Privacy Policy

Last updated: 27 October 2026

GintiFlow ("we", "our", "the app") helps Indian freelancers and small business owners create invoices, get paid, and track their money. This page explains what information the app collects, why, and what we do — and don't do — with it.

Who this applies to

This policy covers the GintiFlow mobile app and the gintiflow.com website. It applies whether you use Business mode (invoices, clients, items and GST) or Personal mode (goals, portfolio, budget and calculators).

Information you provide

Account sign-in. You sign in with Sign in with Apple, Google, or an email address and password. We receive your name and email address; for an email sign-up you also set a password, which we store only as a salted hash. Apple and Google may let you hide your real email behind a private relay address — we support that.
Linked sign-in methods. If you sign in with Google or Apple using an email address that already has a GintiFlow account, and Google or Apple confirms that address is yours, we connect the new sign-in to that same account instead of creating a second one. To do this we keep a record of which sign-in methods belong to your account (the provider's account identifier and the confirmed email address). Nothing else is shared with or received from Google or Apple.
Your profile. Full name, contact email, and — in Business mode — business name, business phone, registered address, GSTIN, whether you are under the GST composition scheme, UPI ID, bank details and a logo. All are optional and entered by you, and the business ones are used only to put on your own invoices. A phone number must be a valid Indian mobile or include its country code, and a GSTIN is checked for typing mistakes; neither is looked up with any outside service.
Your business logo (optional). If you add a logo, you choose one image through your phone's or browser's own photo picker — the app can see only that one image, never the rest of your photos, and needs no photo-library permission. The image is resized on your device and stored on our servers with your account, solely to print on your invoices. You can remove it at any time from Profile (app) or Business details (website), and it is deleted with your account. On the free invoice generator at gintiflow.com, a logo you add is used only to produce that one PDF and is not stored.
Client information. The name, company, email, phone number, GSTIN, address and state of people you invoice — whatever you choose to enter. The state decides whether CGST + SGST or IGST applies. The phone number is used only to open WhatsApp with a pre-filled reminder message — see "How WhatsApp reminders work" below.
Invoices, credit and debit notes, and payments. Line items, amounts, any discount, GST, invoice and due dates, the payments you record, and any credit or debit notes you issue (including the reason you type for each). If you fill them in, also the buyer's order (P.O.) number and date, how the goods travel, and the vehicle number, which print on the invoice.
More than one business (optional). You can add up to three businesses to one account. Each keeps its own business name, GSTIN, address, phone, logo, UPI ID and bank details, with its own clients, invoices and documents. They are all deleted with your account.
E-way bill files. The transport details you type to make an e-way bill file (distance, PIN codes, transporter) are used only to build that one file and are not stored. GintiFlow never logs in to the e-way bill portal and never asks for your portal password.
Purchase bills. If you add them: the supplier's name and GSTIN, their bill number and date, the items, amounts and GST, and your notes. Used only to work out your GST on the GST page.
Quotations and delivery challans. The same kind of details as an invoice (client, items, amounts, GST, dates, your notes), plus how long a quotation's price holds or why goods moved on a challan.
Your item list. The products and services you save to reuse on invoices — name, price, GST rate, HSN/SAC code and unit. It is a price list only; GintiFlow does not track stock.
Personal mode data (optional). Goals, your monthly income and budget plan, and the assets you choose to track — gold, FD, RD, chit funds, property, or anything else you enter. You enter every figure yourself; we don't pull live prices from anywhere. The calculators run on your phone or in your browser, and the numbers you type into them are not sent to us unless you save a result as a goal.
When you last used GintiFlow. The time you were last signed in to the app or the website, and which of the two. We use it to count how many people use GintiFlow, and to see whether new accounts got started, so we can improve the app. Only the people who run GintiFlow can see it, and it is deleted with your account.

How WhatsApp reminders work

When you tap "Nudge" or "Remind" on an overdue invoice, GintiFlow opens WhatsApp on your own phone with a message already typed in, addressed to your client's number. You choose whether to send it. GintiFlow never sends WhatsApp messages on your behalf, doesn't use the WhatsApp Business API, and doesn't see whether the message was actually sent or read.

