Privacy Policy

Flow for Many is a self-assessment tool that measures the conditions for flow and offers an AI coach to help you act on the results. This policy explains what we collect, why, who else handles it, and how to get it back or delete it.

The service is operated by [Company legal name], [Registered address], which is responsible for your data. Contact us at [privacy@theflowai.io].

What we collect

• Your account — email address, name if you give one, and your password in hashed form (we never store or see the password itself). We also record when you verified your email and when you last signed in.
• Your diagnostic answers — your answer to each question, the scores calculated from them, and the context you provide about when you experience flow. These answers concern your sleep, stress, energy, attention and sense of purpose.
• Your coach conversations — the messages you exchange with the AI coach, and short facts the coach extracts from them to remember across conversations (for example, a goal you mentioned).
• Security records — to prevent abuse, we count recent sign-in, sign-up and password-reset attempts per email address and per network (IP) address. These counters hold nothing else and are deleted automatically within two days.

We do not use advertising or analytics trackers, and we don't sell your data.

Why we use it

• To run your account and keep it secure.
• To calculate your results and show how they change over time.
• To let the AI coach answer using your actual scores and context.
• To send account emails — verification and password reset only.

Because your diagnostic answers relate to your wellbeing, we ask for your explicit consent before you begin the diagnostic. You can withdraw it at any time by deleting your account.

Who else handles your data

We use the following providers to run the service. They process data on our behalf and only for the purpose listed:

• Supabase (United States) — Database hosting — stores your account, answers, scores and coach history.
• Netlify (United States) — Web hosting — serves the app and runs its server functions.
• OpenAI (United States) — Powers the AI coach. Your messages, your scores and the facts the coach remembers are sent to generate each reply.
• Resend (United States) — Sends account emails (verification and password reset).

Under OpenAI's API data-usage policy, data sent through its API is not used to train its models by default, and may be retained for a limited period for abuse monitoring.

These providers are based in the United States, so your data is transferred outside your country. Where required, these transfers rely on appropriate safeguards such as Standard Contractual Clauses.

How long we keep it

We keep your data for as long as you have an account. When you delete your account, your profile, answers, scores, coach conversations and remembered facts are erased immediately and permanently. Copies may persist in encrypted database backups for a short period before those backups expire.

Your rights

You can do the following yourself, at any time, from Settings:

• Download your data — everything we hold about you, as a single file.
• Delete what the coach remembers, or individual conversations.
• Delete your account and all its data.

You also have the right to correct your data, object to or restrict how we use it, and complain to a data protection authority — [Data protection authority for the entity's country]. For any of these, contact [privacy@theflowai.io].

Cookies

We use three first-party cookies: one that keeps you signed in, one that protects the sign-in form against forgery, and one that remembers which page to return you to after signing in. All three are strictly necessary for the service to work, so they don't require consent. We use no analytics, advertising or third-party cookies.

Age

Flow for Many is for people aged 16 and over. We don't knowingly collect data from anyone younger.

Changes

If we change this policy in a way that matters, we'll tell you by email or in the app before the change takes effect. See also our Terms of Service.