Privacy Policy

Information stored on your device and in iCloud

Flower stores transactions, categories, wallet and card information, recurring items, separate ledgers and their budgets, investment accounts, instruments, activity and plans, prediction history, personal profile preferences, app preferences, document folios and saved documents, and installed visual skins on your device. Flower does not sell this information or use it for advertising.

With active Flower Plus, supported data syncs automatically through your private iCloud database when iCloud is available to Flower on your device. You may need to reopen Flower after activating Flower Plus. Synced data includes records, wallets, categories, tags, ledgers and their budgets, card-holder customization, earned embossing marks, category artwork, saved location coordinates and place names, personal profile data, and synced app settings, so your Apple devices can present the same state. Photos you attach to records, their previews, and the Original or Cutout versions prepared for monthly recaps are stored as private CloudKit assets when this sync is active. Document folios and saved documents, including their filenames, file-type information, contents, and generated previews, are stored on your device and sync to your private iCloud database under the same conditions. The private database belongs to your iCloud account, counts toward your iCloud storage, and is not visible in the developer portal. Flower does not copy this data to a separate account or financial-data server operated by Flower. Device-only settings such as transient UI/session state and the selected location-detail level remain local.

Optional location context may be used to attach a place to a new record and improve on-device transaction predictions and place insights. Before automatic location starts on a device, Flower asks you to choose between Precise place and Approximate area. Precise place requests the best accuracy iOS allows, normally around 10 metres. Approximate area rounds the coordinates Flower saves to roughly 100 metres. The accuracy iOS supplies can be lower because of system settings, signal conditions, and the surrounding environment. You can change this choice or turn automatic location off in Flower Settings. The change applies to newly saved locations and does not alter existing records.

Flower uses Apple's Core Location, Maps search, and geocoding services to obtain coordinates, find places, and resolve place names. Apple may process location and search information under Apple's privacy terms. Saved locations remain on your device unless private iCloud sync is active, in which case they sync as part of your ledger as described above. Flower does not send location data to its exchange-rate or investment-icon providers or copy it to a Flower-operated server.

Camera and photo-library access may be used to scan receipts or attach photos to records. Receipt recognition and Cutout processing run locally. The photos you choose, their previews, and recap versions remain on your device unless private iCloud sync is active, in which case they sync as private CloudKit assets as described above. Flower does not send them to its exchange-rate or investment-icon providers or copy them to a Flower-operated server.

If you save a spending map card as a Live Photo, Flower asks for add-only Photos access. It creates the card on your device and adds it to your library; add-only access does not let Flower see, read, or change your existing photos.

Profile, avatars, and personal insights

Your optional profile can include a name, a photo you choose, or an avatar assembled from Flower's bundled artwork. Photo preparation and avatar rendering happen on your device. Flower does not send your profile photo or avatar choices to an online image-generation service.

Personal insights are derived from your records and saved places on your device. You can name, confirm, hide, or adjust supported insights and personal areas. Your saved profile, avatar, personal-area labels and regions, and related preferences are stored locally and, when Flower Plus iCloud sync is active, in your private iCloud database. They are not sent to Flower's exchange-rate or investment-icon providers or copied to a Flower-operated server.

Exchange rates and network metadata

Flower downloads public exchange-rate files from the Currency API through the jsDelivr content-delivery network, with a Cloudflare-hosted fallback, when rates refresh automatically or when you request a refresh. The request identifies the selected base currency in the URL and includes ordinary network metadata.

The delivery providers may process the IP address, requested CDN URL, request date and time, client type, unique device identifiers, and diagnostic data to deliver, secure, and troubleshoot the exchange-rate service. Flower does not send transactions, amounts, balances, wallet names, categories, notes, receipts, photos, or location data with these requests.

This network metadata is used only for app functionality and service operation. Flower does not use it for advertising or tracking. jsDelivr acts as a service provider and states that it does not sell personal data. Its data-processing terms are available at https://www.jsdelivr.com/documents/data-processing-agreement.pdf.

