Flaveola Sovereign Privacy

Privacy Policy

Effective date: September 1, 2026  ·  Last updated: September 12, 2026

Flaveola ("Flaveola," "we," "us," or "our") is a personal finance journaling application that enables you to log expenses and income naturally using your voice, track budgets, and gain behavioral insights. This policy explains what data is processed, how it is handled, the third-party providers we use, and your rights regarding your information. It applies to the Flaveola mobile application (Android / iOS) and associated web properties (flaveola.com / app.flaveola.com).

Flaveola is operated by an independent developer. For questions about this policy or your personal data: contact@flaveola.com.

01The short version & core principles

  • On-device storage first. Your financial transactions, categories, budgets, chapters, and plans reside entirely in local on-device app storage (IndexedDB / LocalStorage). Flaveola's servers do not host or store your expense logs or financial entries.
  • Trial version without accounts. You can use Flaveola's Trial version without creating an account, providing an email, or linking any banking accounts.
  • Ephemeral processing. When you record an entry or query your data, audio recordings, transcripts, and query texts are processed in-memory solely to parse your transaction or answer your request. Audio and transcripts are never permanently stored on our servers.
  • Zero third-party trackers or ads. We do not integrate third-party advertising SDKs, tracking pixels, or behavioral analytics scripts.
  • Minimal account data (Executive users). For subscribers who link an account, we collect only the minimum credentials necessary (email address) to authenticate subscription status and manage AI token quotas across authorized devices.

02Information Flaveola processes and collects

  • Voice recordings (ephemeral). When you use voice logging, your microphone records audio. This audio is transmitted securely over TLS/HTTPS to our transcription partners (Google Gemini API, with ElevenLabs as a standby fallback) to convert speech into text. Flaveola's servers do not write this audio to disk, log it, or retain it. When processed by our standby partner, an automated API-level deletion request is executed immediately upon transcription completion.
  • Transcripts and parsed entries (ephemeral). The transcribed text is sent securely over TLS/HTTPS to our AI partner (Google Gemini API) to structure the entry — amount, category, merchant, date, and notes. The structured entry is returned directly to your device and saved in local storage. Transcripts are not logged on Flaveola's servers.
  • Conversational queries & narrative reflections (ephemeral). When using conversational tools like "Ask Flav" (AI Chat), Memory Lane synthesis, or seasonal behavioral reflections, relevant aggregated summary data (e.g., category totals, budget progress, or user notes) is sent ephemerally to the Google Gemini API to formulate responses. This data is not retained by the AI provider to train foundation models.
  • Manual entries. Manually typed entries are saved directly to your device's local storage and are never sent to transcription or AI parsing APIs.
  • Trial & Executive version installation identifier & platform. Flaveola generates a pseudonymous, randomized app-instance identifier stored server-side to enforce AI token quotas and track trial periods. We also receive basic platform metadata (e.g., Android, iOS, Web) to deliver compatible features. This identifier is never linked to your personal identity, contact details, or financial entries.
  • Executive account information. If you link an email or subscribe to the Flaveola Executive tier, we store your email address (authenticated via secure passwordless email OTP), your account identifier (UUID), subscription tier, and monthly AI credit balance in our database. We do not collect or store passwords or payment card details — payments are handled entirely by Apple App Store or Google Play In-App Purchases.
  • What Flaveola never collects. We never collect bank account numbers, credit card credentials, contact lists, or precise GPS location data.

03How we use information

We use processed data exclusively to:

  • Transcribe voice notes into text via API and extract structured financial entries.
  • Answer user-initiated queries about their own spending patterns ("Ask Flav") and generate behavioral reflections.
  • Manage and enforce AI token usage quotas for Trial and Executive tiers.
  • Authenticate Executive subscriptions across authorized user devices.
  • Deliver user-scheduled on-device reminders (notifications run locally without server tracking).

Because your financial entries are stored locally on your device, Flaveola does not collect, store, sell, or share your financial data with third-party advertisers or data brokers, nor is it ever used to train AI models.

