This Privacy Policy explains how Flow ("we", "us") collects, uses, and protects information when you use our Service. We take your privacy seriously and collect only what is necessary.
We collect information you provide directly: your name, email address, and the content you create (tasks, notes, captures). We also collect basic usage data and your timezone for reminder functionality.
We use your information to operate the Service, send account-related emails (verification, due-date reminders), and respond to your support requests. We do not sell your data to third parties.
Your data is stored on Convex infrastructure. For custom deployments, data is stored on infrastructure you own and control. We do not access your data except as required to provide support.
We send transactional emails (account verification, password reset) and optional due-date reminder emails. You can disable reminder emails at any time from your account settings.
If you subscribe to the Flow newsletter, we collect your email address to send it to you. We use double opt-in: after signing up you receive a confirmation email, and we only add you to our list once you click the confirmation link. Our legal basis is your consent. We send the newsletter through Resend, which acts as our email processor and stores your address as part of our subscriber audience. Every newsletter includes an unsubscribe link, and you can opt out at any time; we keep a record of your subscription status so we can honour your choice. We do not sell your email address or share it for third-party marketing.
We use only essential cookies required for authentication. We do not use tracking or advertising cookies.
We retain your data for as long as your account is active. You may request deletion of your account and associated data through the contact form.
Flow lets you share an individual note through a public link. When you enable sharing on a note, it becomes viewable by anyone who has the link, as a read-only page that does not require an account. Only the notes you explicitly choose to share are public; everything else stays private to you. You can turn sharing off at any time, after which the public link no longer works.
Flow uses Convex for data storage and Resend for transactional email. For file uploads, we use Cloudinary. For custom deployments you may choose a different stack (for example Supabase), in which case that provider's privacy policy applies. These services each have their own privacy policies.
Depending on your location, you may have rights to access, correct, or delete your personal data. To exercise these rights, use the contact form.
We may update this policy from time to time. We will notify you of significant changes via email or a notice within the Service.
For privacy-related questions, use the contact form.