Privacy Policy

FlexaPay is an app for planning things with friends and keeping track of who paid for what. It moves no money. This one policy covers the FlexaPay app for iOS and Android, the service behind it, and this website.

What this covers

This policy applies to flexapay.net, the FlexaPay mobile app, and the FlexaPay service the app talks to. It doesn’t cover other companies’ products the app hands you off to — Venmo, Apple, Google, your maps app, your messaging app — each of which has its own policy that applies once you’re there.

The website

The website has two forms. The waitlist form collects the email address you submit. The support form collects the email address you want a reply at, a subject line, and the message you write.

Submissions to both forms are rate-limited. Doing that means reading the IP address your request arrives with and keeping a short-lived count in memory. It isn’t written to disk, isn’t attached to your email address, and isn’t used for anything else.

The invite and sign-in links the app sends (flexapay.net/invite, /add and /verify) are rendered on our servers and store nothing in your browser. An invite page shows the inviter’s name and avatar and a plan’s name to whoever holds the link; a sign-in link page does nothing until you tap through to the app.

Guest passes. Someone who receives a plan invite can see that plan on the website without installing the app, as a guest. Creating a guest pass asks for a first name (required) and, optionally, an email address — nothing else: no last name, no username, no password. An email, if given, is used only to send the pass link and, if asked, to find it again later. The only place it’s ever shown again is back to you, on your own pass — a masked confirmation like p•••@example.com, never the full address. The plan’s owner sees the same masked form, so they can resend or revoke your link — see below. Creating or looking up a pass is rate-limited the same way the two forms above are, by reading the IP address the request arrives with.

A guest’s first name, whether they gave an email, and — if so — a masked form of it, the same kind shown back to the guest above and never the full address, are visible only to the plan’s owner, who manages guest passes from the app: seeing when a guest last looked, resending their link if it’s lost, or revoking it outright. A guest pass never carries the plan’s expenses or balances, however it’s viewed.

Two things here have two different lifetimes, and it matters which is which. The links we email — the ones that open the plan on a device that hasn’t seen it before — work for 7 days; when one runs out, another can be sent, from the pass itself or by the plan’s owner from the app. The pass those links open is the longer-lived thing: it, and the cookie a browser keeps for it, go on working until the plan’s owner revokes it or the guest joins the plan for real in the app.

Your account

When you create a FlexaPay account we hold your name, email address, phone number (verified by a text message code), a username you choose, and optionally your Venmo handle. Your avatar is one letter and one colour — the app has no photo upload, no camera access, and no image library access.

If you sign in with Google or Apple, they send us your email address, your name, and an account identifier. There are no passwords anywhere in FlexaPay: nothing to store, nothing to leak.

If you sign in with Apple, Apple also hands us one credential at sign-in, which we store encrypted and use for exactly one thing: telling Apple to disconnect FlexaPay from your Apple ID when your account is deleted, which Apple requires of every app. It is used for nothing else and is discarded once that happens.

Signing in and your devices

Sign-in is by Google, Apple, or a one-time code or link sent to your email. Phone numbers are verified by a text message code. Codes are short-lived and discarded once used. We keep a record of each device you’ve signed in on so we can recognise it and skip the text-message step next time, for a limited period. To recognise a device, the app creates a random identifier for that install and presents it when you sign in. It identifies your copy of the app to us alone — it isn’t a hardware or advertising identifier, is used only to keep your account secure, and resets if you delete and reinstall the app.

On your phone, the app keeps your sign-in token and that device identifier in the operating system’s secure storage, plus a couple of flags about whether you’ve finished onboarding and when you last opened the activity bell. That is all it stores on the device.

What you put into the app

Everything you create in FlexaPay is stored so that you and the people you share it with can see it: plans and their members; itinerary items, including any venue name, address and map location you attach; polls and votes; RSVPs; links you paste (we fetch the page’s title, site name and preview image so the link has something to show); and expenses, shares and settle-ups, including the history of edits to each so that a changed amount can be traced. If you block or report someone, we keep the block and the report, including any reason you write.

Location

Location is always optional and the app works without it. There are two separate uses, and they behave differently.

Finding places, your own dot, and how long things take. The app asks for approximate location once, on a screen of its own shortly after you sign in, which explains what it is for before your phone shows its own permission prompt. Skipping it leaves the app fully usable. Either way it is only ever read while the app is open.

