Privacy Policy

Effective date: August 11, 2026

This Privacy Policy describes how StashFlow ("StashFlow", "we", "us") collects, uses, protects, and deletes information when you use our application and website at stashflows.com. StashFlow is a personal financial management application that brings cash flow, net worth, account activity, and investments into one place.

StashFlow is currently in private beta. Access is limited to invited users. If you join our waiting list, this policy also covers the information you submit there.

1. Information We Collect

Account information. When you are invited and sign in, we collect your name and email address. If you sign in with Google, we receive your name and email address from Google; we never receive or store your Google password.

Financial information via Plaid. When you connect a financial institution, we use Plaid Inc. ("Plaid") to retrieve your financial data. Depending on the accounts you connect, this may include:

• Account details, such as institution name, account name, type, and masked account number;
• Balances, both current and available;
• Transaction data, such as amounts, dates, merchant names, and categories;
• Investment data, such as holdings, securities, cost basis, quantities, and investment transactions.

We never see or store your banking credentials. You provide your bank username and password directly to Plaid, not to us. We store only Plaid-issued access tokens, in encrypted form, so the connection can stay up to date.

Waiting list information. If you join the waiting list, we collect your email address and, optionally, your name.

Usage and log data. We keep operational logs of application activity, authentication events, and data synchronization jobs so we can operate and secure the service.

2. How We Use Plaid

Bank connectivity is delegated to Plaid, a service provider that specializes in secure connections to financial institutions. When you connect an account, you grant StashFlow and Plaid the right to access the data described above so that we can provide the service to you.

Plaid's collection and use of your information is governed by the Plaid End User Privacy Policy. By connecting a financial institution through StashFlow, you acknowledge and agree that your information will be processed in accordance with that policy.

You can disconnect a financial institution at any time from within StashFlow. When you disconnect an institution, the associated Plaid access token is revoked and deleted, and ongoing data access through that connection ceases.

3. How We Use Your Information

• To provide the service: displaying your accounts, balances, transactions, net worth, cash flow, and investment performance;
• To categorize and enrich your data: we use artificial intelligence services (provided by Anthropic) to categorize transactions and classify investment holdings. Only the minimum data needed for classification is processed, and it is not used by our AI provider to train models;
• To operate, secure, and improve the service, including troubleshooting and fraud prevention;
• To communicate with you about your account, invitations, and the waiting list.

We do not sell your personal or financial information. We do not share your data with advertisers or data brokers. Data collection is minimized to what the application requires to function.

4. How We Share Information

We share information only with the service providers required to run StashFlow:

• Plaid - bank and brokerage connectivity;
• Zoho Catalyst - cloud hosting, database, and email infrastructure;
• Anthropic - AI-powered transaction categorization and security classification;
• Google - sign-in authentication, if you choose to sign in with Google;
• Cloudflare - network and DNS services for our website.

Each provider is limited to the data it needs to perform its function. We may also disclose information if required by law, regulation, or legal process, or to protect the rights, safety, or property of StashFlow or others.

5. How We Protect Your Information

• All data in transit is encrypted using TLS 1.2 or higher;
• Sensitive data at rest, including financial access tokens, is stored encrypted in managed cloud data stores;
• Access to production systems follows least-privilege and role-based access control, with multi-factor authentication required on all administrative accounts;
• Application access is restricted to an explicit allowlist of invited users, validated at signup and on every request;
• Security practices, access rights, and vendors are reviewed on a quarterly schedule under our Information Security and Access Control Policy.

6. Data Retention and Deletion

Financial data retrieved through Plaid is retained only for as long as it is required to provide the service to you, and only while your account and the associated institution connections remain active.

• When you disconnect a financial institution, its access token is revoked and deleted;
• When you request deletion or close your account, your data is deleted from our production systems within 30 days, and related Plaid connections are removed via the Plaid API so that data access ceases;
• Deleted data ages out of platform-managed backups in accordance with our cloud provider's standard backup rotation cycles;
• We may retain data beyond these periods only where required by applicable law, regulation, or legal process.

7. Your Rights and Choices

• Access. You may request a copy of the personal information we hold about you;
• Deletion. You may request deletion of your account and associated data at any time;
• Disconnection. You may disconnect any linked financial institution at any time from within the application;
• Waiting list removal. You may ask to be removed from the waiting list at any time.

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act, including the right to know what personal information we collect and the right to non-discrimination for exercising your rights. To exercise any right, contact us using the details below and we will respond within the time required by applicable law.

You can also manage connections StashFlow has to your financial institutions through the Plaid Portal.

8. Children's Privacy

StashFlow is not directed to individuals under 18, and we do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify active users by email or through the application before the changes take effect. The effective date at the top of this page reflects the latest revision.

10. Contact Us

For privacy questions, access or deletion requests, or anything else in this policy:

StashFlow
Email: privacy@stashflows.com