Privacy Policy

1. Who We Are

FlowStates ("we", "our", or "us") is a personal productivity and well-being application that helps users track their focus sessions, manage tasks, and reflect on their daily progress through AI-assisted check-ins and voice journaling.

If you have any questions about this policy, you can reach us at: privacy@flowstates.ai

2. Information We Collect

2.1 Account & Identity Data

When you sign in with Google, we receive and store the following information provided by Google:

• Email address
• Display name
• Profile picture URL

This data is used solely to create and identify your account. We do not collect your Google password or access any other Google account data beyond what you explicitly authorize.

2.2 Profile & Preferences

• Location (optional, user-provided)
• Language preference
• Notification settings and push notification token
• Subscription status and expiry date

2.3 Check-In & Session Data

FlowStates is built around timed focus sessions called "check-ins." During a check-in we may collect:

• Session start and end timestamps
• Audio recordings you choose to capture at the start and/or end of a session
• Text transcriptions of those audio recordings
• AI-generated analysis of your session (tone, mood indicators, summary)
• Screen context text you choose to share
• The task (to-do) linked to the session

2.4 Task & To-Do Data

• Task titles, descriptions, tags, and priority levels
• Completion status and timestamps
• Hierarchical task relationships (parent / sub-tasks)

2.5 Messages & AI Conversations

If you use the in-app AI assistant, message history is stored to maintain conversation context. Messages are subject to our retention policy; you can request deletion at any time (see Section 7).

2.6 File Uploads

Files you deliberately upload to the app (e.g., attachments, voice memos) are stored on our servers. Only you can access your uploaded files through your authenticated session.

2.7 Calendar Data

If you connect Google Calendar, we access your calendar events to synchronize tasks and sessions. We read only the calendar data necessary for this feature and never modify your calendar without explicit action from you.

2.8 Technical & Usage Data

• Account creation date and last login timestamp
• Device platform (iOS, Android, Web)
• Standard server access logs (IP address, request path, HTTP status codes) — retained for security and debugging purposes only

3. How We Use Your Data

We use the data described above strictly for the following purposes:

• Authentication & account management — to log you in, maintain your session, and recover your account.
• Personalized experience — to display your name, profile picture, language, and preferences across the app.
• Core app functionality — to save check-ins, to-dos, messages, and files linked to your account.
• AI-powered features — audio transcription and emotional/tonal analysis are processed to generate the session summary shown to you. Raw audio is not retained after transcription unless you explicitly save it.
• Notifications — to send you reminders or updates you have opted in to receive.
• Security & fraud prevention — to detect and block unauthorized access attempts.
• Service improvement — aggregated, anonymized analytics may be used to understand usage patterns and prioritize features. Individual-level data is never used for this purpose.

4. Third-Party Services

FlowStates integrates with the following third-party services to deliver its features. Each service is bound by its own privacy policy and data-processing terms.

Google OAuth 2.0 & Google Calendar

Used for sign-in and optional calendar synchronization. Governed by the Google Privacy Policy. FlowStates' use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

ElevenLabs

Used to transcribe audio recordings you create during check-ins. Audio segments are sent to ElevenLabs' API for transcription and are not stored by us beyond the duration needed to process the request. See the ElevenLabs Privacy Policy.

Hume AI

Used to analyze the tone and emotional content of session transcripts to generate session summaries. Only text transcripts (not raw audio) are sent to Hume AI's API. See the Hume AI Privacy Policy.

OpenRouter

Powers the in-app AI assistant. Message threads are transmitted to OpenRouter's API to generate responses. See the OpenRouter Privacy Policy.

5. Data Storage & Security

Your data is stored in a secured database hosted on our servers. We apply the following safeguards:

• All data in transit is encrypted via HTTPS / TLS.
• Database access is restricted to the application server; no public direct access is permitted.
• Passwords (for accounts that use email/password sign-in) are hashed using a strong one-way algorithm and are never stored or transmitted in plain text.
• API keys and secrets are stored as environment variables and are never embedded in client-side code.
• Access tokens issued to your device expire and are rotated regularly.

While we take reasonable technical and organizational measures to protect your data, no system is completely immune to risk. We will notify you promptly in the event of a data breach that materially affects your personal information.

6. Data Retention

• Account data — retained for as long as your account is active. Deleted upon account deletion request.
• Check-in sessions — retained indefinitely unless you delete them manually or request account deletion.
• AI message history — may be automatically purged after a configurable number of days (default: 7 days for inactive threads) to minimize data accumulation.
• Audio files — stored only if you save them. Temporary audio sent for transcription is discarded immediately after processing.
• Server logs — rotated and purged on a rolling basis (typically 30 days).

7. Your Rights & Choices

Depending on your jurisdiction, you may have the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — request that inaccurate or incomplete data be corrected.
• Deletion — request that your account and all associated data be permanently deleted ("right to be forgotten").
• Portability — request your data in a structured, machine-readable format.
• Restriction — request that we limit how we process your data in certain circumstances.
• Objection — object to specific processing activities.
• Withdraw consent — revoke Google OAuth permissions at any time via your Google Account settings. This will prevent future sign-in but will not automatically delete your existing data.

To exercise any of these rights, contact us at privacy@flowstates.ai. We will respond within 30 days.

8. Children's Privacy

FlowStates is not directed at children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

9. International Data Transfers

Our servers are located in the European Union / Turkey. When data is transmitted to third-party services such as ElevenLabs, Hume AI, or OpenRouter, it may be processed in the United States or other countries. We ensure that appropriate safeguards are in place (e.g., Standard Contractual Clauses or equivalent mechanisms) to protect your data during such transfers.

10. Cookies & Local Storage

The FlowStates web app uses browser local storage and session storage to maintain your authenticated session and user preferences. We do not use third-party tracking cookies or advertising cookies. No cross-site tracking is performed.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you via email or an in-app notification. Continued use of FlowStates after the effective date constitutes acceptance of the revised policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact:

• Email: privacy@flowstates.ai
• App: flowstates.ai