1. Information We Collect

We collect only the information necessary to provide and improve the Service:

• Account information: Email address and encrypted password (authentication handled via Supabase Auth)
• Local workspace data: Conversations, canvas state, Agent history, request logs, and provider API keys remain on your device or browser profile
• Payment data: We retain subscription status and payment audit records; Creem processes payments and we do not store card numbers

We do not collect your name, phone number, physical address, or biometric data unless you voluntarily provide it.

2. How We Use Your Data

Your data is used exclusively to operate and deliver the Service:

• To authenticate you and maintain your session
• To render your conversation tree and enable branching interactions
• To process @mention references between messages
• To let your browser send model requests directly to the AI provider you configured
• To generate session titles for easy navigation
• To process subscription payments through Creem
• To send service-related emails (account confirmation, password reset, billing notices)

We do not train AI models on your data. We do not sell your personal information to third parties. We do not use your data for advertising or profiling.

3. Data Storage & Security

Workspace content is stored locally. Supabase retains authentication, account, subscription, and payment-history records only.

• Encryption at rest and in transit (TLS 1.3)
• Row-Level Security (RLS) policies ensuring users can only access their own data
• Provider API keys remain in the browser profile or desktop operating-system credential store
• Authentication is handled by Supabase Auth with password hashing (bcrypt)
• Regular security audits and dependency updates

4. Data Sharing & Third Parties

We share your data only as necessary to provide the Service:

Supabase (Authentication & Database)

Supabase handles authentication and retains account, subscription, and payment-history records. It does not store workspace content or provider API keys. Supabase Privacy Policy

Creem (Payments)

Creem processes subscription payments. We receive payment and entitlement status but do not store payment card details.

AI Providers (Your Choice)

Your browser sends Web model requests, conversation content, attachments, and provider credentials directly to the provider you select. Flowisall does not receive or relay that traffic. The provider's privacy policy governs its processing.

When configured, Umami receives limited product-action event names and small operational properties. Prompts, responses, canvas content, and API keys are never analytics payloads. We do not use advertising networks or data brokers.

5. Local Storage

Flowisall uses IndexedDB and local preferences for functional, profile-local storage:

• Theme preference: Remembers whether you prefer dark or light mode
• Canvas direction: Stores your preferred branch direction
• Branch overrides: Caches branch display settings for performance
• Workspace and provider data: Stores conversations, canvas state, request logs, and the provider API key in this browser profile
• Reasoning panel state: Remembers whether the reasoning panel is open

We do not use advertising cookies. Supabase uses a strictly necessary authentication cookie, and configured Umami analytics is limited to the product-action boundary described above.

6. Data Retention

• Local workspace data: Remains until you clear browser or app storage, uninstall the application, or remove it on the device
• Deleted accounts: Cloud account and subscription data is deleted subject to legal payment-record retention
• Manual backups: Exist only where you choose to save exported files
• API keys: Remain local and can be removed or rotated at any time
• Payment records: Billing history retained as required by tax law (typically 7 years)

7. Your Rights

Depending on your jurisdiction (including GDPR for EU users and CCPA for California users), you may have the following rights:

• Right to access: Request a copy of your personal data
• Right to rectification: Correct inaccurate or incomplete data
• Right to deletion: Request deletion of your personal data
• Right to data portability: Receive your data in a machine-readable format
• Right to object: Object to processing of your personal data
• Right to withdraw consent: Withdraw consent at any time (where processing is based on consent)

To exercise these rights, please contact us at admin@flowisall.com. We will respond within 30 days.

8. International Data Transfers

Supabase account, subscription, and payment-history data may be processed in regions where our infrastructure providers operate. Local workspace content is not transferred to Supabase, but model requests are sent to the AI provider you select.

9. Children's Privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we discover that a child under 13 has provided us with personal data, we will delete it immediately. If you believe a child has provided us with personal data, please contact us.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or through the Service. The "Last updated" date at the bottom of this page reflects the most recent revision. Your continued use after changes constitutes acceptance of the updated policy.

11. Contact

For privacy-related inquiries:

Email: admin@flowisall.com