F2F-Flow says your data stays on your phone. Here is exactly what that means, and how to check it yourself.
What the app asks your iPhone for
Face ID: only if you turn on app lock. Your iPhone does the check; the app never receives biometric data.
Camera and photo library: only when you attach a receipt photo to a transaction.
Notifications: local alerts on your phone (budget alerts, an optional daily reminder). There is no push server.
What it stores, and where
Your transactions, budgets, categories, savings plan, notes, tags and receipt photos are stored in the app's own storage on your phone.
Your PIN is not stored as text. A verification record is kept in the iPhone Keychain, on this device only.
The app's database and receipt files are marked to be left out of iCloud and computer backups of your phone.
What can leave your phone, and only if you choose
A CSV export, a backup file, or an image of your savings rate, sent through the iPhone share sheet to wherever you pick.
Backups can be protected with your PIN or a passphrase (standard AES-GCM encryption). A plain backup is also possible, so keep those files safe.
The optional Home Screen widget gets one number, this month's savings rate, and the month name. It stays on the same phone, and it is off until you turn it on.
What it does not do
No account, sign-in, bank connection or bank login.
No analytics, advertising, crash reporting or tracking in the app.
No network requests. The app has no server to talk to.
Check it yourself (about two minutes)
Airplane mode test. Turn on Airplane Mode and use the app: add entries, set budgets, look at Trends. Everything works, because nothing needs the internet.
App Privacy Report. On your iPhone open Settings, then Privacy & Security, then App Privacy Report, and turn it on. After a few days of use, look at F2F-Flow under network activity. It should list nothing. If you ever see an entry, please tell us.
Permissions list. In Settings, then F2F-Flow, you will see only the permissions above, and only those you have allowed.
The honest limits
If you lose your phone and have no backup, we cannot recover your data or your PIN, because we never had them.
Anyone with your unlocked phone can open the app unless you turn on app lock. The app lock is a convenience layer on top of your iPhone's own passcode, not a replacement for it.
The app contains open-source libraries, as most apps do. None of them are used to contact any service.
This website is separate from the app. It uses cookieless Vercel Web Analytics; see the privacy policy.