Privacy Policy

Flow (“Application”, “Service”, “we”, “us”, “our”) is a wellness and productivity mobile application operated by {LEGAL_ENTITY_NAME} (“Service Provider”). This Privacy Policy explains what personal data we collect, the lawful basis on which we process it, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR), the UK GDPR, and comparable privacy laws.

Flow is a wellness and productivity tool. It is not a medical device: it does not diagnose, treat, cure, mitigate, or prevent any disease or condition. Heart-rate-variability (HRV), sleep, and focus data are surfaced for self-reflection only.

1. Who we are (Data Controller)

• Data Controller: {LEGAL_ENTITY_NAME}
• Privacy / Data Subject Requests: privacy@flowdeep.app
• Security Disclosure: security@flowdeep.app
• General: hello@flowdeep.app

We do not currently have a statutory obligation to appoint a Data Protection Officer (Art 37 GDPR). The address above is the single point of contact for all data-protection matters.

2. What data we collect

We collect the minimum data required to deliver the Service. Concretely:

2.1 Account data

• Email address: collected when you sign up via Apple, Google, or email link, and (optionally) when you join the Flow newsletter waitlist.
• Firebase User ID (UID): an opaque identifier assigned by Firebase Authentication. It is the primary key for everything below.

2.2 Health & activity signals (only with your explicit OS-level permission)

• HRV (heart-rate variability) samples from Apple HealthKit or Android Health Connect, millisecond integers, stored against a timestamp.
• Sleep duration: total hours and main sleep window per night.
• Focus score history: derived numeric score (0 to 100) computed from your inputs and HRV/sleep signals.

2.3 Calendar metadata (only with your explicit OS-level permission)

• Event count, deep-work window, meeting time for the upcoming day.
• We do not read or store event titles, descriptions, locations, attendees, or invitee email addresses. Only the shape of your day is read; never the content.

2.4 Flow session records

• Start time, end time, duration, ambient sound selected, interruption count.

2.5 User preferences

• Work style, default session length, quiet hours, notification settings.

2.6 Burnout signals

• Five deterministic flags computed locally and on our backend from the signals above. No additional data is collected here; this is a derivation.

2.7 Subscription state

• Active / inactive subscription status and product identifier, provided by RevenueCat. We never see, store, or process your payment card details. those stay with Apple or Google and never reach our servers.

2.8 Technical & diagnostic data

• IP address (at request time), device model, OS version, app version, and approximate region (country-level) inferred from IP for security and abuse prevention. Crash logs are stored for 30 days and contain no health data.

We do not collect:

• Voice recordings (only transcribed text, if you use voice input).
• Precise location (no GPS).
• Contacts, photos, microphone audio, or screen content.
• Advertising identifiers.

3. Why we collect it, lawful basis (GDPR Art 6)

We do not rely on legitimate interest to send marketing emails. Marketing is consent only.

4. Sub-processors

We process data on our own servers and through the following sub-processors. Each sub-processor is contractually bound to comparable data-protection obligations.

About Anthropic specifically: when Flow calls the Anthropic API, the request never contains your email, Firebase UID, or any directly identifying information. The prompt carries only abstracted numeric signals (HRV millisecond integers, sleep hours, focus scores, recent dates, preferences). Anthropic has contractually undertaken not to train its foundation models on data submitted via the API.

Observability (error reporting & product analytics). The Flow mobile application integrates Sentry (crash + error reporting) and Mixpanel (product analytics) for diagnostic and reliability purposes. Both are configured to:

• scrub direct identifiers (no email, no IP body field, no health values attached to events);
• transmit only the Firebase UID as a pseudonymous correlation key, which is unlinkable to a natural person without our Firebase Auth database;
• be disabled automatically on user sign-out and on account deletion.

The Cloudflare Worker AI proxy (api.flowdeep.app) ships with a Sentry Cloudflare SDK that is inactive unless a SENTRY_DSN secret is set; when active it operates with tracesSampleRate: 0 and does not record prompt content.

You may disable AI-personalization features and request data anonymization from inside the application (Settings → Privacy).

5. International data transfers

The sub-processors above are predominantly based in the United States. When personal data of users in the European Economic Area (EEA), the United Kingdom, or Switzerland is transferred to the US, the transfer is protected by the EU Standard Contractual Clauses (SCCs) as approved by the European Commission (Implementing Decision 2021/914), supplemented by the additional safeguards described in our Data Processing Agreements with each sub-processor.

You may request a copy of the relevant SCCs by writing to privacy@flowdeep.app.

6. Retention

We retain personal data only as long as necessary for the purpose for which it was collected.

When a retention period ends, data is either deleted or, where deletion is not technically feasible (e.g. immutable backups), securely isolated and overwritten on the next backup cycle.

7. Your rights

If you are in the EEA, UK, or Switzerland, the GDPR gives you the following rights. We honour the same rights worldwide as a matter of policy.

• Art 13 / 14, Right to information. This Privacy Policy is your Art 13/14 notice.
• Art 15, Right of access. You may request a copy of all personal data we hold about you. Use the in-app Settings → Privacy → Export my data button, or write to privacy@flowdeep.app. We respond within 30 days.
• Art 16, Right to rectification. Correct inaccurate data directly in the app (Settings → Profile), or write to us.
• Art 17, Right to erasure (“right to be forgotten”). Use the in-app Settings → Delete account button. We complete deletion within 30 days (Firebase Auth retention noted in §6 applies).
• Art 20, Right to data portability. The in-app Export my data function returns your data in machine-readable JSON.
• Art 21, Right to object. You may object at any time to processing based on legitimate interest (Art 6(1)(f)). For marketing, use the unsubscribe link or contact us.
• Art 22, Automated decision-making. Flow’s AI coaching is advisory only and does not produce legal effects or similarly significant effects on you (Art 22(1) does not apply). You always remain in control of whether to act on a suggestion.
• Right to withdraw consent. Where processing is based on consent (Art 6(1)(a)), you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint. You may complain to your local supervisory authority. In Serbia: the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs). In the EU: see edpb.europa.eu/about-edpb/about-edpb/members_en.

