Legal

Privacy Policy

Last updated · September 2026

This English version is provided for convenience. The Italian version is the authoritative one: where the two differ, the Italian text prevails.

Your privacy is our first concern. Floow was designed privacy-first from the start. This notice describes how we collect, use and protect your data.

Two contexts are kept apart, with different rules: the data handled by the app, which stays on your device, and the little data handled by this website when you write to us or join the waiting list, which necessarily passes through a few external providers.

Data controller

The data controller is Alessandro Recano, Via Trieste 35B, 81020 San Nicola La Strada (CE), Italy — VAT IT04946950617. For any request about your data, write to privacy@getfloow.app.

Data collection — the app

Floow collects only what the app needs to work:

  • Financial data: transactions, balances, budgets and goals that you enter yourself
  • Bank data: only if and when you turn on bank synchronisation — transactions, balances and linked accounts, which still stay on your device
  • Profile data: name and app preferences set by you

Floow contains no analytics, telemetry or crash reporting: no information about how you use the app is collected or transmitted.

Data storage

Your financial data is stored locally on your device: transactions, balances and linked accounts are never transferred to servers of ours. They are protected by the device’s own encryption (iOS Data Protection) and by the app’s biometric lock (Face ID / Touch ID).

Waiting list

If you join the pre-launch waiting list we collect your email address, an automatically generated invite code, the code of whoever invited you if any, the language you read the site in, and the dates of sign-up and confirmation. We do not collect your name, your IP address for profiling, or any financial data.

The language is used to write to you in the language you signed up in, and for nothing else.

Purpose and legal basis: handling your request for early access and telling you when the app launches. The processing rests on pre-contractual measures taken at your request (Art. 6(1)(b) GDPR): without an email we cannot hold your place or write to you. The confirmation link verifies that the address is really yours.

Retention: we keep your email until the app launches and for at most 12 months after that, or until you ask for deletion — which you can request at any time by writing to privacy@getfloow.app, in one line and with no reason given.

Invite programme: if you share your invite link, whoever uses it sees only a sign-up page: they do not receive your email address or any other data of yours. We show you only the number of people who confirmed, never who they are.

Payments

If you take out the Founder subscription, payment is handled entirely by Stripe: card details travel to Stripe and never pass through our systems, which receive only the outcome, a customer identifier and the subscription status. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Tax records tied to the transaction are kept for the period the law requires.

External providers used by the website

To run the waiting list, the contact form and payments we rely on these providers, acting as data processors:

  • Vercel: website hosting
  • Supabase: the database holding the waiting-list email
  • Resend: sending confirmation and service emails
  • Stripe: payments and subscriptions
  • Cloudflare Turnstile: anti-spam protection on forms, with no profiling cookies
  • Vercel Web Analytics: anonymous count of site visits

Some of these providers are based in the United States: transfers rely on the Standard Contractual Clauses approved by the European Commission and on the safeguards in their respective data processing agreements.

Open Banking (PSD2)

Bank synchronisation is not active yet: today Floow runs entirely on the data you enter. When it arrives, accounts will be linked through a certified PSD2 provider, bank credentials will never be stored in the app, and the connection will run over encrypted channels directly with your bank.

Cookies and local storage

This site uses no profiling, advertising or third-party cookies, which is why it shows you no consent banner. It does store four things in your browser’s local storage, all needed to make what you asked for work:

  • theme: whether you chose the light or dark theme
  • floow_whitelist_code: the code of your waiting-list sign-up, so your place is found again when you return
  • floow_ref: the code of whoever invited you, if you arrived from an invite link
  • sign-in session (Supabase): present only if you use the Account area, so you are not asked for credentials on every page

These are all technical or functional means under Art. 122 of the Italian Privacy Code: they need no consent from you, do not follow your browsing on other sites and are not shared with anyone. They stay in your browser and you can delete them at any time from its settings, or by leaving the Account area, which also removes the waiting-list data. Deleting them costs you only convenience: theme, list position and invite will need setting again.

Website visit statistics

On this site — not in the app — we use Vercel Web Analytics to know how many people visit and which pages they read. It uses no cookies and assigns no permanent identifier: each visit yields a temporary value, computed server-side from request data, which changes every day and cannot recognise the same person over time or connect them to your waiting-list email or account. The IP address is not retained. We see aggregate numbers — visits, pages, referrer, device type — never individual people.

Legal basis: our legitimate interest in knowing whether the site works and is found (Art. 6(1)(f) GDPR). As a measure with no cookies and no profiling, it needs no consent from you; you can still object by writing to privacy@getfloow.app, and browser script blockers switch it off.

Third parties

Floow does not share your financial data with third parties for advertising or marketing. We use no advertising trackers, no profiling cookies and nothing that reconstructs an individual’s behaviour: the only statistics we collect are the site visit figures described above, anonymous and aggregated.

Your rights

Under the GDPR you have the right to:

  • Access your personal data
  • Ask for inaccurate data to be corrected
  • Ask for your data to be deleted
  • Export your data in a readable format
  • Withdraw consent at any time

Because the app’s data is stored locally, you can delete all your financial data simply by uninstalling the app.

For data handled by the website — the waiting-list email and any subscription data — send your request to privacy@getfloow.app: we answer within 30 days. You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali).

Contact

For any privacy question, use the Contact page or write to privacy@getfloow.app.