Privacy Policy

Last updated September 2026. This describes what the software does, not what we would like you to believe it does.

The short version

The Flow is a private notebook that happens to live on a server. It holds what you put in it, shows it back to you, and sends it nowhere else. There is no advertising, no analytics, no tracking, and no third party that receives your entries.

What is stored

• Your email address and name, so the account can exist and so you can be sent a password reset if you ask for one.
• A hash of your password — PBKDF2-SHA512, 210,000 iterations, with a per-account salt. The password itself is never stored and cannot be recovered from the hash.
• Everything you write in the app: journal entries, tasks and priorities, notes, training and diet logs, sleep and mood entries, expenses and budgets, and anything else you type into a field. This is the point of the app.
• Recovery codes, hashed the same way as the password.
• Session and access tokens, so you stay signed in and so an assistant you have connected can read your day.
• Apps you connect yourself, and only if you do. Connecting Google stores the name, email address and profile photo of the Google account you chose, so the app can show it as yours — nothing else: The Flow does not ask for, and cannot read, your mail, calendar, contacts or files. No Google token is kept after the connection is made. Disconnecting in Settings, or deleting your account, removes all of it.

Where it is stored

On a server in the European Union, in a Redis database run by Upstash, reachable only by this application. Each account's data is held under its own key prefix and the server refuses any request for a prefix that is not yours. Nothing is shared between accounts except a task you deliberately send to somebody, which carries only what you typed.

Who else sees it

• Nobody, by default. Not the operator of this server in the ordinary course of things, not other account holders, not any advertiser or data broker — there are none.
• An assistant you connect yourself. If you connect Claude, ChatGPT or another assistant, you are granting that service permission to read the parts of your Flow you agreed to. It reads; it cannot change anything. You can revoke it at any moment in Settings, and revoking it takes effect immediately.
• The assistant inside the app, if the operator has switched it on. Questions you ask it, and the parts of your record needed to answer, are sent to Anthropic's API for that answer and are not used to train anything.
• Hosting providers — Render and Upstash — who necessarily hold the data at rest and in transit in the course of running the server, under their own terms.

What is not collected

No advertising identifiers. No analytics or telemetry SDKs of any kind — the app contains none, which you can check: the source is a handful of plain files. No location. No contacts. No microphone or camera. Nothing is collected in the background, and nothing about you is sold or shared for anybody else's purposes, ever.

Deleting everything

Settings → Account → Delete my account and everything in it. It asks for your password and then for your email address, and then it removes your entries, your sessions, your access tokens and your assistant connections, and finally the record that you had an account. It is immediate and there is no backup copy to restore from. If you would rather it were done for you, write to the address below and it will be done.

How long things are kept

Until you delete them. Sign-in sessions expire on their own after 60 days, password reset links after 30 minutes, and an assistant's access token after its own short life.

Children

The Flow is not directed at children under 13 and accounts are not knowingly created for them.

Your rights

Under the GDPR and comparable laws you may see, correct, export or erase what is held about you. In practice the app already gives you all four directly: everything is on your own screen, editable, exportable from Settings, and erasable from the same place. If you would rather ask a person, use the address below.

Changes

If this policy changes, the date at the top changes with it, and a change that affects what is done with your data will be said plainly in the app rather than quietly published here.

Getting in touch

Questions, requests, or anything that reads wrong here: artur.abacilar@abko.com.tr.