Optional online investment icons

Flower includes a bundled investment-icon catalog that works without a network request. If you deliberately search for an additional icon, Flower sends the search term or ticker symbol to LoadLogo over HTTPS. If you select an online result, Flower requests its image using the returned company domain. The image is cached on your device for up to 30 days. Flower does not attach transactions, units, prices, balances, notes, or your name to these requests.

LoadLogo states that its request logs can include queried domains or ticker symbols, IP addresses, user-agent strings, and timestamps; that these logs are retained for 30 days for rate limiting, abuse prevention, and service improvement; and that its brand search may use third-party infrastructure, including OpenRouter for AI-powered brand resolution. This processing occurs only when you use an online icon or Flower needs to reload one you selected. It is used for app functionality, not Flower advertising or tracking. LoadLogo's current policy is available at https://www.loadlogo.com/privacy.

Face ID

If you enable Wallet privacy, iOS may use Face ID to confirm that you can reveal protected amounts. Flower receives the authentication result, not biometric data. Biometric data is managed by Apple and never becomes available to Flower.

Purchases

Purchases are processed by Apple, and Flower does not receive your payment-card number. In RevenueCat-enabled versions, Flower uses RevenueCat to retrieve the Flower Plus products, start an Apple purchase, restore purchases, and receive the resulting Flower Plus entitlement status. Apple remains the source of the transaction, price, currency, renewal terms, refund, and revocation facts; RevenueCat CustomerInfo is Flower's normal service-layer authority for whether the flower_plus entitlement is active.

RevenueCat acts as Flower's service provider for subscription functionality and subscription lifecycle analytics. RevenueCat may process Apple purchase history and transaction information, a randomly generated anonymous customer identifier, IP address, Identifier for Vendor (IDFV), and ordinary device, app, and network technical information. RevenueCat 5.89.0 sends IDFV in a technical request header even though Flower disables automatic attribution-identifier collection. IDFV is not Apple's advertising identifier (IDFA). Flower does not provide RevenueCat with your name, email address, IDFA, or a Flower account identifier; Flower does not call RevenueCat login APIs, set customer attributes, enable RevenueCat diagnostics, or enable an advertising-attribution integration. Purchase history and IDFV are used for subscription functionality and analytics, are not linked by Flower to your identity, and are not used for tracking across apps or websites.

Flower may ask RevenueCat to synchronize existing App Store purchase history for a versioned migration and uses RevenueCat for an explicit restore. During migration or a temporary service/configuration mismatch, Flower protects a still-valid, independently verified Apple entitlement while it reconciles the RevenueCat result. A confirmed expiration, refund, or revocation is not hidden by that protection. RevenueCat's information for end users is available at https://www.revenuecat.com/privacy.

On-device intelligence

Category prediction, receipt and screenshot recognition, voice recording and sentence search run on device. Voice is transcribed by Apple's on-device speech recognition; Flower does not use server-based speech recognition. On iPhones with Apple Intelligence, Flower also uses Apple's on-device language model to fill in record fields, suggest categories and turn a search sentence into filters; these requests are processed on the iPhone. Apple may download the language or speech models the system needs. Flower does not send financial documents, transcripts or search text to a third-party AI service.

Tracking and analytics

Flower does not track you across apps or websites and does not include advertising. In Firebase-enabled versions starting with Flower 1.5.0, Flower uses Google Analytics for Firebase to understand which features people discover and use, where onboarding or purchase flows are abandoned, and how to improve the app. The service receives feature and screen names, predefined choices, onboarding progress, Flower Plus screen sources and purchase outcomes, and broad ranges for usage counts, time since first use of the analytics-enabled version, and time spent on a subscription screen. User properties include membership status, app language, base-currency code, iCloud-sync status, and ranges for record and discovered-feature counts.