04Third-party service providers

Flaveola relies on a limited set of external processors over encrypted connections (HTTPS/TLS):

Google Gemini API — Primary Voice Transcription, AI Parsing & Conversational Queries

Converts audio to text, parses text transcripts into structured expense data, and answers conversational financial queries when requested. Flaveola uses paid API endpoints; Google does not use data submitted through billed API projects to train its foundation models. Google temporarily retains requests solely for security and abuse detection.

ElevenLabs — Standby Voice Transcription

Serves as a standby speech-to-text engine in case the primary Gemini STT service is unavailable. Converts audio to text. Flaveola sends an automated API-level deletion request immediately upon transcription completion. Flaveola has opted out of account-wide model training. Audio processing occurs primarily in the United States under Standard Contractual Clauses (SCCs) and Data Processing Addendums.

Google Drive API — Optional Cloud Backups

If you choose to enable automated Google Drive backups, Flaveola connects to Google APIs via OAuth to save backup snapshots directly inside your private Google Drive folder (Flaveola Backups).

Supabase & Vercel — Backend Infrastructure & Authentication

Flaveola's API routing runs on Vercel. Account authentication, subscription status, Google Drive connection tokens, and usage counters are maintained in a secure Supabase database. Neither provider stores your voice recordings, transcripts, or financial transactions.

05Data storage, security & backups

  • On-device storage. All transaction entries, budgets, chapters, and personalized plans are stored in sandboxed local application storage (IndexedDB / LocalStorage) on your device.
  • In-transit encryption. All network communication between the app, our backend relays, and third-party APIs is encrypted using TLS/HTTPS.
  • Device access controls. Flaveola offers optional PIN and biometric app-lock controls (Face ID, Touch ID, or Android Biometrics via WebAuthn / Platform Authenticator). Biometric verification is performed locally by your device's secure enclave; no biometric data ever leaves your device.
  • Encrypted local backups. When exporting data locally, Flaveola supports client-side passphrase encryption (PBKDF2 with 100,000 iterations + AES-GCM 256-bit). Your encryption passphrase is known only to you and is never transmitted or stored on any server.
  • Cloud backups (Google Drive). If you enable cloud backup, your snapshot is securely relayed to your personal Google Drive account. Flaveola stores only your OAuth connection token in Supabase to facilitate syncing; your backup files are not permanently stored or read on Flaveola's servers.

06Financial & banking disclosures

Flaveola is not a bank, broker, or financial institution. We do not link directly to bank accounts via Open Banking or financial aggregation services.

07Notifications & device permissions

  • Microphone permission. Used exclusively while actively recording voice notes to log expenses. Flaveola never records audio in the background.
  • Local notifications. Scheduled reminders (daily logging reminders, upcoming bill due alerts) are managed entirely on-device via local operating system alarms. We do not operate push notification servers or track push tokens.

08Children's privacy

Flaveola is not directed to individuals under the age of 13 (or 16 where applicable by local law), and we do not knowingly collect personal information from children.

09International data transfers

Because our third-party infrastructure and AI processors operate globally (primarily in the United States), your voice audio, query text, and transcript data may be transferred across international borders during processing. These transfers are executed under applicable Data Processing Agreements and standard contractual safeguards.

10User data controls & account deletion

  • Editing and deleting transactions. You can modify or delete any expense, category, chapter, or budget directly within the app at any time.
  • Local data removal. Uninstalling the app, clearing application cache, or selecting "Reset All Local Data" permanently removes all locally stored financial records from your device.
  • Account deletion (Executive tier). In compliance with App Store and Google Play requirements, registered users can permanently delete their account and associated metadata (email, usage counters, Google Drive connection tokens, and authentication records) at any time via the "Delete Account" option in app settings.

11Governing law

This Privacy Policy and any related disputes shall be governed by and construed in accordance with the laws of India, without regard to conflict of law principles.

12Changes to this policy

We may update this policy to reflect operational or regulatory changes. We will revise the "Last updated" date at the top of this page accordingly. Material changes will be communicated via an in-app notice.

13Contact us

For questions regarding this policy, data processing practices, or account deletion:

Email: contact@flaveola.com
Website: flaveola.com