Privacy policy

What we collect

Cash Flow Positive stores only what it needs to work:

• Your email address, used to sign you in and to send low-balance alerts and monthly check-ins

• Only the numbers you type in or import yourself: account names and balances, scheduled income and bills, and your alert threshold

• CSV files you upload are kept only long enough to import them and are deleted automatically within 7 days

• Billing status from our payment provider (never card numbers)

• In the store apps, a subscriber id that links an in-app purchase to your account

• We never ask for bank passwords and never connect to your bank — there is no bank linking

Product analytics

To learn which features to improve or remove, Cash Flow Positive collects a small amount of anonymous usage data. Our own usage counts use no cookies and no third-party service; any optional scripts described above are separate and load only with your consent.

What is collected: a random session id that lives only in the current browser tab (never a user id or email address), the pages you visit (the path only, never the address bar’s query string or anything you type), which buttons and forms are used (by their internal names, never their text or values), error messages with email addresses, numbers and anything resembling a credential removed, your device type (phone or desktop, iOS, Android or desktop) and the app version.

Individual events are stored in our own database for 90 days and then deleted automatically. Daily totals (how many times each page, button or error was seen that day, with no session id) are kept so we can see trends. IP addresses are not stored.

Opting out: your browser’s Do Not Track and Global Privacy Control signals are honored automatically, and you can switch analytics off for your browser at any time with the "Share anonymous usage data" checkbox in Settings.

Who processes it

We use these service providers to run Cash Flow Positive: Amazon Web Services (hosting, email), Stripe (payments on our website, as merchant of record), RevenueCat (in-app purchase processing in the store apps), Apple App Store and Google Play (in-app payments).

RevenueCat (in-app purchase processing in the store apps): receives the subscriber id that links a store purchase to your account, the purchase receipt or token, the subscription status, the device platform and the IP address of the request.

Apple (App Store) and Google (Google Play) take payment for subscriptions bought inside the app, under their own terms and privacy policies; we never receive your card details.

We do not sell your data. We do not use it for advertising, except in products whose own privacy page says they show ads.

Deleting your data

Account owners can delete the account and its data at any time from Settings. Deletion removes the account and its content from the live service; a deleted account can remain in our backups until they expire.

We keep a record of each time you ticked an "I agree" box (your email address, the terms version, the statement shown, the time and a one-way hash of your IP address) for six years from when it was made or, if later, six years after the account is deleted. We keep it, also after deletion, because we have a legitimate interest in being able to show what was agreed, and to establish, exercise or defend legal claims.

We also keep a record of the deletion (when, by whom, and the payment provider's customer and subscription ids) for 1 year, and, if the account had a free trial or a paid plan, a one-way hash of the owner's email address for 2 years from when it was first recorded (the first free trial, or the deletion of an account that had paid) so that a free trial is offered only once per person.

Children

Cash Flow Positive is for people aged 13 and older (16 and older in the EU). It is not directed at children under 13; we do not knowingly collect their data. If you believe a child under 13 has given us information, email support@chimneytopdigital.com and we will delete it.

Changes to this policy

We may update this policy as the service changes; the effective date above shows the current version. For a material change, such as collecting a new kind of data or sharing data with a new kind of service provider, we will tell account holders by email or by a notice in the service at least 30 days before it takes effect, and where the law requires it we will ask for your consent first. Earlier versions are available on request.

Contact

Questions: support@chimneytopdigital.com