Privacy Policy

Last updated: [DATE]

Fluve holds things that matter: what you spend, who you share it with, who owes whom. This policy says what we collect, why, who else handles it, how long we keep it, and what you can do about it. The short version: we collect what Fluve needs to work, we don't track you, we don't show ads, and we never sell your data.

Fluve is made by [COMPANY NAME] ("we", "us"), NIF [NIF], in Spain. We are the controller of your personal data under the EU General Data Protection Regulation (GDPR). This policy covers the Fluve apps, the website at fluveapp.com, and the services behind them.

What we collect and why

Your account

When you sign up we store your name, your email address, and either a password (stored only as a one-way hash, never in plain text) or the account you signed in with at Apple or Google. From Apple or Google we receive your name, email address and an account identifier; nothing else.

You can add a profile photo, and choose your language, currency and time zone. Your time zone is used to put expenses on the right day and to run repeating expenses on time.

We use this to run your account, to show your name and photo to the people you share groups with, and to send you the notifications and emails that belong to using Fluve. We don't send marketing emails today. If we start, we'll only send them if you agree, and you can stop them at any time.

Expenses, groups and comments

Everything you add to Fluve is stored on our servers so it's there on all your devices and for the people you share it with: groups and their names, expenses, amounts, currencies, notes, dates, splits, settlements, repeating expenses and comments. We also keep an activity history for each group (who added, changed or settled what), because that history is part of how a shared group stays trustworthy.

To make Fluve searchable, we keep a search index of your expenses (notes, amounts, dates, and the names of the people involved). To sort expenses into categories automatically, we send the expense's note to our AI provider as you wrote it, without anything that identifies you (see below).

Receipt scanning

When you scan a receipt, the photo is sent to our AI provider, which reads the total, currency, date and a short description off it. We don't store the photo. It's held in memory while it's read, then discarded. We keep the result it returned and a small record of the scan (when it happened, the photo's file size and format, and whether it worked) so we can find and fix problems.

Inviting people

When you invite someone by email, we store their email address with the invitation and send them one email, from Fluve, that names you and the group and contains a link to join. We don't use their address for anything else, and we don't send them reminders unless you choose to send the invite again.

If you pick someone from your phone's contacts, Fluve reads your contacts on your device only to show you the list. Only the email address of the person you pick is sent to us. We never upload the rest of your address book.

Notifications

If you allow notifications, we store a push token from Apple for your device so we can tell you when something happens in your groups. The notification text (for example who added an expense, the amount and the note) passes through Apple's push service to reach your phone. You can turn notifications off at any time in your phone's settings.

Signing in and security

When you sign in we store a session, with your device's IP address and the type of device and app, so you can see and end your sessions and so we can spot misuse. We also use IP addresses and account ids, briefly, to limit how often requests can be made, which protects Fluve from attacks.

Errors and crashes

When something goes wrong in the app or on our servers, an error report is sent to our error-reporting services so we can fix it. On our servers these reports carry your account id but not your name, email or IP address. In the app, a report can include your account details, device and app version, the steps that led to the error, and a screenshot of the screen at the moment it happened, which may show what was on it. We use these only to find and fix bugs. [REVIEW: the app currently sends screenshots and personal details with error reports. Turn these off, or keep this paragraph.]

The website

The website uses one cookie, to keep you signed in, and remembers your light or dark mode choice in your browser. It has no analytics, advertising or tracking cookies.

What we don't do

We don't use advertising or tracking tools, and we don't track you across other apps or websites. We don't use analytics today; if we add it, we'll update this policy first. We don't sell your data, share it for advertising, or use it to build a profile of you. We don't use your data to train AI models, and our AI provider doesn't either.

Why we're allowed to (legal basis)

• To provide Fluve to you (performance of a contract, GDPR art. 6(1)(b)): your account, your groups and expenses, receipt scanning, search, categories, notifications and invites you send.
• Our legitimate interests (art. 6(1)(f)): keeping Fluve secure, preventing abuse, fixing bugs, and sending the invite email someone asked us to send to you. We've weighed these against your privacy, and they're limited to what's needed.
• Your consent (art. 6(1)(a)): access to your camera, contacts and notifications, which your phone asks you for and which you can withdraw in its settings at any time.
• Legal obligations (art. 6(1)(c)), where the law requires us to keep or hand over information.

