Your data stays yours.

1. What this policy covers

This policy explains what data the BillFluxView apps (iOS and web) and the billfluxview.com website handle, where it lives, and the choices you control. It applies to everyone who uses BillFluxView, on every tier.

2. On-device by default

On the Free tier and the One-Time unlock, everything you enter — bill names, amounts, due dates, categories, notes — is stored in an encrypted database on your device. We do not require an account, and we do not receive, collect, or have access to any of it. On the Free tier the app makes no network calls at all. The one exception on the One-Time unlock is purchase verification, described in Section 5 — it involves your App Store receipt and an anonymous ID, never your bills.

3. Data leaves only when you flip a toggle

Optional cloud features each have their own switch in the Privacy Panel, and every switch starts off. Turning one on shares only what that feature needs:

• Multi-device sync & cloud backup — your bill data is encrypted on your device before upload and stored on our servers as ciphertext. Only you hold the key (a passphrase plus a one-time Recovery Kit). We cannot read, reset, or recover your data, and no server process inspects its contents.
• Bank connections — handled by Plaid. Your bank credentials go directly to Plaid; we never see or store them. We receive recurring-transaction data only to detect your bills, and it is processed and stored under the same encryption as everything else. See Plaid’s privacy policy at plaid.com/legal.
• Bill negotiation — if you ask us to negotiate a specific bill, you choose exactly which bill’s details to share with our negotiation team. We use them only for that negotiation.

Turning a toggle off stops the sharing going forward, and you can delete your cloud data entirely at any time (see Section 7).

4. Accounts

No account exists until you enable a cloud feature. If you do, we store the minimum needed to run the service: your email address, authentication data, subscription status, and the encrypted blobs described above. That’s the whole account.

5. Payments

Purchases on iOS are processed by Apple; purchases on the web are processed by Stripe. We receive confirmation that a purchase happened and what was bought — never your card number. Apple and Stripe handle payment details under their own privacy policies.

When you buy the One-Time unlock on iOS, the app sends your App Store receipt to our purchase-verification service (EntitleHub, which we operate) together with a random identifier generated on your device. That identifier is not your name, email, Apple ID, or device ID, and it is not linked to you or used for tracking — it exists only so the unlock can be restored. This is the sole reason the App Store privacy label lists “Purchases” and “Identifiers” (both “not linked to you”). No bill data is ever included, and no such call is made unless you buy or restore a purchase.

6. What we don’t do

• We never sell, rent, or share your data with data brokers or advertisers.
• We run no ads and embed no advertising SDKs.
• We use no analytics that profile you. Any diagnostics are opt-in, anonymous, and free of bill contents.
• We don’t read your synced data — we can’t; it’s encrypted with your key.

7. Your rights and controls

Because your data is on your device, most controls are already in your hands: export it (CSV/PDF), back it up, or delete the app and it’s gone. If you’ve enabled cloud features, you can delete your cloud data and account from inside the app or by emailing us; deletion removes your encrypted blobs from our servers and backups within 30 days. Where laws like GDPR or CCPA apply, you have rights to access, correct, delete, and port your data — email us and we’ll honor them.

8. Security

On-device data is encrypted at rest with a key protected by your device’s secure keychain, with optional Face ID lock. Cloud data is end-to-end encrypted: keys are derived from your passphrase on your device and never sent to us. Transport is TLS everywhere. No system is perfectly secure, but our design goal is that a breach of our servers yields nothing readable.

9. Children

BillFluxView is not directed at children under 13, and we do not knowingly collect personal information from them.

10. Changes to this policy

If we change this policy, we’ll update the date at the top and, for meaningful changes, tell you in the app before they take effect. We will never change the core promise: your data is not for sale.

11. Contact

Questions or requests: [email protected].