Privacy Policy
Last updated: June 23, 2026
Flowsstate (“we”, “us”) builds a calm productivity app that helps you plan your day, focus, build habits, and actually end your workday. This policy explains what we collect, why, and the choices you have. We aim to collect as little as possible — and to be plain about it. It is written to align with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
What we collect
- Account details — your name and email address, and a securely hashed password (or a Google sign-in identifier if you use Google).
- Your content — the tasks, habits, goals, focus sessions, daily reviews, notes, and workspace data you create in the app. This is the core of the service.
- Usage & device data — basic technical logs (IP, browser type, timestamps) needed to operate and secure the service, and — only with your consent — product analytics (see below).
- Google Calendar data — only if you choose to connect Google Calendar, and only to read/write the events you schedule through Flowsstate.
How we use it
- To provide the app: store and sync your tasks, habits, goals, and reviews across your devices.
- To run features you ask for — for example, AI scheduling and the AI coach (see “AI & your data”).
- To keep your account secure and prevent abuse.
- To send essential service emails (e.g. email verification, password reset). We only send marketing or product emails with your consent, and every such email includes an unsubscribe link (CASL).
AI & your data
Some optional features (AI scheduling, the daily/weekly AI coach, smart suggestions) send the relevant task or review text to our AI provider, Google (Gemini API), to generate a response. We send only what’s needed for that feature — never your account name, email, or free-text notes. If you don’t use the AI features, no content is sent to Google. We do not sell your data, and we do not use your personal content to train any models of our own.
Cookies & analytics
We use strictly-necessary local storage to keep you signed in and to hold your preferences and offline data — this is required to run the app. Optional product analytics (PostHog) only load after you accept the consent banner, and you can decline with no loss of functionality. Analytics help us understand which features actually help people focus.
Who we share it with (sub-processors)
We use a small set of trusted providers to run the service. They process data only on our behalf:
- Railway / hosting & database — application hosting and storage.
- Paddle — payment processing for Pro subscriptions (handles your payment details; we never see your card number).
- Google (Gemini API) — AI features (only when you use them).
- Resend — transactional email.
- PostHog — product analytics (only with consent).
- Google — sign-in and Calendar sync (only if you connect them).
Data retention & your rights
We keep your data while your account is active. You can access, correct, export, or delete your data at any time. Deleting your account removes your personal content from our active systems. To exercise any of these rights, email flowsstateapp@gmail.com and we’ll respond within a reasonable time. You also have the right to complain to the Office of the Privacy Commissioner of Canada.
Security
We protect the service with HTTPS everywhere, a strict Content-Security-Policy, HSTS, rate limiting, password hashing, and access controls. No system is perfectly secure, but we take reasonable, industry-standard measures to protect your information.
Children
Flowsstate is not directed to children under 13, and we do not knowingly collect their data.
Changes
We’ll update this page when our practices change and revise the “last updated” date. Material changes will be communicated in-app or by email.
Contact
Questions? Get help in the app, or email flowsstateapp@gmail.com.