal data described here.

1. Information we collect

Account data: display name, email address, hashed password, and (if you sign in with Google) your Google profile identifier.
Financial inputs you provide: debts, bills, income and the budgeting/strategy choices you enter into the app.
Usage & device data: log data, IP address, browser type, device identifiers, pages viewed and basic analytics events.
Support communications: messages you send us by email or in-app.
Billing data: handled by our payment processor Paddle (see Sharing, below). We receive transaction metadata such as plan, amount, country, and a customer ID — not your full card number.

2. How we use your information

To create and operate your account and deliver the Service.
To process subscriptions and one-time purchases (via Paddle as Merchant of Record).
To provide customer support and respond to your requests.
To secure the Service and prevent fraud and abuse.
To improve features, performance and reliability.
To comply with legal obligations.

3. Legal bases (UK/EEA users)

Performance of a contract — to provide the Service and process payments you request.
Legitimate interests — to keep the Service secure, to improve it, and to prevent fraud.
Consent — where required, e.g. for optional marketing or non-essential cookies.
Legal obligation — to meet tax, accounting and regulatory requirements.

4. Sharing your information

We share personal data only with:

Paddle.com — our Merchant of Record and payment processor. Paddle handles checkout, subscription billing, taxes and invoicing, and receives the data necessary to process your transaction.
Hosting & infrastructure providers — for database, email and application hosting, acting as our processors.
Analytics providers — to understand aggregated usage of the Service.
Professional advisers — legal, accounting and similar advisers, under duties of confidentiality.
Authorities — where we are required to do so by law or to protect our rights.

5. International transfers

Your data may be processed in countries outside your own, including outside the UK/EEA. Where we transfer personal data internationally we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or adequacy decisions.

6. Data retention

We keep your account data and financial inputs for as long as your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we are required to keep records (for example for tax or fraud-prevention purposes).

7. Your rights

Depending on where you live, you may have the right to access, rectify, erase, restrict or object to our processing of your personal data, to data portability, and to withdraw consent at any time. UK/EEA users have the right to complain to their supervisory authority (in the UK, the ICO). To exercise any of these rights, email privacy@crashflowapp.com. We aim to respond within one month.

8. Security

We use appropriate technical and organisational measures, including encryption in transit, hashed passwords, access controls and audit logging, to protect your personal data. No system is perfectly secure, so we cannot guarantee absolute security.

9. Cookies

We use essential cookies and similar technologies to keep you signed in and to operate the Service. We may use a small number of analytics cookies to understand aggregated usage. You can manage cookies in your browser settings.

10. Children

CrashFlow is not directed at children under 16, and we do not knowingly collect personal data from them.

11. Changes to this notice

We may update this Privacy Notice from time to time. We will notify you of material changes through the Service or by email.

12. Contact

Questions or requests: privacy@crashflowapp.com.