Firebase assigns a random app-instance identifier to measure activity across sessions. It also processes ordinary app/device technical information and derives a general geographic area from network IP addresses. This general area is separate from the saved coordinates and place names in your ledger. Flower does not give Firebase your name, email, account identifier, or private CloudKit identifiers, and does not set a Firebase User-ID or connect Firebase identifiers to RevenueCat customer identifiers. The analytics SDK used by Flower does not include Apple's advertising identifier (IDFA), and Flower turns off the SDK's collection of the identifier for vendor (IDFV) and its ad-network (SKAdNetwork) attribution registration. Google signals, advertising personalization, and user-provided data collection are intended to remain off. Analytics event and user data are kept for 14 months in Google Analytics and then deleted.

Flower's custom analytics events do not contain ledger amounts, balances, transaction titles, notes, category names, saved places or coordinates, account or ledger names, search words, receipt text, photos, or documents. Separately, Firebase may automatically measure purchases and subscriptions made inside the app through StoreKit, including the product identifier, product name and price. These are purchases of Flower products, not the financial records you enter in your ledger.

In the European Economic Area, the United Kingdom and Switzerland (decided by your App Store country), usage sharing stays off until you choose to share; Flower asks once during its welcome guide, with equal choices to share or not. Elsewhere usage sharing is on by default. You can change it at Settings → Privacy protection → Share anonymous usage data （设置 → 隐私保护 → 分享匿名使用数据）. The choice is stored on this device and does not disable record keeping or Flower Plus. The switch-off action is recorded before collection stops. Turning sharing off stops subsequent analytics collection; it does not automatically erase information already received by Google or remove the usage log stored on your device. A random app-instance identifier allows sessions to be grouped; the setting name does not mean that every event is irreversibly anonymous. Google's privacy policy is available at Google Privacy Policy, with service-specific information at Privacy and Security in Firebase.

RevenueCat processes purchase history for subscription app functionality and analytics. Flower uses its bundled Flower Plus screen and does not send a general stream of in-app behaviour to RevenueCat. If a future Flower version enables a RevenueCat-hosted subscription screen, RevenueCatUI may record interactions limited to that screen and the purchase lifecycle, such as paywall encounters, package selection, purchase initiation and outcome, restore, dismissal, conversion, and abandonment. Flower does not send RevenueCat transactions from your ledger, amounts, balances, merchants, categories, accounts, ledgers, assets, locations, OCR text, receipt photos, attachments, or private CloudKit identifiers.

The exchange-rate delivery providers process the limited network metadata described above, and LoadLogo processes optional icon queries and request metadata, for app functionality rather than advertising. Private iCloud synchronization uses Apple's CloudKit service; Flower does not copy that private database into RevenueCat or a developer-owned analytics, advertising, or financial-data service. Firebase receives only the analytics information described above, not a copy of the private CloudKit ledger.

Data control

You can edit or delete records and assets in Flower. Removing the app normally removes its local container. If iCloud sync was active, the user's private iCloud database and Apple-managed device or computer backups may retain copies according to Apple's storage and deletion behavior. Back up important records before deleting the app.

For questions or applicable access or deletion requests concerning third-party network metadata or Firebase analytics, contact Flower using the address below. Flower will assess the request and route it to the relevant provider when necessary. Turning off usage sharing is separate from requesting deletion of previously collected analytics data.

RevenueCat's random customer identifier normally changes after the app is uninstalled and reinstalled. Removing Flower, disabling a future runtime gate, or cancelling an Apple subscription does not by itself delete purchase history already processed by RevenueCat. For an applicable access or deletion request, contact Flower below so the request can be assessed and routed. Deleting data from RevenueCat does not cancel an Apple subscription; Apple subscription management remains separate.

Children

Flower is a general personal-finance tool and is not directed to children under 13. Flower does not knowingly collect children's data.

Changes

Material changes will be reflected by a new effective date and, when required, an in-app notice. Users should review the policy supplied with each release.

Contact

For privacy questions, contact Zhiwen Huang at zhiwen.build@gmail.com.