Privacy Policy
This policy explains what Flow collects when you use the app and the website, why, who it's shared with, and what you can do about it. Flow is for people 18 and older. We don't sell your data, and we don't show ads.
What we collect
- Your account. Your email address, and your Google account if you sign in with Google. The name, photo, bio, skill level, and contact details or social handles you add to your profile.
- Your location. The ZIP code you enter, and the rough coordinates we work out from it, so we can show people and plans near you. When you allow it, your device location is used while the app is open: for the map, and on approaches you log.
- What you log. Approaches (outcome, ratings, notes, time, and place), sessions, and challenge progress.
- Dates. The contacts, dates, notes, and photos you keep in Dates, and your chats with the AI coach. This can include details about other people, like a name, phone number, or social handle. Only add what you have a good reason to keep.
- Social activity. Friends, follows, blocks, wingman plans, forum posts and replies, video comments, likes, and which videos you've watched. Coaches also have the videos they post and the Instagram or TikTok accounts they connect.
- Messages. Messages are end-to-end encrypted on your devices. Our servers store and pass along text we can't read. To deliver messages we keep each device's public key, and who is in each conversation, stored as scrambled ids.
- Reports. If you report someone, we keep the report and any details you send with it, including a reported message.
- Payments. If you add a card, Stripe holds the card. We only keep the brand, the last four digits, and a record of each charge.
- Technical data. Your sign-in sessions (when, and which browser), push notification subscriptions, and error reports when the app crashes. Our host keeps short-lived request logs, including IP addresses.
How we use it
To run Flow: sign you in, save and show your data, find people and plans nearby, deliver messages and notifications, and run the features you use. We also use it to keep Flow safe, which means stopping spam, scraping, and abuse and handling reports, and to fix bugs. We don't use your data for advertising, and we don't build profiles of you for anyone else.
Who can see what
- Other people on Flow see your public profile: your name, photo, bio, and skill level, plus your social handles unless you limit them to friends. They can also see what you post publicly, like forum posts, comments, plans, and videos. Nearby people can find you unless you turn off public visibility in Settings. Your contact details are only shown to friends.
- Your coach, if you join one, sees your approach stats and logs. Your Dates and coach chats are never shared with coaches or friends.
- Moderators (Flow's admins) can see reports and what was reported.
Services we use
These services handle data for us so Flow can work:
- Cloudflare hosts the app, the database, and uploaded photos and videos. When the AI coach is turned on, it runs on Cloudflare too.
- Google (Firebase) handles Google sign-in. The app's font also loads from Google Fonts.
- Resend sends the sign-in codes we email you.
- Stripe processes card payments and coach payouts.
- Zippopotam.us turns the ZIP code you enter into a city and rough location.
- OpenFreeMap serves map tiles. Your browser asks it for the part of the map you're looking at.
- Push services from Apple, Google, or Mozilla, depending on your browser, deliver notifications if you turn them on.
- Instagram and TikTok serve coaches' videos when they're shown in the feed. Discord is only involved if you link your Discord account.
We may also share information if the law requires it, or to protect someone's safety.
How long we keep it
We keep your data while you have an account. When you delete something, it's removed. When you delete your account, everything is removed right away from the live database and storage, except what we have to keep by law, such as payment records held by Stripe. Database backups roll off within 30 days, and request logs within a few days.
Your choices
- Download your data: Settings → Your data → Download my data gives you one file with everything we store about you.
- Delete your account: Settings → Your data → Delete account. This deletes your profile, logs, Dates, friends, messages, forum threads (including replies in them), and videos.
- Edit or remove your profile details, location, Dates, and posts at any time in the app.
- Control visibility and notifications in Settings, and block anyone you don't want to hear from.
Depending on where you live (for example California, the EU, or the UK), you may have the right to access, correct, delete, or move your data, and to object to how it's used. Use the tools above or email us. We'll answer within 30 days.
Security
Everything is sent over HTTPS. Messages are end-to-end encrypted. Who talks to whom, and reported messages, are encrypted at rest. Access to production data is limited to Flow's admins. No system is perfectly secure. If a breach affects you, we'll tell you.
Children
Flow isn't for anyone under 18. If we learn that an account belongs to someone under 18, we'll delete it.
Changes
If we change this policy, we'll update the date at the top. For big changes we'll also tell you in the app.
Contact
Questions or requests: privacy@flowstates.xyz.