We will not charge you for exercising these rights and will not require disproportionate identity-verification steps. We may ask you to confirm your identity via the email address on file before fulfilling a request.

8. Children

Flow is an adult productivity and wellness application. It is not directed at children. Within the European Economic Area we apply a minimum age of 16 by default, in line with the strictest GDPR-K baseline (Art 8(1) GDPR, Germany, the Netherlands, Romania, Hungary and others). In jurisdictions whose national law sets a lower digital consent age (down to 13), that lower age applies; Apple App Store age ratings are applied independently.

We do not knowingly collect personal data from anyone below the applicable minimum age. If we become aware that we have inadvertently collected such data, we will delete it without undue delay. If you are a parent or guardian and believe your child has provided us data, please contact privacy@flowdeep.app and we will erase the account within 7 days.

8a. Profiling and automated decision-making (Art 22)

Flow’s AI coaching (focus-plan and Now-Reset) is a profiling activity within the meaning of Art 4(4) GDPR: we apply a Large Language Model (Anthropic Claude) to a small set of abstracted signals (HRV, sleep, focus score, calendar shape) to suggest blocks of focused work.

This profiling does not produce legal or similarly significant effects on you (Art 22(1) GDPR). Specifically:

• Output is advisory only. Every suggestion is presented as a proposal that you can accept, modify, ignore, or delete in one tap.
• There is no automated rejection, exclusion, eligibility decision, pricing decision, or risk score that affects your access to the Service or to any benefit, employment, insurance, or financial product.
• A deterministic burnout-mode gate runs server-side before any AI output reaches you; when triggered, AI output is constrained to safe recovery-oriented suggestions and, if it cannot meet those constraints, replaced with a fixed safe-fallback template.

You may opt out of AI personalization at any time from Settings → Privacy → Use AI features (off). When off, Flow falls back to non-AI manual planning. You may also enable Settings → Privacy → Anonymize my data to strip pseudonymous identifiers from the abstracted payload sent for personalization.

9. Cookies, analytics, and similar technologies

9.1 Marketing website (flowdeep.app)

The Flow marketing website is cookieless by design. We do not set analytics cookies, advertising cookies, or any cookies for which consent would be required under the EU ePrivacy Directive.

The website uses Cloudflare Web Analytics, a privacy-preserving, cookieless analytics product that collects only aggregated, anonymous measurements (page views, country-level region, browser family). It does not set cookies, does not fingerprint visitors, does not build cross-site profiles, and is not used for advertising.

If we add additional analytics in the future (for example Plausible, which is also cookieless), we will update this section and, where required by ePrivacy law, request consent before activation.

9.2 Email tracking (newsletter)

Our newsletter is delivered through Beehiiv. Beehiiv may include open-rate tracking pixels and click-tracking redirect links in marketing emails for aggregate engagement measurement. You can disable image loading in your mail client to suppress open tracking, and you may unsubscribe at any time via the one-click unsubscribe link in every email. Newsletter signup is double opt-in: you receive a confirmation email before your address is added to any list.

9.3 Mobile application

The Flow mobile application stores small amounts of state locally on your device (preferences, cached focus-plan, authentication token) using the operating system’s secure storage (iOS Keychain / Android Keystore / encrypted AsyncStorage). These are not web cookies and are covered by §2 above. They can be wiped at any time by uninstalling the application or by deleting your account (§7 → Right to erasure).

10. How we keep your data secure

• Encryption in transit: TLS 1.2+ (TLS 1.3 where supported) for every request.
• Encryption at rest: AES-256 for Firestore (provider default), iOS Keychain / Android Keystore for on-device secrets.
• Access control: Firestore Security Rules enforce per-user isolation on every read and write; only the authenticated owner of a UID may read or write data under that UID.
• Secrets management: API keys and credentials are stored in Firebase Secret Manager and rotated quarterly.
• Audit logs: every authentication event and every Cloud Function invocation is logged.

No security system is perfect. If you believe you have found a security vulnerability, please write to security@flowdeep.app. We follow a 72-hour breach-notification policy in line with Art 33 GDPR.

10a. Personal-data breach notification

If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it (Art 33 GDPR). If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay (Art 34 GDPR), in plain language, describing the nature of the breach, the likely consequences, the measures we have taken or propose to take, and the contact point for more information.

10b. Data Processing Agreements (Art 28 GDPR)

For business customers who process personal data of their own users or employees through Flow (B2B scenarios), a Data Processing Agreement (DPA) including the European Commission Standard Contractual Clauses 2021/914 is available on request from privacy@flowdeep.app. Consumer users do not need to sign a DPA. This Privacy Policy together with the Terms of Service describes the controller/processor relationship in full.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we update the “Last updated” and “Effective” dates at the top. Material changes will also be announced in-app and (if you are subscribed) by email at least 14 days before they take effect. Historical versions are kept on file and available on request.

12. Contact

Effective date: 2026-06-11.