Privacy
The short version: we do not have your data, and we could not get it if we wanted to.
Effective September 22, 2026.
There is no DohFlow server
This is the whole answer, and it is architectural rather than a policy we could quietly change. DohFlow is a desktop application that reads and writes a file on your Mac. There is no account system, no sync service and no backend that could hold your data, because none was built.
A privacy policy that says “we will not misuse your data” asks you to trust a promise. This one says we never receive it.
What leaves your machine
Exhaustively — these are the only outbound connections the app makes:
| What | When | What is sent |
|---|---|---|
| Bank refresh | Only if you connect an account; after that, automatically each time you unlock your vault (at most once every 6 hours), plus whenever you refresh manually | Your request goes to SimpleFIN, not to us. We are not in the middle and never see the response. |
| Update check | Automatically each time you launch or unlock the app, and any time you check manually | A request to GitHub for the current release. No identifiers — just what any web request inherently reveals (your IP, visible to GitHub as it would to any site). |
Those are the network connections DohFlow itself makes. If you save an encrypted backup in a cloud-synced folder, it leaves your Mac through that provider’s own sync client as ciphertext; it is not an app-managed upload, and DohFlow receives no destination or usage report. The version-2 backup header does contain a stable fingerprint that lets someone who can see the ciphertext correlate backups made before a password rewrap or rekey.
No analytics. No crash reporting. No telemetry. No “anonymous usage statistics.” The update check above does happen automatically, but it carries nothing identifying — there is nothing else to opt out of, because there is nothing else collecting.
We do not run ads, and we have no data to sell. There is no ad network on this site or in the app, and nothing described above could be sold even if we wanted to — the app never sends us anything to begin with.
Do Not Track: this site does not use tracking cookies or cross-site identifiers, so there is nothing for a Do Not Track signal to disable — honoring it and ignoring it produce the same result. We do not respond to it differently either way.
Your financial data
It lives in a SQLCipher-encrypted vault on your Mac, keyed from your passphrase with Argon2id. Backups are encrypted and go wherever you put them. Exports are plain CSV and go where you choose.
If you forget your passphrase, we cannot recover your vault. There is no reset link and no support back door. That is what the encryption being real means.
This website
dohflow.app is hosted on Cloudflare, which — like any host — sees each visitor’s request and IP address in the ordinary course of serving the site. dohflow.app also uses Cloudflare Web Analytics, which is cookieless and does not fingerprint or track visitors across sites. It tells us which pages get read. It does not tell us who you are, and it sets nothing on your device.
No cookies. No consent banner, because there is nothing to consent to.
Third parties you may click into
We don’t send your information to anyone, but some things on this site are genuine links out — once you click, you’re on their site, under their privacy policy, not ours:
- GitHub — the source code, releases, and issue tracker all live at github.com/dohflow.
- SimpleFIN — only if you set up a bank connection inside the app itself, covered above; nothing about this happens by browsing this site.
GitHub Sponsors and Ko-fi are linked from the Sponsor page. If you choose either service, you leave dohflow.app and are subject to that service’s privacy policy; DohFlow does not receive your payment details.
If you email us
Mail sent to hello@dohflow.app or security@dohflow.app reaches a Google Workspace inbox and is kept as long as it is useful. Please do not send real financial data, account numbers or vault files — we do not want them, and a support question rarely needs them.
The technical detail behind this page
The app repository’s privacy fact sheet is checked claim-by-claim against the app’s own code — the exact capability grants that control what it can reach, and the network calls it actually makes. It’s the fuller technical version of this page: the encryption model, the capability configuration, and where the complete threat model lives.
Changes
Material changes will be noted in the changelog. Since the app has no data collection to expand, the realistic change here is a new outbound connection — and that would be a notable event, documented as one.