Privacy Policy

This policy explains what Flow State collects, why, and your choices. Controller: [Company name, address, contact email].

What we collect

• Account: your email address and optional name.
• Content: diagrams, images you upload, and AI chat history per diagram.
• AI key: your OpenRouter API key, stored encrypted (AES-256-GCM). It is never shown again, never sent to your browser, and deleted with your account.
• Integrations: personal access tokens (stored as hashes) and OAuth grants for apps you connect.
• Technical: session cookies, IP address for rate limiting and abuse prevention (reports store only a hashed IP).

Why

To provide the service (contract), keep it secure and prevent abuse (legitimate interest), and send sign-in emails. We do not sell personal data or use your diagrams to train models.

Processors

• Hosting: Vercel (or your self-hosted server)
• Database: MongoDB Atlas
• Email delivery: Resend
• AI (only when you use it, with your key): OpenRouter and the model provider you select

Cookies

Only essential cookies: your session and your appearance preference. No advertising or analytics cookies.

Public links

When you turn on a public link, anyone with the link can view that diagram. Links are not indexed by search engines unless you allow it.

Retention

We keep your data while your account exists. Change history is kept for 30 days. Deleting your account removes your data from our systems (backups expire within [N] days).

Your rights

Export everything or delete your account in Settings → Data & account. You can also contact us to access, correct, or object to processing, and complain to your data-protection authority.