Privacy Policy
Version 2026-08-27 · in effect from 27 August 2026
CashFlowNamics is in closed alpha. It is run by an individual, offered free to invited testers, and takes no payment. No business registration stands behind it yet, so no enterprise number is published here — the contact address below is monitored and reaches the person responsible. Formal registration details will appear on this page before the service opens to the public or accepts any payment.
This explains what CashFlowNamics collects about you, why, how long it is kept, and what you can ask us to do about it. It is written to be read, not to be survived.
Who is responsible
CashFlowNamics, based in Belgium, is the data controller. For anything in this policy — including any request about your data — write to cashflownamics@gmail.com.
What we collect
- Your identity. Your email address and name, from your Google account. We never see your Google password.
- What you tell us. Country of residence, date of birth, preferred language and currency, and the tax and forecasting settings you choose.
- Your financial data. Everything you enter or import: holdings, transactions, dividends, income and expenses, liabilities, property, goals. This is the heart of the service and it is the most sensitive thing we hold.
- How you use the service. When you last signed in, and which emails you have chosen to receive.
- What you write. Feedback, forum posts and messages.
We do not collect special-category data, we do not buy data about you from anyone, and we do not build advertising profiles.
Why, and on what legal basis
- To provide the service — your account, your data and the figures calculated from it. Legal basis: performance of our contract with you (Art. 6(1)(b)).
- To keep it working and secure — error reports, administrative audit records, abuse prevention. Legal basis: our legitimate interests in running a reliable and secure service (Art. 6(1)(f)).
- To send you optional email — the notification types you can switch on and off in Settings. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.
- To meet legal obligations — accounting records once you buy a subscription. Legal basis: legal obligation (Art. 6(1)(c)).
We do not make automated decisions about you that have legal or similarly significant effects. The projections the app shows you are calculations from your own data, not decisions about you.
Who else sees it
We do not sell your data and we do not share it with anyone for their own purposes. These companies process it on our behalf, under contract:
| Who | What for | Where |
|---|---|---|
| Google Ireland Ltd (Sign in with Google) | Signing you in. We never see or store your Google password.Email address, name, and the fact that Google verified the address. | EU, with group transfers to the USvia EU–US Data Privacy Framework |
| Resend (Plus Five Six, Inc.) | Delivering the emails you have asked for.Email address and the content of the message sent to you. | United Statesvia Standard Contractual Clauses |
| Google Cloud (hosting and database) | Running the application and storing its database.Everything in your account, at rest. | EU (europe-west1, Belgium) |
We also fetch market data — prices, company details, instrument reference data — from Yahoo Finance, Twelve Data, OpenFIGI, Alpha Vantage, SimFin, ESMA FIRDS. These are asked about securities, never about people: no name, address or account identifier of yours is sent to any of them.
How long we keep it
| Your account and everything in it | Until you delete it. Deletion is final 30 days after you ask, and signing in again during those 30 days cancels it. |
| Error reports | 12 months, then deleted automatically. Your email address is removed from them immediately if you delete your account. |
| Administrative audit records | 24 months, then deleted automatically. These record what an administrator did, which we are required to be able to account for. |
| Background job history | 7 days, then deleted automatically. |
Your rights
You can, at any time and free of charge:
- See what we hold. Settings → Account → Download your data gives you the whole lot as a file, without asking anyone.
- Correct it. Everything about you is editable in the app.
- Delete it. Settings → Account → Delete account. Final after 30 days; signing in again in that time cancels it.
- Take it elsewhere. The download is JSON, so another service can read it.
- Object, or ask us to restrict processing — write to us and tell us why.
- Withdraw consent to any optional email, in Settings → Notifications or from the unsubscribe link in any message.
If you think we have got this wrong, please tell us first — but you have every right to complain directly to the Belgian Data Protection Authority, or to the authority where you live.
Cookies
Three are strictly necessary and need no consent: one keeps you signed in, one remembers your chosen language, and one remembers your answer to the cookie question below (the word "granted" or "denied", for six months). We also keep simple aggregate counts of visits to our public pages (which page, which day, and which site or campaign sent the visitor); they contain no cookie, no IP address and no identifier, and nothing is counted for visitors who send a Do Not Track or Global Privacy Control signal.
There is one optional tool, which stays off until you press Accept in the cookie banner: the Google Ads tag, provided by Google Ireland Limited. If you accept, it sets Google cookies in your browser and tells Google that you visited our site or created an account, so that we can see whether an advertisement of ours led to a sign-up. We use it to measure our advertising, not to show you anything inside the service, and we do not send Google the contents of your account. Google may process this data outside the EU under the safeguards it publishes. If you press Decline, or make no choice, nothing from Google is loaded.
You can change your mind at any time with "Cookie settings" in the footer. Declining stops anything new from loading; cookies Google has already set can be deleted in your browser's settings. This section was updated on 1 October 2026.
Security
Traffic is encrypted in transit. The database sits in the EU. Access to production data is limited to administrators, and administrative actions on an account are recorded. If a breach ever put your rights at risk, we will tell the supervisory authority within 72 hours and tell you without undue delay.
Age
CashFlowNamics is not for children. You must be at least 16 to create an account.
Changes
If we change this policy in a way that matters, we will raise its version and ask you to read and accept it again the next time you sign in. Small corrections are made without asking.