Private by design

Privacy Policy

Short version: your budget is encrypted on your device with a passphrase only you know, before anything syncs. We can't read it — and that's the point.

Effective July 18, 2026

What JayCK Flow is

JayCK Flow is a financial calendar. You enter incomes, bills, and plans yourself; the app projects your future balance. There are no bank connections, no imports of your credentials, and no advertising.

Data that never leaves your device unencrypted

Your budget — transactions, categories, balances, savings, debts — lives on your device. If you enable sync, it is encrypted on your device with a passphrase only you know before anything is uploaded. Our server stores an opaque encrypted blob plus a revision number and timestamps. We cannot decrypt it, and we cannot recover your passphrase. JayCK Flow is designed so that we cannot access the contents of your encrypted financial data.

Data we do store (only if you create an account)

• Email address — your sign-in identity and where verification / password-reset codes are sent.
• Password — stored only as a strong one-way hash using scrypt with appropriate security parameters, never as plain text.
• Sign in with Apple / Google — if you use them, we store the provider's account identifier and the email the provider attests. Apple may provide a private relay email address instead of your actual email address. We never receive your Apple or Google password.
• Subscription status — whether sync is active and until when, verified through Apple's App Store transaction system. We do not process payments directly and never receive your payment card information.
• Encrypted vault — the unreadable blob described above.

Using the app without an account stores nothing on our servers at all.

What we don't do

• No analytics or tracking SDKs, no advertising, no selling or sharing of data.
• No reading of your budget — our design gives us no technical means to.
• No marketing emails. We email you only codes you request (verification, password reset) and replies to your support messages.

Security

All traffic uses TLS. On-device secrets (your session and passphrase) are kept in the iOS Keychain. Server-side, passwords are scrypt-hashed and session tokens are stored hashed and rotated. Our emails contain only short one-time codes — never links to click — and we will never ask for your password or passphrase.

Retention and deletion

We retain account information while your account remains active. You can delete your account from inside the app (Account & sync → Delete account). Deletion requests are processed immediately: the account record and your encrypted vault are removed from our servers, except where limited retention is required by law. Data on your own device stays yours until you delete the app or its data.

Legal basis for processing (EEA/UK users)

If you are in the European Economic Area or the United Kingdom, we process your personal data on these legal bases: to provide the service you requested — creating your account and running sync (performance of a contract); to keep the service secure and prevent abuse (legitimate interests); and consent, where the law requires it (for anything optional). We do not run advertising or analytics, so we do not process your data for those purposes.

Your privacy rights (EEA/UK)

Under the GDPR and UK GDPR you have the right to: access a copy of your personal data; correct inaccurate data (rectification); delete your data (erasure); restrict or object to certain processing; and receive your data in a portable format (portability). You can already export your data locally at any time from the app, and delete your account and its server data from inside the app (Account & sync → Delete account). For any other request, or to exercise these rights, email us at support@jayck.dev; we respond within the timeframes the law requires. You also have the right to lodge a complaint with your local data protection authority.

Data Controller

The controller responsible for your personal data is:

Company: JAYCIKEY LLC
Location: Florida, United States
Email: support@jayck.dev

International data transfers

We are based in the United States and our servers are located in the United States. If you use JayCK Flow from the European Economic Area or the United Kingdom, your information (your email, password hash, and the encrypted vault blob) may be processed in the United States, outside the EEA/UK. Where required, we rely on appropriate safeguards for international transfers, which may include Standard Contractual Clauses approved by the European Commission. Importantly, your financial data in the encrypted vault is encrypted on your device before upload and remains inaccessible to JayCK Flow, wherever it is stored.

California privacy rights

California residents may have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we hold, to delete it, to correct it, and to opt out of certain data sharing as defined under applicable California privacy laws. JayCK Flow does not sell or share your personal information for advertising purposes. To exercise any of these rights, email support@jayck.dev.

Your choices

• Use the app fully offline, with no account.
• Export your data locally at any time from the app.
• Delete your account and server data at any time, in-app.

Children

JayCK Flow is not directed at children under 13, and we do not knowingly collect their data.

Changes

If this policy changes, the new version will be posted here with an updated effective date. Material changes will be noted in the app's release notes.

Contact

Questions about privacy:
JAYCIKEY LLC
Florida, United States
support@jayck.dev