Privacy Policy

Flow collects what you give it: the text you type into your brain dump, the tasks and plans we generate from it, and your focus session history. We also store your email address and name from Clerk, the auth provider we use.

If you connect Google Calendar, we read your calendar events — titles, times, and dates — so we can show them next to your tasks. That's it. We never write to your calendar, never move or delete events, and never share what we read.

Your brain dump text is sent to Google Gemini AI to be classified into tasks and planning items. We don't use your data to train models, and we don't sell it or share it with third parties for advertising.

Calendar events are only used to display alongside your tasks inside Flow. They give you scheduling context when you're deciding what to work on next. We don't analyze, index, or share them.

When you connect Google Calendar, Flow requests read-only access. We fetch event titles, start times, and end times. We store a local copy so the calendar loads quickly without hitting Google every time you open Flow.

We never modify, create, or delete calendar events. We never share your calendar data with other users or third parties. If you disconnect Google Calendar — or delete your account — we permanently delete all stored calendar data immediately.

You can disconnect Google Calendar at any time from your settings. Doing so removes the integration and deletes all locally synced calendar data from our servers right away.

We keep your data for as long as your account is active. If you delete your account, we delete everything associated with it — tasks, brain dumps, focus history, and any synced calendar data — within 30 days. You can request deletion sooner by emailing us.

• Clerk — handles authentication. They store your email and OAuth tokens.
• Supabase — our database. Your tasks, brain dumps, and focus sessions live here.
• Google Gemini— processes your brain dump text to classify it. Text is sent per-request; we don't store it with Gemini.
• Vercel — hosts the app and collects anonymous analytics (page views, no personal data).
• Google Calendar API — read-only access, as described above.

We use session cookies for authentication. We don't run ad tracking, cross-site tracking, or sell data to data brokers. Vercel Analytics collects aggregate usage data (no personally identifiable information).

You can export or delete your data at any time. To do either, email us at privacy@useflo.app. We'll respond within 7 days.

Questions about this policy? Email privacy@useflo.app.