Privacy policy
This policy explains what personal information Moflow collects, how we use and share it, how long we keep it, and the choices and rights you have.
Last updated 2026-10-28
On this page
Summary
- Your ledger syncs to your account. It is encrypted in transit and at rest, and we use it to provide Moflow to you, including to an AI assistant you connect. We do not sell your personal information or share it for advertising.
- We measure traffic. We count page views and a few product actions to see how Moflow is used. Nothing from your ledger is included, and analytics cookies are optional.
- Stripe, Apple or Google takes your payment. You pay on Stripe's own page, in the App Store or on Google Play, and your card number never reaches us.
Information we collect and how we use it
What we collect, why we use it, and the legal basis for each use.
| What | Why | Legal basis |
|---|---|---|
| Email address, or your Google or Apple account identity, which can include your name | To create your account and attach your ledger and any subscription to it. | Performance of a contract |
| A record that you agreed to the Terms and read this policy: when you agreed, and the date each was last updated at the time | To show that you agreed to the Terms, and to which version. | Legitimate interest — keeping a record of your agreement |
| Your synced ledger: accounts, balances, transfers, holdings, snapshots, a day-by-day record of your net worth and account balances, goals, reasons, your money profile — the income, monthly spending, emergency reserve, retirement plan, birth year and notes you enter — and your ledger settings | To provide Moflow to you: to sync your ledger between your devices, to work out the day-by-day record on Moflow+, to confirm a month you leave unconfirmed, from the 8th of the next month, and to answer an AI assistant you connect. | Performance of a contract; legal obligation, where the law requires disclosure; legitimate interest, for a transfer of Moflow to another company |
| Your subscription record: your plan, its status — including a failed payment being retried — and when it last changed, and Stripe's customer and subscription identifiers; for a subscription bought in the App Store or on Google Play, which store sold it, whether the store reports it active, when we last checked, the store's identifier for the purchase, and a code derived from your account ID that the store keeps with the purchase | To give your account its plan's features, to keep them on while a failed payment is retried, to open your billing portal, and to check a store subscription with the store that sold it and tie it to one account. | Performance of a contract |
| The country of your billing address, which Stripe sends us when a checkout completes | To check that Moflow+ is sold in that country. The country is not stored. | Performance of a contract |
| The country our hosting network works out from the IP address your browser connects from, when you open a page that offers Moflow+ or start a checkout | To show whether Moflow+ can be bought where you are, and to stop a checkout where it cannot. The country is not stored. | Legitimate interest — offering Moflow+ only where it can be sold |
| Your brokerage accounts, once you connect one: the positions, cash, balances, cost basis and currency your broker reports, the deposits and transfers it reports into the account, the name it gives the account, and the name of the institution | To fill in and update the accounts you connect. The access is read-only: Moflow cannot place an order or move money. Moflow never receives your broker sign-in details. We keep what the connection needs to work, for the period in Data retention. | Performance of a contract |
| A record that you agreed to the brokerage connection service's own terms, if you start connecting a brokerage account: when you agreed, and which version | That service requires everyone who connects to agree to its terms, and requires us to keep a record of it. | Legitimate interest — showing that the connection service's terms were met |
| Your assistant connections, once you connect one: which assistant, whether it may read your ledger, change it or both, when you connected it, when it last used the connection, and when it was disconnected | To let the assistant you approve reach your ledger, and to show you in Settings what is connected. | Performance of a contract |
| A message you send to support, from Help in the app or the contact page: the topic, your message and the email address we reply to; when you are signed in, your account ID or account email and your plan; and, on the contact page, your IP address | To answer you, to find your account and to prevent abuse of the contact page. | Performance of a contract; legitimate interest — answering people without an account and preventing abuse of the contact page |
| The contact page's security check: the IP address your browser connects from and details of your browser, which the check's provider sees when you open the contact page, and a small record it keeps in your browser | To tell people from automated scripts. The check's provider runs it for us. | Legitimate interest — preventing abuse of the contact page |