Who else handles your data

We use a small number of service providers to run Fluve. They handle your data only on our instructions, under data processing agreements, and only for the purposes below:

• Hosting and storage: the servers that run Fluve, store its database and search index, and store profile photos.
• Network and security: protecting Fluve from attacks and delivering it quickly.
• AI: reading receipt photos and suggesting categories from expense notes. Our AI provider may not use this data to train its models, and deletes it after a short period. [CONFIRM against the provider's current terms]
• Email delivery: sending invite emails.
• Sign-in and notifications: Apple and Google, when you sign in with them, and Apple's push service for notifications.
• Error reporting: reports from the app and our servers, so we can find and fix bugs.

If you'd like to know which companies we use for any of these, write to us at [PRIVACY EMAIL] and we'll tell you.

Beyond these, we share your data only when you tell us to (by adding it to a group, the members of that group see it), or when the law requires us to, for example a valid order from a Spanish court or authority. If Fluve is ever sold or merged, we'll tell you before your data moves to a different company or becomes subject to a different policy.

Transfers outside the EU

We keep your data in the EU where we can. Some of our service providers are based outside the EU, mostly in the United States, so some data may be processed there. When it is, the transfer is protected by the EU–US Data Privacy Framework where the provider is certified under it, or by the European Commission's Standard Contractual Clauses.

What other people see

Fluve is made for sharing. People in a group with you see your name, profile photo, and the expenses, receipts' results, comments and activity in that group. People you invite see your name and the group's name in the email. Your personal group is visible only to you.

How long we keep it

• Your account and content: for as long as your account exists.
• Deleted expenses: removed for good 30 days after you delete them.
• Sessions: deleted when they expire, within 30 days of your last use.
• Notifications: deleted 30 days after they're sent (90 days if delivery failed).
• Sent emails: the record is deleted 30 days after sending.
• Receipt photos: never stored.
• Error reports: kept for up to [90 days, CONFIRM].
• Invitations: kept with the group, so members can see who was invited. [REVIEW: consider removing the invitee's email once an invite is accepted, declined or has expired]

When you delete your account

You can delete your account from Profile in the app. It happens straight away:

• Your sign-in details, sessions, push tokens, receipt-scan records and any invitations sent to you are deleted.
• Your name, email address, profile photo and preferences are erased. Your profile photo is deleted from storage within 48 hours.
• You're removed from every group. Groups where you were the only member, and your personal group, are deleted with everything in them.
• In groups you share with others, the expenses you were part of stay, so everyone else's balances remain correct. They show you as "Former member", with no name, photo or email.
• If you signed in with Apple, we tell Apple to revoke Fluve's access.

A few copies take a little longer to disappear: notifications other people received about you are deleted within 30 to 90 days, and our backups are overwritten within [CONFIRM backup retention].

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you, and get a copy of it;
• correct it, most of which you can do yourself in the app;
• delete it, which you can do yourself by deleting your account;
• restrict or object to how we use it;
• take it with you in a machine-readable format (data portability);
• withdraw your consent at any time, where we rely on it.

To use any of these rights, email [PRIVACY EMAIL]. We'll answer within a month, and may ask you to confirm it's really you first. If you think we've handled your data wrongly, please tell us. You also have the right to complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es) or the data protection authority where you live.

If you were invited to Fluve by someone and don't have an account, you have the same rights over your email address. Write to us and we'll remove it.

Security

All traffic to and from Fluve is encrypted with TLS. Passwords are stored as one-way hashes. Access to our servers and database is limited to the few people who need it to run Fluve, and we only look at an account's content when fixing a problem you've reported, investigating abuse, or when the law requires it.

Children

Fluve is not meant for children under 14, and we don't knowingly collect data from them. If you believe a child has created an account, contact us and we'll delete it.

Changes to this policy

When we change this policy, we'll update the date at the top. If a change is significant, we'll tell you in the app or by email before it takes effect.

Contact

Questions about this policy or your data? Write to us at [PRIVACY EMAIL].

[COMPANY NAME] · NIF [NIF] · [ADDRESS] · [COMMERCIAL REGISTRY DETAILS]

Parts of this document are adapted from Basecamp's open-source policies, licensed under CC BY 4.0.