What we don't do

We don't run ads, and we don't sell or rent your data to anyone.
We don't use AI, machine learning, OCR, or receipt scanning on your data.
We don't pull live market data — no stock prices, NAVs, or gold rates. Every number in Money Tools is one you typed in yourself.
We don't collect money on your behalf. Invoices show your own UPI ID or bank details; your client pays you directly.
We don't file GST returns or send anything to the GST portal. The GST summary and the spreadsheet you can download are figures for you or your accountant to use; you remain responsible for your returns.
We don't read your bank account, SMS or email.

Cookies and browser storage (gintiflow.com)

The website uses no advertising, analytics or tracking cookies. It stores only what it needs to work:

Sign-in cookie (gf_session) — keeps you logged in on gintiflow.com. By default it lasts until you close your browser (and at most 12 hours); only if you tick “Keep me signed in on this device” does it last up to 30 days. It can't be read by any script on the page, and it's deleted when you log out.
Signed-in flag (gf_signed_in) — holds only the value "1", so the site can show "Open dashboard" instead of "Log in". It contains no personal information.
Your last generated invoice — if you download an invoice from the free invoice generator, a copy stays in your own browser (local storage) for up to 24 hours, so you can save it to an account if you sign up. It is never sent to us unless you choose to save it, and it's removed once saved.
Intro animation — a note in your browser's session storage so the homepage animation plays only once per visit.

The website also loads fonts from Google Fonts, and the Google sign-in button from Google, which may receive your IP address as part of serving them.

Visit counts. We count visits to gintiflow.com with Vercel Web Analytics, which sets no cookies and doesn't identify you. It records the page visited, the site you came from, your country, and your device and browser type, and shows them to us only as totals. This covers the website only; the GintiFlow app has no analytics.

Where your data is stored, and who processes it

Your data is stored on servers hosted by our infrastructure providers (currently Supabase for the database and Railway for hosting), located to keep the app fast for users in India. We use industry-standard encryption in transit (HTTPS) and rely on our providers' encryption at rest.

So you can open the app without internet, the GintiFlow app also keeps a copy of the data it last loaded (your clients, invoices, items, goals and business details) in its own private storage on your phone. Saving changes still needs a connection. The copy is deleted when you log out, sign in to another account, or delete your account.

A few third-party services process specific pieces of data on our behalf, and nothing else: Expo / Apple APNs / Google FCM deliver push notifications (they receive a device token and the notification text); Resend delivers account verification and password-reset emails (it receives your email address and a one-time code); Sentry receives crash diagnostics with personal and financial identifiers scrubbed out; Vercel hosts the website and counts visits as described above. We do not sell or rent your data, and we use no advertising and no tracking beyond those cookie-free website visit counts.

Payments

GintiFlow Pro subscriptions are billed through your device's app store — the Apple App Store on iPhone, or Google Play on Android. We never see or store your card details; the app store handles payment entirely. We only receive confirmation that a subscription is active and when it expires.

Push notifications

If you enable notifications, we store a device push token (via Expo/Apple/Google's push services) to let us notify you about overdue invoices or payments received. You can turn this off in your device settings at any time.

Your rights

You can view and edit your profile data at any time in the app (Profile → Your profile, Business details & GST, Payment details) or on gintiflow.com (Business details, Account). You can delete your account and all associated data in the app from Profile → Privacy & data → Delete my account, on gintiflow.com from Account → Delete account, or by emailing us at privacy@gintiflow.com. Deletion is permanent and cannot be undone. Our encrypted nightly backups, kept for 14 days only to recover from a failure, roll over within those 14 days. What is deleted and what is kept.

If you're in India, the Digital Personal Data Protection Act, 2023 (DPDP Act) gives you specific rights over your personal data, including the right to access, correct, and erase it. The rights described above are designed to meet those requirements.

Changes to this policy

If we make a material change to this policy, we'll update the date at the top of this page and, where required, notify you in the app.

Contact us

Questions about privacy? Email privacy@gintiflow.com.