| Three whole numbers sent under a comparison feature that has been withdrawn: an age band, a net-worth band and a growth band | They were sent by members who opted in to the comparison. They are no longer collected or used. | Consent — no longer collected |
| A push-notification token and your notification settings | To send the notifications you turn on. Most notifications are a fixed message; a drift alert adds an asset class and its share, target and tolerance, as percentages. | Consent — withdrawn by turning them off |
| Snapshot emails: your email address, the month an email asks you to confirm, your net worth and its change since your latest confirmed snapshot and, if you have set allocation targets, each asset class's share and target, as percentages — and, with your account, which month we last emailed you about, whether you stopped these emails, when each happened, and a random code for the Unsubscribe link | To remind you to confirm a month's snapshot and to show where your net worth and allocation stand, without emailing you twice about one month or after you unsubscribe. | Legitimate interest — reminding you to confirm your snapshots; the Unsubscribe link in each email stops them |
| Ticker symbols, symbol-search text, and exchange-rate requests | To price your holdings, find the symbols you search for, and convert currencies. A price request includes your sign-in; a search includes it on a paid plan. | Performance of a contract |
| An anonymous count of how many people hold each ticker | To decide which tickers to support. It is not linked to you. | Legitimate interest — improving coverage |
| Usage analytics: page addresses, a count of four product actions, and the device type and rough location our analytics provider derives from the request | To see how Moflow is used. Nothing from your ledger is included. The cookie that recognises a repeat visit is optional; see Cookies. | Consent for analytics cookies where the law requires it; legitimate interest — understanding how Moflow is used — for counting without cookies |
| Which product moments your account reached, and when: creating your account, adding your first account, each snapshot you confirm, and, if you subscribe, starting a trial and starting to pay | To see whether people who sign up keep using Moflow. | Legitimate interest — knowing whether Moflow works |
| Server request logs, including the IP address your browser connects from | To keep Moflow running and secure. Our hosting provider records each request with its IP address, the address requested, its status and its timing. | Legitimate interest — security and operating the service |
How we share information
We share personal information with the service providers that help us run Moflow, and with the services you choose to connect:
- Our hosting and database provider — hosting, sign-in, our database and servers, push delivery, and usage analytics. It holds your synced ledger, your sign-in identity and the server request logs, which include the IP address your browser connects from.
- Our payment processor, Stripe — payments and the billing portal. Stripe collects your card details, name and billing address on its own page, under its own privacy notice.
- Apple and Google, if you subscribe in the iOS or Android app — they sell Moflow+ in those apps and take your payment under their own terms and privacy notices. They tell us whether your subscription is active, and we give them a code derived from your account ID so the purchase belongs to one account.
- Market-data and exchange-rate providers — to price your holdings and convert currencies. Our servers send them the ticker symbols you hold, the text you search for and currency requests, not who you are.
- Our email providers — to send snapshot emails and carry messages to support. A snapshot email gives them your email address, your account ID in its Unsubscribe link, the month it asks you to confirm, your net worth and its change since your latest confirmed snapshot and, if you have set allocation targets, each asset class's share and target, as percentages. A message to support gives them what you wrote, the email address we reply to and, from Help in the app, your account ID.
- A security check on the contact page — when you open the contact page, its provider sees the IP address your browser connects from and details of your browser, to tell people from automated scripts. Its own privacy notice covers what it uses to improve its bot detection.
- A brokerage connection service, SnapTrade — if you connect a brokerage account. Your browser reaches it each time you connect or reconnect a brokerage, and it returns your positions, cash, balances and the deposits your broker reports, with read-only access. It knows you by a random identifier, not your Moflow sign-in, and processes what it receives for us as our service provider. SnapTrade's End User Terms apply to its service.
- An AI assistant you connect — if you connect one. What it asks for is read from your ledger and sent to it, and its provider's privacy notice covers what it keeps. Disconnecting it in Settings ends its access.
We may also disclose personal information where the law requires it, and to a company that takes over Moflow, which will continue to use it under this policy.