Before your position leaves your phone the app rounds it to roughly the nearest kilometre, so the service only ever learns which neighbourhood you’re in. To keep search fast, recent searches — the words searched and the rounded position they were biased to — are held briefly in the server’s own memory and then gone. The same rounded position is sent when a plan’s map works out how far you are from where the plan starts; it is used for that one answer and is not stored.

One rounded position, kept, so suggestions are local. We keep a single approximate position — the most recent one, rounded the same way — alongside your account, and we use it for one thing: working out which city’s suggestions to show you. Without it we would have to show everyone the same city’s events and places.

It is one position and not a history: each new one replaces the last, so there is no trail of where you have been. It is only ever read while the app is open, never in the background. It is deleted when you delete your account, and deleted on its own if you stop using the app. And it is only ever collected if you allowed approximate location — skip that screen, or turn the permission off later, and we simply fall back to a default city.

More precise travel times, if you want them. A kilometre is about fifteen minutes on foot, which is enough to make “when should I leave” wrong. So a plan may offer, once, to use precise location for your own travel estimates. Saying no costs nothing — the map simply says that its times from you are approximate — and place search keeps using the rounded position whatever you choose. Precise location obtained this way is not shared with anyone; sharing is the separate, opt-in setting below.

Sharing where you are with a plan. You can choose, for one plan at a time, to let the other people on that plan see where you are while the plan is running. This is off unless you turn it on, and it is gated twice: the plan’s organiser has to allow sharing for that plan at all, and then each person decides for themselves. Until the organiser allows it, nobody on the plan can share and nobody is asked to.

You can switch your own sharing off at any time — that always works, whatever the organiser has since done, and it deletes your position straight away rather than waiting for it to expire. If the organiser turns sharing off for the plan, every position on it is deleted at once, and everyone’s own setting with it.

While sharing is on, we store your most recent position only — never a history of where you have been — and only for a few minutes at a time, after which it is deleted. It is visible to the members of that one plan and to nobody else; people you have blocked never see it, and you never see theirs. Sharing works only while the plan is actually running, and stops on its own when it ends.

We still never track you in the background. The app has no always-on or background location access, so nothing is collected when the app is closed. On iPhone, precise location is granted for that session only and returns to approximate afterwards.

The places you choose to add to a plan — their name, address and map position — are stored with the plan. Place search, map tiles and travel directions come from third-party map providers, who receive the search text, the rounded position the search was biased to, the map area being viewed, the two stops a route is between, and, like any web server, your device’s IP address. A route from where you are to a plan’s first stop sends the rounded position too, because that is the start of the route being asked for. Your shared position — the one other people on a plan can see — is never sent to them: it stays between FlexaPay and the plan you shared it with.

Tapping through to another app — a ride, a scooter, or your phone’s maps app — hands that app the pickup and destination for that one trip, and from there their own privacy policy applies. We don’t tell them who you are.

Your contacts

FlexaPay never uploads your contacts and never asks for permission to read them. When you invite someone from your contacts, the phone shows its own picker and hands the app the one number you tapped. The app then opens your messaging app with an invite message already written; you decide whether to send it. The number is used only to address that message on your phone — it is never sent to us at all.

Who can see what

Your friends and the members of your plans see your name, username, avatar, and — if you’ve added one — your Venmo handle, along with the expenses and balances you share with them. Other FlexaPay users can find you by searching for your username, name or phone number. Turning on Private profile in the app removes you from search; people can then only reach you through an invite link you create. Anyone holding one of your invite links, including someone it was forwarded to, sees your name and avatar. A guest who creates a pass on one of your plans sees the same — every member’s name and avatar, for as long as the pass lasts — and never your username, your Venmo handle, or anything about your expenses or balances.

Settling up

FlexaPay keeps a record of who owes whom; it never holds or moves money and never stores a card, bank account or wallet. When you tap “Settle through Venmo”, the app opens Venmo with the other person’s Venmo handle, the amount, and a short note mentioning FlexaPay and the plan filled in. What happens from there is between you and Venmo: we get nothing back, which is why the app asks you to confirm the payment went through. Marking something as paid is your word, recorded; the other person can confirm or dispute it.

Notifications

FlexaPay sends opt-in push notifications for events aimed at you: when someone joins your plan or adds you to one, when a friend request arrives or a friend accepts yours, when an expense is added to a plan you’re in, and when a settle-up you’re part of is paid, confirmed or disputed. You can turn notifications off on the Me screen or in your phone’s settings.

When you enable notifications, FlexaPay creates a push token on your device and stores it with your account so we can send notifications only to you. The token is deleted when you sign out, turn notifications off, or delete your account.

Cookies, analytics and tracking

No third-party tracking of any kind. There is no analytics, crash reporting, advertising, attribution or social SDK in the app, and no third-party script on this website; the fonts are served from this domain. The app uses Firebase Cloud Messaging (a Google service) to deliver push notifications; it receives your device’s push token and the content of each notification, solely to deliver it; it is not used for analytics, advertising or tracking. The website sets one cookie, fp_guest — and only if you create or open a guest pass — plus one flag in your browser’s local storage to remember that you’ve seen the cookie notice. Neither is used for tracking; both are strictly necessary, which is explained in the Cookie Policy.

The one record the app itself keeps of how you use it concerns its suggestions. When the app suggests places or ideas for a plan, we record which suggestions you were shown and which you tapped, saved, dismissed or added to a plan, tied to your account. That record is used for two things only: keeping a suggestion you dismissed dismissed, and making future suggestions better fit what you actually use. It is never shared with anyone and is erased when your account is.

Service providers

We use a small number of companies to run FlexaPay — hosting, sending sign-in codes by text message and email, Google and Apple for sign-in if you choose them, and map providers for place search and map images — each for that one job and each under terms that stop them using your data for anything else. We don’t sell your personal information, don’t share it for advertising, and don’t give it to anyone else for their own purposes. We would disclose it if the law required us to, and we’d tell you if we were allowed to.

Where your data lives

FlexaPay is run from the United States. If you use it from the European Union, the United Kingdom or elsewhere, your data is transferred to and processed in the United States under this policy and the standard contractual terms those laws provide for.

Retention and deletion

Your account. You can delete it yourself, from the Me screen in the app or from our website if you can’t sign in. Deletion takes effect immediately: you are signed out everywhere, your profile becomes “Deleted user” to everyone else, and your plans are archived. For 29 days you can change your mind by writing to us through the Support page; after that your account is erased and can’t be recovered. We email you when an account is deleted, so you know if somebody else asked for it.

Erasing removes your name, email, phone number, username, Venmo handle, sign-in records, devices, friendships, and the record of what you did with suggestions. The expenses, settle-ups, itinerary items and votes you contributed to shared plans remain, with your identity removed, because deleting them would rewrite other people’s records. Copies can persist in routine backups for a short period afterwards.

The website. A waitlist address is kept until FlexaPay opens to the waitlist and that email has gone out, or until you ask us to remove it. A support request is kept while it is being dealt with and for a reasonable period afterwards, so that if you write again we know what was said before. Neither is linked to an app account, so deleting your account doesn’t delete them — ask and we will. A guest pass (see “The website” above) stops working the moment its plan’s owner revokes it or the guest joins the plan in the app, but the guest record itself — the first name and, if given, the email address — stays on that plan’s guest list rather than being erased the moment the pass ends; it is removed when the plan is, or sooner if you ask us through the Support page.

Short-lived things. Invite links and sign-in codes expire on their own after a short time.

Your rights and choices

Wherever you are, you can: see and correct your profile in the app; delete your account in the app; hide yourself from search with Private profile; block or report anyone; and ask us for a copy of the personal information we hold about you, or to correct, delete or stop using it, by writing to us through the Support page. There is no self-serve export yet — we fulfil those requests by hand, and will reply within thirty days.

If you are in the European Economic Area, the United Kingdom or Switzerland, those are your rights of access, rectification, erasure, restriction, portability and objection under the GDPR; our legal basis for processing is performing the service you asked for, and for security and rate limiting, our legitimate interest in keeping it running. You can also complain to your local data protection authority. If you are in California, the rights above include those under the CCPA; we don’t sell or share personal information, and we’ll never treat you differently for exercising a right.

Security

Everything between the app, the website and the service is encrypted in transit, and sign-in credentials are never stored in a form that could be reused. There are no passwords to steal and no payment details to lose. No system is perfect, though; if something goes wrong with your data we’ll tell you, and the authorities where the law requires it.

Children

FlexaPay isn’t for children under 13, or under the age at which your country lets you agree to a service like this on your own, and we don’t knowingly collect information from them. If you think a child has an account, write to us and we’ll delete it.

Changes

If this policy changes, the new version will be posted here with a new effective date, and if the change matters we’ll tell you in the app before it takes effect. We would rather say so here than quietly not.

Contact

Anything about this policy or your data can reach us through the Support page.