International transfers
Our hosting and database provider and our payment processor are United States companies, so your information is processed outside the EEA and the UK. What crosses a border includes the IP address your browser connects from, your sign-in identity, your synced ledger, your payment details, the ticker symbols you hold and the text you search for, the band numbers sent under the withdrawn comparison, and the page addresses and event counts used for analytics, with the device type and rough location derived from them. What a brokerage connection service, an AI assistant you connect, the contact page's security check and our email providers receive is also processed outside the EEA and the UK.
We are based in Canada, which the European Commission and the UK recognise as protecting personal data adequately. Transfers from the EEA, the UK or Switzerland to the United States rely on the EU-US Data Privacy Framework and its UK and Swiss extensions where the provider is certified, and otherwise on the European Commission's standard contractual clauses and the UK addendum to them. You can ask for a copy of these safeguards from our contact page.
Data retention
We keep personal information only as long as we need it for the purposes above, or as the law requires:
- The copy of your ledger in your browser — as long as you keep it. Clearing this site's data in your browser removes it, and so does Erase all data in Settings while you are signed in.
- Your synced ledger — until you delete your account. If your subscription ends, your account moves to Free and your ledger is kept.
- If we close your account, its data is deleted as if you had deleted it yourself.
- Band numbers from the withdrawn comparison — until you ask us to delete them.
- Billing records — ours, until your account is gone; Stripe's, as long as tax law requires; Apple's and Google's, under their own privacy notices. Stripe keeps the transaction record, such as the invoice, the amount and the date. Our subscription record holds your plan, its status, Stripe's or the store's identifiers and when it last changed, and it is deleted after your account is deleted.
- A brokerage connection — until you disconnect it, until your subscription lapses, or until you delete your account. Disconnecting ends it at the connection service and deletes what we hold for the connection, apart from a note of the accounts you ended, kept so they are not added back. The positions, cash and balances in your ledger are kept with the rest of your ledger. The record that you agreed to that service's terms is kept through a disconnect or a lapse, and is deleted after your account is deleted.
- Your agreement to the Terms — until you delete your account.
- An assistant connection — until you delete your account. Disconnecting it ends its access at once; the record of the connection stays with your account.
- Messages to support — until you ask us to delete them.
- The contact page's security check — nothing kept by us. Its provider keeps what it sees for its own retention period.
- Snapshot emails — our record, until your account is gone; each email, for our email provider's retention period. Our record is which month we last emailed you about, whether you stopped these emails and when, and the code in your Unsubscribe link.
- Analytics cookies — two years, or until you turn them off.
- Product moments — until you delete your account.
- Server request logs — for a limited period. Our hosting provider keeps them, with the IP address of each request, for its default log retention period.
Data security
We use safeguards designed to protect your information, including encryption in transit and at rest. No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security.
Your rights and choices
Wherever you live, you can ask us for access to, correction of or deletion of your personal information. If the GDPR or UK GDPR applies to you, you also have the rights below. Ask from our contact page, with or without an account.
- Access and portability. Ask for a copy of the personal information we hold about you, and we will send you one, machine-readable and free of charge.
- Deletion. Settings → Delete account cancels a subscription bought on moflow.app and deletes your account, your synced ledger and your sign-in, and erases the copy of your ledger in the browser you use. A copy in another browser you signed in on stays until you clear this site's data there. Erase all data in Settings deletes your ledger and keeps your account. Some records are kept for the periods in Data retention.
- Correction and restriction. Edit your ledger in the app, and your billing details in the billing portal. For anything else, ask us.
- Withdrawing consent. Turn off push notifications or analytics cookies in Settings at any time.
- Objection and complaints. You can object to processing based on our legitimate interests, and complain to the data-protection authority where you live. The Unsubscribe link in each snapshot email stops them.
Children's privacy
Moflow is not directed at children, and we do not knowingly collect personal information from children.
Changes to this policy
We may update this policy. The “last updated” date at the top shows when it last changed. If we ever want to use your data for a purpose this policy does not describe, this policy changes first, and we ask for your consent where the law requires it.
Contact us
To ask about this policy or your personal information, or to reach our privacy officer, write to us from our contact page.
Moflow is operated by Wechill Technology Inc., British Columbia, Canada, referred to in this policy as “we” or “us”.